2f443c41885f17a63eb87947beecea91d2a18f50c3e83c3ddc9f2f26a54e90b6

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261027-lm3cdadb67
SHA256 2f443c41885f17a63eb87947beecea91d2a18f50c3e83c3ddc9f2f26a54e90b6
MD5 aa51e71141dbea65ff56a7dcd795e26b
SHA1 ee515f5921160c0fae8440e5d1acb0ed0bcb1fbb
SHA512 5a0af7c6fc4f41043aa5f00436f998d9907e4f151274b726885dd21090bb9e7040e2055afe81d086e907be5499d2c0dfd187281e4bfc21c0daf43261747dca3b
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T11734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2480	CP.exe
5112	vpnifavqni.exe
384	CP.exe
1232	CP.exe
4420	i_vpnifavqni.exe
1628	pkicausnkf.sys
1596	CP.exe
4148	fzxspkhcau.exe
3480	CP.exe
5060	CP.exe
2416	i_fzxspkhcau.exe
2304	nhfzxrpkhc.sys
3420	CP.exe
1508	xsmkecxupm.exe
4988	CP.exe
2296	CP.exe
2884	i_xsmkecxupm.exe
4900	czusmkecwu.sys
3780	CP.exe
3896	uomhbzusmk.exe
2104	CP.exe
4772	CP.exe
2316	i_uomhbzusmk.exe
4620	rpjhbzurmj.sys
4708	CP.exe
2672	jecwuomgez.exe
3772	CP.exe
544	CP.exe
2944	i_jecwuomgez.exe
4540	gbytrljdbw.sys
4500	CP.exe
1544	ztrljebwto.exe
3276	CP.exe
3796	CP.exe
1936	i_ztrljebwto.exe
2304	geywqoigby.sys
3664	CP.exe
1400	qlidbvtnlg.exe
4756	CP.exe
940	CP.exe
4168	i_qlidbvtnlg.exe
5040	ysqlidbvtn.sys
1900	CP.exe
4912	qljdbvtnlg.exe
1932	CP.exe
2248	CP.exe
1660	i_qljdbvtnlg.exe
4352	qkicavsnlf.sys
1768	CP.exe
4852	idavtnigay.exe
1328	CP.exe
4320	CP.exe
4376	i_idavtnigay.exe
900	kicavsnkfd.sys
4032	CP.exe
2264	dxvpnhfaxs.exe
3236	CP.exe
2004	CP.exe
212	i_dxvpnhfaxs.exe
2080	kfzxspkica.sys
4492	CP.exe
1620	smkecwupmh.exe
632	CP.exe
2740	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnigay.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5072	ipconfig.exe
4892	ipconfig.exe
2640	ipconfig.exe
5076	ipconfig.exe
2968	ipconfig.exe
2916	ipconfig.exe
2032	ipconfig.exe
3392	ipconfig.exe
3316	ipconfig.exe
3524	ipconfig.exe
4612	ipconfig.exe
3640	ipconfig.exe
3264	ipconfig.exe
4188	ipconfig.exe
4968	ipconfig.exe
176	ipconfig.exe
4612	ipconfig.exe
4328	ipconfig.exe
2944	ipconfig.exe
656	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499858966"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec980000000000200000000001066000000010000200000003258ed3d22cc2c77fce6dd4dc523ef0bfb5bab6a1f758188df9ee367ddd665b0000000000e8000000002000020000000dfcf5f680ade817e00ec8b3503ffa29ef6ee4ed9a3c414f794f3296c4876b615200000005a3a7ebbaecbf31080a2440882e5900cf2d008015ce4b5a25924f3776867c9a840000000eca1277fd6de54ab4dbdeeac0e42af180d4ec606d0d9cbef88e939dab5b80731d3300b9c1fd253af8a8aeec11b75823e99801e9a3a4caaa20e3a946a04dcbf40	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5B8AB87B-D1EA-11F1-8D83-46FEC571B403} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7005be30f765dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286775"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "824331785"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "832456389"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec98000000000020000000000106600000001000020000000a93d4ebd3c3112703eed8f63c4ab192efb80628ec9f9c3abba3d07bca091e437000000000e800000000200002000000013563e1b87a0f7c531d136ca6793b14e74d8917bf4cd7197f9f4e3f1474dfedc2000000061769b16cd13c0d438b2550f0e39d406f92bcce44c61242a45d7a31504ad47084000000049b59b09116ee75ef7a95375359a1d237a256e23a76ab028ac40a9b01e836386304b4ace9f56dfaef86d68cfaed8b02d86a0e961a794fec26fbb0bf26c966ec7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9000b730f765dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286775"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	i_vpnifavqni.exe
Token: SeDebugPrivilege	2416	i_fzxspkhcau.exe
Token: SeDebugPrivilege	2884	i_xsmkecxupm.exe
Token: SeDebugPrivilege	2316	i_uomhbzusmk.exe
Token: SeDebugPrivilege	2944	i_jecwuomgez.exe
Token: SeDebugPrivilege	1936	i_ztrljebwto.exe
Token: SeDebugPrivilege	4168	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	1660	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	4376	i_idavtnigay.exe
Token: SeDebugPrivilege	212	i_dxvpnhfaxs.exe
Token: SeDebugPrivilege	2440	i_smkecwupmh.exe
Token: SeDebugPrivilege	5028	i_urmkecwupm.exe
Token: SeDebugPrivilege	1500	i_rmjecwuomg.exe
Token: SeDebugPrivilege	4940	i_jgbztrljeb.exe
Token: SeDebugPrivilege	2176	i_trljdbwtol.exe
Token: SeDebugPrivilege	4412	i_ytqlidbvtn.exe
Token: SeDebugPrivilege	656	i_tnlfdyvqki.exe
Token: SeDebugPrivilege	4892	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	5020	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	684	i_hczusmkfcx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
