8b3df5dea52695fceb98e12a58fc4f49e024eb902ab52ad49bd94e3a423afa15

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261104-s56ababs5x
SHA256 8b3df5dea52695fceb98e12a58fc4f49e024eb902ab52ad49bd94e3a423afa15
MD5 7faeb4aba946f8b042855697239d20a8
SHA1 ea82f25bad595852afdf3d992013fb4a9991e92d
SHA512 95ea20d605af9152d712617f17ba67351f51c8640d6463f869a306e155cf006b31360595c0eab67dbd81ccc4c6f8104c54200d1595059c208eadf3c6b1f0ca4a
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
620	CP.exe
5816	nlfdyvqlid.exe
4852	CP.exe
2360	CP.exe
5196	i_nlfdyvqlid.exe
4312	qnifaysqki.sys
5324	CP.exe
3812	fdxvpnifax.exe
5040	CP.exe
5068	CP.exe
5220	i_fdxvpnifax.exe
4436	kfdxvpnhfa.sys
4444	CP.exe
4584	vpnhfaxsqk.exe
4572	CP.exe
2972	CP.exe
4760	i_vpnhfaxsqk.exe
3992	upnhfzxrpk.sys
3656	CP.exe
6000	nhfzxspkic.exe
1196	CP.exe
4812	CP.exe
4192	i_nhfzxspkic.exe
1948	pjhczusmke.sys
1908	CP.exe
544	fzxrpjhczu.exe
5108	CP.exe
2104	CP.exe
3788	i_fzxrpjhczu.exe
4544	zurmjecwuo.sys
4796	CP.exe
5568	omgeztrlje.exe
3280	CP.exe
5076	CP.exe
4756	i_omgeztrlje.exe
5524	wuomgeywro.sys
5664	CP.exe
3972	gbytrljdbw.exe
5512	CP.exe
1416	CP.exe
5196	i_gbytrljdbw.exe
652	ljdbwtomge.sys
5232	CP.exe
5148	bytrljdbvt.exe
5552	CP.exe
464	CP.exe
5212	i_bytrljdbvt.exe
2260	dbvtnlgdyw.sys
4208	CP.exe
5404	vqoigaytql.exe
4652	CP.exe
5344	CP.exe
3312	i_vqoigaytql.exe
4384	ysqkidavsn.sys
4196	CP.exe
4772	qlidavtnlf.exe
2920	CP.exe
2180	CP.exe
3060	i_qlidavtnlf.exe
5432	aysqkidavt.sys
5164	CP.exe
5252	kfdxsnkfcx.exe
664	CP.exe
1900	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavtnlf.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
372	ipconfig.exe
4848	ipconfig.exe
3352	ipconfig.exe
4272	ipconfig.exe
1232	ipconfig.exe
4148	ipconfig.exe
4032	ipconfig.exe
3808	ipconfig.exe
3192	ipconfig.exe
3248	ipconfig.exe
5228	ipconfig.exe
5716	ipconfig.exe
204	ipconfig.exe
1888	ipconfig.exe
4804	ipconfig.exe
4248	ipconfig.exe
1148	ipconfig.exe
6140	ipconfig.exe
2228	ipconfig.exe
3768	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31288435"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1365822002"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000bb6cc820bcee0b2cb330c4b30cf787ee42f5c06b76bd19dce0de7f65c7ebf5b6000000000e800000000200002000000006f7e163075c4a904a0c1a27d959ff22b5f2ea63eea57db5e39d9ba10fca54bd200000004ff3bb5e0d559c477769a5d430eee23e17849535c5576b282c2ae0de2494277d4000000008db287b927266a20329146288fa74edf85029a0294ab993f9861f5d6c2fc2022a2e2381d1b8c6730e37bfb482353aabc4d3a23a5f8b6cad347151bed9390927	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1362692578"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0aaa953736cdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7C926026-D866-11F1-8FDF-466A5CF93802} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500571986"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31288435"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000d050d230b823bb5a50573fe011369df4837b2e64467240a25db25d90c91816fd000000000e8000000002000020000000f88a7b7b5b23a71bbf51ef051d02c975f53156bc52518620abd139b981be990220000000c14f4ab874ec695d9218f530f15bbc990302d3677adc673458a9fa2f6a0b0672400000009a0284ed73536d5beee7b4c410c68ac6f8675e8c2ac56f392514358c0561a49e7efe40642610acc9063e385bd9ce15dc8a16539ba1254e4d556dfbe2082a4b3d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c065ae53736cdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	i_nlfdyvqlid.exe
Token: SeDebugPrivilege	5220	i_fdxvpnifax.exe
Token: SeDebugPrivilege	4760	i_vpnhfaxsqk.exe
Token: SeDebugPrivilege	4192	i_nhfzxspkic.exe
Token: SeDebugPrivilege	3788	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	4756	i_omgeztrlje.exe
Token: SeDebugPrivilege	5196	i_gbytrljdbw.exe
Token: SeDebugPrivilege	5212	i_bytrljdbvt.exe
Token: SeDebugPrivilege	3312	i_vqoigaytql.exe
Token: SeDebugPrivilege	3060	i_qlidavtnlf.exe
Token: SeDebugPrivilege	5764	i_kfdxsnkfcx.exe
Token: SeDebugPrivilege	3884	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	4788	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	2884	i_cwuomhezxr.exe
Token: SeDebugPrivilege	372	i_wrojhbztrl.exe
Token: SeDebugPrivilege	5896	i_wtomgeywqo.exe
Token: SeDebugPrivilege	4420	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	5448	i_kidavtnlfd.exe
Token: SeDebugPrivilege	204	i_qdavsnlfdx.exe
Token: SeDebugPrivilege	4880	i_kicausnkfc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5284	iexplore.exe