4216	IEXPLORE.EXE
4216	IEXPLORE.EXE
4216	IEXPLORE.EXE
4216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2052	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	84
PID 2052 wrote to memory of 4216	2052	iexplore.exe	85
PID 3920 wrote to memory of 2480	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5112 wrote to memory of 384	5112	vpnifavqni.exe	91
PID 3920 wrote to memory of 1232	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	96
PID 3920 wrote to memory of 1596	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 4148 wrote to memory of 3480	4148	fzxspkhcau.exe	105
PID 3920 wrote to memory of 5060	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 3920 wrote to memory of 3420	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 1508 wrote to memory of 4988	1508	xsmkecxupm.exe	114
PID 3920 wrote to memory of 2296	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 3920 wrote to memory of 3780	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 3896 wrote to memory of 2104	3896	uomhbzusmk.exe	123
PID 3920 wrote to memory of 4772	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 3920 wrote to memory of 4708	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 2672 wrote to memory of 3772	2672	jecwuomgez.exe	133
PID 3920 wrote to memory of 544	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3920 wrote to memory of 4500	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1544 wrote to memory of 3276	1544	ztrljebwto.exe	143
PID 3920 wrote to memory of 3796	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 3920 wrote to memory of 3664	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 1400 wrote to memory of 4756	1400	qlidbvtnlg.exe	152
PID 3920 wrote to memory of 940	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 3920 wrote to memory of 1900	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4912 wrote to memory of 1932	4912	qljdbvtnlg.exe	161
PID 3920 wrote to memory of 2248	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 3920 wrote to memory of 1768	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4852 wrote to memory of 1328	4852	idavtnigay.exe	170
PID 3920 wrote to memory of 4320	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 3920 wrote to memory of 4032	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 2264 wrote to memory of 3236	2264	dxvpnhfaxs.exe	179
PID 3920 wrote to memory of 2004	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 3920 wrote to memory of 4492	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 1620 wrote to memory of 632	1620	smkecwupmh.exe	188
PID 3920 wrote to memory of 2740	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 3920 wrote to memory of 612	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 1884 wrote to memory of 4652	1884	urmkecwupm.exe	197
PID 3920 wrote to memory of 848	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 3920 wrote to memory of 2804	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 1012 wrote to memory of 2208	1012	rmjecwuomg.exe	206
PID 3920 wrote to memory of 4352	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 3920 wrote to memory of 3268	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 4924 wrote to memory of 4020	4924	jgbztrljeb.exe	215
PID 3920 wrote to memory of 1424	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 3920 wrote to memory of 4628	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	222
PID 4848 wrote to memory of 1504	4848	trljdbwtol.exe	224
PID 3920 wrote to memory of 4052	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 3920 wrote to memory of 508	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	231
PID 3656 wrote to memory of 5012	3656	ytqlidbvtn.exe	233
PID 3920 wrote to memory of 5080	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 3920 wrote to memory of 928	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 1288 wrote to memory of 2868	1288	tnlfdyvqki.exe	242
PID 3920 wrote to memory of 616	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 3920 wrote to memory of 2680	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 3392 wrote to memory of 1364	3392	nhfaxsqkic.exe	251
PID 3920 wrote to memory of 1708	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 3920 wrote to memory of 4716	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 3920 wrote to memory of 1060	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 3920 wrote to memory of 1800	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 3616 wrote to memory of 3156	3616	hczusmkfcx.exe	269
PID 3920 wrote to memory of 4736	3920	2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_aa51e71141dbea65ff56a7dcd795e26b_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifavqni.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480
- - C:\Temp\vpnifavqni.exe
    C:\Temp\vpnifavqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifavqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Temp\i_vpnifavqni.exe
    C:\Temp\i_vpnifavqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Temp\fzxspkhcau.exe
    C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\i_fzxspkhcau.exe
    C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsmkecxupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Temp\xsmkecxupm.exe
    C:\Temp\xsmkecxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsmkecxupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2296
- - C:\Temp\i_xsmkecxupm.exe
    C:\Temp\i_xsmkecxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhbzusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Temp\uomhbzusmk.exe
    C:\Temp\uomhbzusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhbzusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Temp\i_uomhbzusmk.exe
    C:\Temp\i_uomhbzusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Temp\jecwuomgez.exe
    C:\Temp\jecwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:544
- - C:\Temp\i_jecwuomgez.exe
    C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\ztrljebwto.exe
    C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3796
- - C:\Temp\i_ztrljebwto.exe
    C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\qlidbvtnlg.exe
    C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:940
- - C:\Temp\i_qlidbvtnlg.exe
    C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2248
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1768
- - C:\Temp\idavtnigay.exe
    C:\Temp\idavtnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\i_idavtnigay.exe
    C:\Temp\i_idavtnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4032
- - C:\Temp\dxvpnhfaxs.exe
    C:\Temp\dxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2004
- - C:\Temp\i_dxvpnhfaxs.exe
    C:\Temp\i_dxvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2740
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwupm.exe ups_run
  2⤵
  PID:612
- - C:\Temp\urmkecwupm.exe
    C:\Temp\urmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwupm.exe ups_ins
  2⤵
  PID:848
- - C:\Temp\i_urmkecwupm.exe
    C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:2804
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:4352
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljeb.exe ups_run
  2⤵
  PID:3268
- - C:\Temp\jgbztrljeb.exe
    C:\Temp\jgbztrljeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljeb.exe ups_ins
  2⤵
  PID:1424
- - C:\Temp\i_jgbztrljeb.exe
    C:\Temp\i_jgbztrljeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtol.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\trljdbwtol.exe
    C:\Temp\trljdbwtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtol.exe ups_ins
  2⤵
  PID:4052
- - C:\Temp\i_trljdbwtol.exe
    C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqlidbvtn.exe ups_run
  2⤵
  PID:508
- - C:\Temp\ytqlidbvtn.exe
    C:\Temp\ytqlidbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqlidbvtn.exe ups_ins
  2⤵
  PID:5080
- - C:\Temp\i_ytqlidbvtn.exe
    C:\Temp\i_ytqlidbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqki.exe ups_run
  2⤵
  PID:928
- - C:\Temp\tnlfdyvqki.exe
    C:\Temp\tnlfdyvqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqki.exe ups_ins
  2⤵
  PID:616
- - C:\Temp\i_tnlfdyvqki.exe
    C:\Temp\i_tnlfdyvqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  PID:2680
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  PID:1708
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  PID:4716
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  PID:1060
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkfcx.exe ups_run
  2⤵
  PID:1800
- - C:\Temp\hczusmkfcx.exe
    C:\Temp\hczusmkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkfcx.exe ups_ins
  2⤵
  PID:4736
- - C:\Temp\i_hczusmkfcx.exe
    C:\Temp\i_hczusmkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:684