5284	iexplore.exe
4592	IEXPLORE.EXE
4592	IEXPLORE.EXE
4592	IEXPLORE.EXE
4592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 5284	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 5284 wrote to memory of 4592	5284	iexplore.exe	86
PID 5540 wrote to memory of 620	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 5816 wrote to memory of 4852	5816	nlfdyvqlid.exe	90
PID 5540 wrote to memory of 2360	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 5540 wrote to memory of 5324	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3812 wrote to memory of 5040	3812	fdxvpnifax.exe	104
PID 5540 wrote to memory of 5068	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 5540 wrote to memory of 4444	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 4584 wrote to memory of 4572	4584	vpnhfaxsqk.exe	116
PID 5540 wrote to memory of 2972	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5540 wrote to memory of 3656	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 6000 wrote to memory of 1196	6000	nhfzxspkic.exe	126
PID 5540 wrote to memory of 4812	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5540 wrote to memory of 1908	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 544 wrote to memory of 5108	544	fzxrpjhczu.exe	137
PID 5540 wrote to memory of 2104	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 5540 wrote to memory of 4796	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5568 wrote to memory of 3280	5568	omgeztrlje.exe	147
PID 5540 wrote to memory of 5076	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 5540 wrote to memory of 5664	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 3972 wrote to memory of 5512	3972	gbytrljdbw.exe	156
PID 5540 wrote to memory of 1416	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 5540 wrote to memory of 5232	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 5148 wrote to memory of 5552	5148	bytrljdbvt.exe	165
PID 5540 wrote to memory of 464	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 5540 wrote to memory of 4208	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 5404 wrote to memory of 4652	5404	vqoigaytql.exe	174
PID 5540 wrote to memory of 5344	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 5540 wrote to memory of 4196	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4772 wrote to memory of 2920	4772	qlidavtnlf.exe	183
PID 5540 wrote to memory of 2180	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 5540 wrote to memory of 5164	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 5252 wrote to memory of 664	5252	kfdxsnkfcx.exe	192
PID 5540 wrote to memory of 1900	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 5540 wrote to memory of 4360	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 2584 wrote to memory of 5060	2584	kfcxvpnhfa.exe	201
PID 5540 wrote to memory of 5652	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 5540 wrote to memory of 5228	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 4016 wrote to memory of 3068	4016	fzxrpjhczu.exe	210
PID 5540 wrote to memory of 2652	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 5540 wrote to memory of 4636	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 5312 wrote to memory of 1032	5312	cwuomhezxr.exe	219
PID 5540 wrote to memory of 736	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	222
PID 5540 wrote to memory of 3032	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 5128 wrote to memory of 3728	5128	wrojhbztrl.exe	228
PID 5540 wrote to memory of 5416	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	231
PID 5540 wrote to memory of 448	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 1436 wrote to memory of 3612	1436	wtomgeywqo.exe	237
PID 5540 wrote to memory of 1740	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 5540 wrote to memory of 1256	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 4048 wrote to memory of 5152	4048	qljdbvtnlg.exe	246
PID 5540 wrote to memory of 1464	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 5540 wrote to memory of 3808	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 3600 wrote to memory of 4396	3600	kidavtnlfd.exe	255
PID 5540 wrote to memory of 3732	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 5540 wrote to memory of 3448	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 5496 wrote to memory of 2300	5496	qdavsnlfdx.exe	262