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
- Executes dropped EXE
PID:1628

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:2304

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:4900

C:\Temp\rpjhbzurmj.sys
C:\Temp\rpjhbzurmj.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\gbytrljdbw.sys
C:\Temp\gbytrljdbw.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
- Executes dropped EXE
PID:2304

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:5040

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\kicavsnkfd.sys
C:\Temp\kicavsnkfd.sys
1⤵
- Executes dropped EXE
PID:900

C:\Temp\kfzxspkica.sys
C:\Temp\kfzxspkica.sys
1⤵
- Executes dropped EXE
PID:2080

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:928

C:\Temp\zwrpjhbzur.sys
C:\Temp\zwrpjhbzur.sys
1⤵
PID:3140

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
PID:2616

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
PID:4540

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:4752

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
PID:2440

C:\Temp\ysnlfdxvpn.sys
C:\Temp\ysnlfdxvpn.sys
1⤵
PID:4884

C:\Temp\xsqkicavsn.sys
C:\Temp\xsqkicavsn.sys
1⤵
PID:4536

C:\Temp\snhfzxrpkh.sys
C:\Temp\snhfzxrpkh.sys
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwu.sys

Path C:\Temp\czusmkecwu.sys
Size 141KB
SHA256 b87ea5ed13c9e225a49843fc85771a788a1e77b1b37ace677fb17cc4ae9d6298
MD5 992047e573d8ee4bc3759a4aec0fb5c7
SHA1 45a6ffdf61fc34faf898b598088d946b5bb73b5d
SHA512 c20a001ba7c6e7bad1b8a2dfa89ca9bb70bacb9cc02c96dc67fe1139840949b1ee877f680b8adee23334b39df1b5e56feb475c451e870bc26088916233b43c13
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhcau.exe

Path C:\Temp\fzxspkhcau.exe
Size 226KB
SHA256 15030f7fbfa7380fcc087f027658f0d4fdda05670f805fa1730808ee6ce5ef87
MD5 d2f04cc161b20eccf4b5e706850f7e34
SHA1 d585e0a7f231ea321d75082f3d9f1e87915f70e6
SHA512 eab46e5aef22ffc103842865356d3c0238224ddab0f0cd846cacb8dca6c6e5df756968fa32f76da10cf7835448b516442ab6d6cf754ee14af8c607910b1013eb
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T1C434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.sys

Path C:\Temp\gbytrljdbw.sys
Size 141KB
SHA256 a45de63eb37386c50c18d8f76ca4daf526893a6b91f5ec3367c144ed0a5c881a
MD5 519a7f4a0a2b3a556dca31b6bf0c669b
SHA1 556c50fbddeb0c335cccacfda767f48a1fc19749
SHA512 1919d41d61711136cb2375e951bd1dc5358b0702acc4cea7b813ca61c507cb8ee4975b9010b248bd87d424375bcf4fa700a7cd0cb30c2d82daee8357a9ad8aaa
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.sys

Path C:\Temp\geywqoigby.sys
Size 141KB
SHA256 891338b42f7929e3288302562bfd0a20e4a6a9c8380df13319e2008635ddff6f
MD5 8135fb30b92c81237023c0b342b55c01
SHA1 09250f2cc76e119ff381aef63df5f4edee699cd9
SHA512 007cb2bdbe6713ce6ad10820002402809c791ee5d7f97af3dc0891698b1c41556de5f16a29fe5e11affc49977f6a3c1e27dba7b25dfcf88d1be6b906425c5739
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkhcau.exe

Path C:\Temp\i_fzxspkhcau.exe
Size 226KB
SHA256 62faf6ce352fc09332efdfad79aa95392f926aebaada28a67d06268f05a118a6
MD5 5b6db53420505c0e4ed05e245bd39841
SHA1 7fe2fe9b4b9b964440fbf002eb7efe62a38a59f3
SHA512 46c6a3854b4a4504be043fac1d52335ed4a61dee0c1cc6c2a9a304d7147fa48958deb06fda9c1c557ee53dcfa045925fc395b53f360395c19b50514453ab8177
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1E634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jecwuomgez.exe

Path C:\Temp\i_jecwuomgez.exe
Size 226KB
SHA256 cf21d8c8b6ecccdf274421d74da27bd661a29087f12a409cbb0c11a4866a396b
MD5 0b886e78dd43682779451605cba4382c
SHA1 441bc91f363f275266efea33e20b9b5f19b86e96
SHA512 891f0b355da051816bb0cfc9a4dc91239fe1bd86a3d770f5403e163be79fb756ffcbdabfeecb30181efd5a4f5de122b12a98fedcee166bb24ff23cad97e8a83f
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvtnlg.exe

Path C:\Temp\i_qlidbvtnlg.exe
Size 226KB
SHA256 ac7f4d2bfeef8c46f551eb5392c232a2e4f2c294d4b957f9c7932d0432ec6af8
MD5 e5a5f1ccbd8cd26644fa0c80c31fb3c3
SHA1 aa561965e63b09fb9d9ae7e2e99f26feefe88b7d
SHA512 d8b84abbb992860973d83ddb42b831fcb8c372ad7204518322c90c168934bc536edd435f142e65b6611082df7d9f90bb23141a9b91ef9df25c439e5b8d399004
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhbzusmk.exe

Path C:\Temp\i_uomhbzusmk.exe
Size 226KB
SHA256 25305008caae98c268eb99650f9d396ea5c8e2226a8eadaa03791d4574523dcd
MD5 7d30d17d51912eb8d591de4ee0851e8c
SHA1 95cbb3499fbe67cfb94731978ce038eba14401c5
SHA512 62fee56ef632b0791779c9e6de3f3fbf267d3769af0bdc2a25ae0ad993c3f9d578bf1db1cd0f41c3ca259a7020244497858d4403bb7cb6d2d9633827a56cc12a
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnifavqni.exe

Path C:\Temp\i_vpnifavqni.exe
Size 226KB
SHA256 058e1a0234838a12ca99cd11f90ec3b0201a002ed2ba1e60e16d096127278002
MD5 a7587e7ff997deb39e44357ac8270e72
SHA1 0db2a25f6c592c26d91637f4764c2763f3cbaa0d
SHA512 ecc0050faacd414b9f4d2e6d2260668bf7fe4f2133680d8571f1e394cfca667c19aa38985c7b7a76c3c16dc363d93ee7d6fc47a3be968ea6e40123e457916301
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T12834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsmkecxupm.exe

Path C:\Temp\i_xsmkecxupm.exe
Size 226KB
SHA256 961665d0d0acf3991a70d6ff66ee158212c9fd951a44b00ea088eff7baf19e28
MD5 45ce5f71671b2924788e5dded81652f8
SHA1 241fb1360a230c0e4af0c4ad10e5a25c7c175615
SHA512 de1caa41aa094b05247efda39f73e6556f6e87bdd9031ca6d4028bbb5b99cfa25b26f4e3e2fccb22dd05a185feb0e4c924e3e5fab792d9461faaa5c163290ef8
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1CE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljebwto.exe