PID 5540 wrote to memory of 2676	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	265
PID 5540 wrote to memory of 1548	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 2164 wrote to memory of 3804	2164	kicausnkfc.exe	269
PID 5540 wrote to memory of 5900	5540	2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7faeb4aba946f8b042855697239d20a8_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5284 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:620
- - C:\Temp\nlfdyvqlid.exe
    C:\Temp\nlfdyvqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2360
- - C:\Temp\i_nlfdyvqlid.exe
    C:\Temp\i_nlfdyvqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5324
- - C:\Temp\fdxvpnifax.exe
    C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5068
- - C:\Temp\i_fdxvpnifax.exe
    C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Temp\vpnhfaxsqk.exe
    C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\i_vpnhfaxsqk.exe
    C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4812
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1908
- - C:\Temp\fzxrpjhczu.exe
    C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2104
- - C:\Temp\i_fzxrpjhczu.exe
    C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\omgeztrlje.exe
    C:\Temp\omgeztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\i_omgeztrlje.exe
    C:\Temp\i_omgeztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5664
- - C:\Temp\gbytrljdbw.exe
    C:\Temp\gbytrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1416
- - C:\Temp\i_gbytrljdbw.exe
    C:\Temp\i_gbytrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5232
- - C:\Temp\bytrljdbvt.exe
    C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\i_bytrljdbvt.exe
    C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\vqoigaytql.exe
    C:\Temp\vqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5344
- - C:\Temp\i_vqoigaytql.exe
    C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidavtnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Temp\qlidavtnlf.exe
    C:\Temp\qlidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidavtnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2180
- - C:\Temp\i_qlidavtnlf.exe
    C:\Temp\i_qlidavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxsnkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5164
- - C:\Temp\kfdxsnkfcx.exe
    C:\Temp\kfdxsnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxsnkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\i_kfdxsnkfcx.exe
    C:\Temp\i_kfdxsnkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run
  2⤵
  PID:4360
- - C:\Temp\kfcxvpnhfa.exe
    C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
  2⤵
  PID:5652
- - C:\Temp\i_kfcxvpnhfa.exe
    C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run
  2⤵
  PID:5228
- - C:\Temp\fzxrpjhczu.exe
    C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
  2⤵
  PID:2652
- - C:\Temp\i_fzxrpjhczu.exe
    C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run
  2⤵
  PID:4636
- - C:\Temp\cwuomhezxr.exe
    C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins
  2⤵
  PID:736
- - C:\Temp\i_cwuomhezxr.exe
    C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  PID:5416
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run
  2⤵
  PID:448
- - C:\Temp\wtomgeywqo.exe
    C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins
  2⤵
  PID:1740
- - C:\Temp\i_wtomgeywqo.exe
    C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  PID:1256
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  PID:1464
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  PID:3808
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  PID:3732
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qdavsnlfdx.exe ups_run
  2⤵
  PID:3448
- - C:\Temp\qdavsnlfdx.exe
    C:\Temp\qdavsnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qdavsnlfdx.exe ups_ins
  2⤵
  PID:2676
- - C:\Temp\i_qdavsnlfdx.exe
    C:\Temp\i_qdavsnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run
  2⤵
  PID:1548
- - C:\Temp\kicausnkfc.exe
    C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins
  2⤵
  PID:5900
- - C:\Temp\i_kicausnkfc.exe
    C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
- Executes dropped EXE
PID:4312

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:4436

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:3992

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:1948

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
- Executes dropped EXE
PID:5524

C:\Temp\ljdbwtomge.sys
C:\Temp\ljdbwtomge.sys
1⤵
- Executes dropped EXE
PID:652

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:2260

C:\Temp\ysqkidavsn.sys
C:\Temp\ysqkidavsn.sys
1⤵
- Executes dropped EXE
PID:4384

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
- Executes dropped EXE
PID:5432

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
PID:3232

C:\Temp\mkecxupnhf.sys
C:\Temp\mkecxupnhf.sys
1⤵
PID:2216

C:\Temp\jhczurmkec.sys
C:\Temp\jhczurmkec.sys
1⤵
PID:4488

C:\Temp\pjecwuomhe.sys
C:\Temp\pjecwuomhe.sys
1⤵
PID:1148

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
PID:5196

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
PID:716

C:\Temp\dyoigaysql.sys
C:\Temp\dyoigaysql.sys
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrljdbvt.exe

Path C:\Temp\bytrljdbvt.exe
Size 226KB
SHA256 e528309a8a0b9f476122b0cfdbc48a49ccde1073c0624ee20410e40134ce90da
MD5 a1797bcd8060786dc1f138275d803581
SHA1 f4e1eedaf10779d9188e54b569ecdfe866aa22ea
SHA512 72eb79ae504d7ed257f468062929302121f5f4c3ac730410832c07db04be75d269ceeb1f97251959e1d798a6ee1ef40cd61ec8e9277a543a366ed06a782aa158
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifax.exe

Path C:\Temp\fdxvpnifax.exe
Size 226KB
SHA256 b0382897ed1ff7d81682d004dd3e47e9e91e0797cdf4c21616dad64f6d640a18
MD5 426500bb52d6d26ea570d6492aed550e
SHA1 646232ff6feb6d1f98d7c35f02aac54396afea95
SHA512 a426feabe0d1deb1089ace2e5a230f6f489583ccccd858abe19a08f3be452bb6849f1f0f322485ff6cdfec95db85ed9cf4536b8c8cfaf9253e85bd772bbe1b8a
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T18834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhczu.exe

Path C:\Temp\fzxrpjhczu.exe
Size 226KB
SHA256 7191204c0f294ad9c40cc8ce0ac2d338964f25650e9e02c9cb36ba27f3248050
MD5 f70c4f8e63f52f9ae7576c96018a9bda
SHA1 a43d9f2bcec655c0f16b6bf8f782fb06bcae6311
SHA512 3563133ab85600c7348ec1a946195cc4969c1f923f62359f00bbffda0a9890ad86c1f99a47228d16a065fd56d30db5369d1315bf7683a13fcaaa9e53524022ca
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.exe

Path C:\Temp\gbytrljdbw.exe
Size 226KB
SHA256 87de71ffec834b576da4d9782ea8c33ff3f00995a8f3e8ed8a36302b43f9398f
MD5 a85d10848d942c741c4a27dd13137e73
SHA1 c7fe841e4f5c9b3e68c6ccbbe6e73c35cb7e124e
SHA512 dc07b519f1c3329597a8587a9e9eb821daba569175719dbe11b88fb166c71a1dea3c95894bbde4ad715e2bd37b5131681fb3f4574e69c0a62c8f8e5df3cea56d
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T15634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifax.exe

Path C:\Temp\i_fdxvpnifax.exe
Size 226KB
SHA256 a9befb311972e14ee91c9b31515362787851e420e14fd81a723312468a786138
MD5 3bcda97a851e6c90b78f887626399e62
SHA1 0d7e1b76000aa18dfd00a97998ba9be11a7ad910
SHA512 2bdb6d918d93d1a965f0a6af70d446e036c0fdf44a0eb5e38528a29b3ff111ff52b00bf45e0f03d5ef9f24fc63d290d95394e6b40e79304c64a33da92a9b7d18
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T17E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpjhczu.exe

Path C:\Temp\i_fzxrpjhczu.exe
Size 226KB
SHA256 feb8b109b3c75c5cb4c69565d0c98b67c4694bbb734ea7918ad0cda1286982f8
MD5 42962d2380c7e735923456f182f01c1f
SHA1 5d7ba0daea8faf5f15e512ddca6d3e0becf38fff
SHA512 67a018737d25ee587af9af5336d0b6bf3627f72291ada15e92a5854a099185b295aced09cd1dfffe158dc5ccc994cfc6c85dc3ff7a81e50a920093c482a90955
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1D434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbw.exe

Path C:\Temp\i_gbytrljdbw.exe
Size 226KB
SHA256 8e55e6b1573fdf52e55b5a12fb885acddda1b52d8fee61a8bc4228c3ad015d0a
MD5 ed2d2a1dfab489f2b5f324975b6ae485
SHA1 71f16645f188ed69db18039e01f26d15bdd2d973
SHA512 f68bad60c9580ba2d26342924b5bbf8e888d932aae7c4c9b04f7433884f34089aa63ed3673c96b06db864c098d61d67d9b6dcecfc160cc91f2989044d2adfaf8
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1DA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 226KB
SHA256 3d9f2f018016efc118cb241b45021cddbb8902303502156990ee2cd8d9341862
MD5 8aa13caedad8e5ac8ec689577ed6566a
SHA1 19fec44646bcc3ae56160d5159e593a3ca34fc84
SHA512 a349dbc50aba3086b4f2c7836ebd04c4a2859c3bffd7f245228b04d846f6e7a804fe2dc774bfde1e1216167eaba67d9a5a1c3685cbd9d0bc578145533a79794a
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T11A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdyvqlid.exe

Path C:\Temp\i_nlfdyvqlid.exe
Size 226KB
SHA256 c5e0ba877c5a217b26d4fcbdbb20938b4dc616260df1863dd819c0c6db67ecf2
MD5 cf6bc15be58859d2710c9a41d330ae7c
SHA1 9fd13c93a69afc19bb663bc7b6011b73c29eef7b
SHA512 40a2161bf441768dedb651d66a110004592e370b00cd396c94cdd98acfebf6bac7229099c03e64bf7e2fcc47fdf008a01a48c019ba488b3812052c95668a6c31
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeztrlje.exe

Path C:\Temp\i_omgeztrlje.exe
Size 226KB
SHA256 d6496e097d7b1d1be6455a9875154fccec54890a0b774dd8441783f28add4676
MD5 14139c651de6c9a23a30ce7e9004ca5f
SHA1 b96535fb02ee5677fe3ce6e4a9ffde86dae263f9
SHA512 1b42416ed313b1a1f297b6842b3943cc872bca0b09b05e29f71409566ae48240469fac73ee46737b4424d8d78adcff77cf0a0fc477fad0d3ba50acd49da170bd
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfaxsqk.exe

Path C:\Temp\i_vpnhfaxsqk.exe
Size 226KB
SHA256 a6836d7af8778c967ada62ea81ec10e0a55a00bb20122389594eb8ab118f371c
MD5 cfe5372edad60d131e947f296877d900
SHA1 eaba4f32ccec7f6e50aeebf8bd2617a01ac7c88b
SHA512 ff0b21a2dd06776902fc90fc195944e35861c629fc8d09df8cd0981b2f1101e6e2661ec4ce75223887a6896089f3c286776b4c8b06b091fe35aa3cc6b988afc2
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.sys

Path C:\Temp\kfdxvpnhfa.sys
Size 141KB
SHA256 4fef9045eb9d190397e67a5125f011cbc22c7b5eb354544f0348e1e4f347a6ce
MD5 ed727ed99c3145ac0d2d1f75573af7f2
SHA1 028d9915d56bfe1feef64754a60bed511287ff1e
SHA512 6e34a1964756802916062beb6042c90894137753c20191ed990c5b5194a6b304564725107bd07f0765db089a0e1930f9798ae16b5fe474b503f609f8b16965e0
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomge.sys

Path C:\Temp\ljdbwtomge.sys
Size 141KB
SHA256 7b137949d489ffdd6425faf2e80765a2676a75ede50b68b8597b755ee26e50ec
MD5 ba066f2d5702a0eaa6cbcbfa2babff50
SHA1 692ad8cabefc3620f831e72459064bf0951e6dcb
SHA512 9854eb80aaedf58aacb6f6a024f9f05da6863f08b778b6be5bc53915afa429e701ac29a21852b9596cf24d4bed3026dabae752ab456897fd6744910133bd6d49
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 226KB
SHA256 808fe3a9b86f5f275300bf186c45bd40a57bd5f4d72373f5fd5c74a7da818ea2
MD5 3e1f50940f9ac79e8bef725de045315f
SHA1 bae242fa6a524119d54327eb89ac01d82d3fea7f
SHA512 20347c3253dacf6921d33112823a464c4569d073587082fd3ab50fad59cd757c5fbdefd1