Path C:\Temp\i_ztrljebwto.exe
Size 226KB
SHA256 1b27563ff1b9b5d75e8f87fba6d5f9c1985d519de7f8825b012bc0a9a59c7d76
MD5 13f01a335b0a98ce521b395226abcfb6
SHA1 80d3792177be4c67534cd9020e1d171850c9a92b
SHA512 20ffa9f3734264ae929006f1331a01ef558e8635287c6ef4b0fc7d14fa13aceea308549dd4343fddc341e178669aaa2e0c69789e9ecd6bbcd0d6ca4978af94bb
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1FE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomgez.exe

Path C:\Temp\jecwuomgez.exe
Size 226KB
SHA256 c0d445b2118eb924bb48c52f23940eb5a3d2215f3f0be93213c6b980cf896634
MD5 6ac3372ce5063587cb764f7d1f56a69a
SHA1 c9186bfd896a1fa81fff2cdcc8cfadb385eac997
SHA512 7405b89622d7d8538037cd9367558b0f5f25b797e055e1711a2dffef4c07b923e954201d506b2ec2f11f728b776240aba041e9a90b563337948a6b07e545075d
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T18834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxrpkhc.sys

Path C:\Temp\nhfzxrpkhc.sys
Size 141KB
SHA256 f053fe5d728e8b77a0d8ddf0fc5bc41d1267373c42fc0afafaa943251b7f6596
MD5 80d22377d30cf71bd34baa330bc61e6c
SHA1 96fdc8edd503b4f1060d2c9516c58e48a1b881a1
SHA512 b804dc040810c1f20e82639c86610f486eea3dfe6e5c8a55f4c85334f9e1d9d515862dfeadc9c5d06b18fd52ad45ac38400fef457b1901ee5d0fba0055bc7553
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.sys

Path C:\Temp\pkicausnkf.sys
Size 141KB
SHA256 effae920624be4ecc8047c915df14049744dab46c55078fb54a7a8800b76023b
MD5 a4ab9326f608da24c34cec662306d7a1
SHA1 c362934b9262b1af5c3535475a01f114f2a3ed90
SHA512 4aa1fb9717c73ee83362b0d67ea24294f18d3246449f6ddb501bd24f99fec15e7d4791ebbb75926e5dbe84914039d4c56502c3c95f5ef1bb17652cd9ddd575f8
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.exe

Path C:\Temp\qlidbvtnlg.exe
Size 226KB
SHA256 55c5b4fe1c0bfb37e33475e6f76467bf930b24ad8ca54fb52491f177fdedc17e
MD5 391a79ad482be384edf14a156243c480
SHA1 db8170b84e0f1a190ffe3e54fac8dd8a75a97669
SHA512 29b14bd72d52ac06aa77acfb8769b038eaef12c2094896d6d3609d27f47a32f0f3ac33774a93f64070b000e4dbf52beb06512b6d5c8f11c534adcb1d794af31d
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T1EA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlg.exe

Path C:\Temp\qljdbvtnlg.exe
Size 226KB
SHA256 011513443cbc58ed5220f59bad2d3fee12b0827bcd2559b8b2acfc23e9cc8cb6
MD5 00c8b2d4c819386f27f84c42513ecd2f
SHA1 7a12d0f9ad6f8e00e286c4cb8fa64cd2608af386
SHA512 c40325f205a7a3783377b7ac495c4652a183131ffb85453dcfde4862d160c7ef48ff7f675a8ba1006a94a7ae163eaaf2d7287716deb66c45339092e740e12d22
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzurmj.sys

Path C:\Temp\rpjhbzurmj.sys
Size 141KB
SHA256 d978bb8795d4311c252716135fa83758df61ffdcf7e9012e2d612eff59d00160
MD5 f0be28bd4050737ebe222eec89bda29f
SHA1 4c6219d02572aba20b196a7e7f70941f37d0c3d3
SHA512 9798679b1a1dd03692932fb5ead2193f57ac26f0a47922df2dd800c708b1f022d0573e3786b1b9382695be355fd8774e1c593b8395c070fc69e2e5f7f8b66891
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T188E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhbzusmk.exe

Path C:\Temp\uomhbzusmk.exe
Size 226KB
SHA256 06ee0a0d9d9cf2d44e2e50524205c11c24ccb5ed1183de4161fdd1dbdc26c016
MD5 cf113bc13a6b0729cd5caa73baa8fe68
SHA1 e344b6709d17756df4e5cf705a837fd5ad4b56e7
SHA512 3d5a7e4e288ccaf1bbabff3b110a216b2b21a08bdb9f8bc9e58965268fa3a0e0d03dc175a47d83eaad35ae4badca4599b48545cffb21bb5901878e8b7aab6971
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifavqni.exe

Path C:\Temp\vpnifavqni.exe
Size 226KB
SHA256 0ccf0e0901a255a17365fafffa64e27f0fd0531b1a277c3528204110f2e4d01e
MD5 03876c5d676b5f4b3ef76c110bd405d2
SHA1 d4fbcaf10204c10b10be137f7e6dbbea57c03588
SHA512 1b1cde99781b506dc088c992cdc98c0a5479bb11b678b553e235ecd87645870216914c3bd6a3d0b7efe9a797db1719144e775be75c065642ba5050412c362ca5
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T13034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkecxupm.exe

Path C:\Temp\xsmkecxupm.exe
Size 226KB
SHA256 5657999178ecd33299eed6bd7d9f4f695b94288a0472df675aa0fef10714d31b
MD5 e59b1de295107fc242121415d22fc252
SHA1 f32356cc64ce2defe8fc6c3a89e43b5d0e5cd9df
SHA512 d8e64ab56f4c47a6b532c3f991ec53825d383f19292471b44a03924663e6c8854cd17bfbb4bced9007ed4b2dd6a5371d52e56a1a6cec294bf881a159450560ac
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.sys

Path C:\Temp\ysqlidbvtn.sys
Size 141KB
SHA256 3fd4adec44eb4c4f565af51b38c500b832f4c80f4301c01f3196c90290b07281
MD5 608d009797e86f985e4756fa0ca88638
SHA1 0aefdc8f2aef5814081e16f1a20e940194ff2d7d
SHA512 773c5b9d8fd055e4b4e70c77212d92cc8a224ee85fe3eef02c1122aaff1547f9fd592ddb1d4c9f29c4ead7f7c46be033966a036c7cdfeb2140c23ff1a9422f29
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwto.exe

Path C:\Temp\ztrljebwto.exe
Size 226KB
SHA256 60a95a45229adcf06a38821c3c5313a5d7b73ed7ecff0a8d745df43885c22022
MD5 3a69986f49229a368510d885b36c0671
SHA1 a5461cf217a7932aac75ca083784abfcca34dc20
SHA512 573330f5ba57911b486ad60f7c93010bcdbd8dc1836e5b87538e01ef02946f734d1c9e01d0aadf64356afce09c544598e6abc97b6091106841bcfebefd0a6888
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T17034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 b8de7e94a4623204dc6106389acdbd1809b61bfaa341a30f772eaf30cac8cdc3
MD5 153bf4040de2b2d7cc1e79af3e134669
SHA1 f3c3e10128260600f854c5a83841332e69a7d5c3
SHA512 95d4fa158fe6d1024cd6ac29bf4855ffe7a7d546c91c81fde25ebd7be3d337b2ceac798139adef8f860a376063296b70f8765c4f9ba0f730ad4e7a44e060f122
TLSH
T1CDF05447E069F4503DC144DC02D80A25303013B61886C055F1B408A10E383EA2E4F838
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 524c0dfde70cc8c194e5507444fe9c41e7445304efd1f10933128220aa01485a
MD5 b7de3c14ba3e09cd98daaf6907c94d6a
SHA1 6dbf14d510487e44a461edbb3050b52de3e82726
SHA512 6c5df5348b65c5d9aa2ace0ae8340a6ec7f0bad0bd00eec051186c5fc294cc6ba06679c72bdd4135e31c25e4586b24a9dc4fed82477756a4408a9126489ee688
TLSH
T15DE0C03411FF011EF5F4D0344FD67425445AF133241AA2B42EC85F04BB02A40BC03B2A
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/928-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2440-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2616-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4752-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4884-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5040-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads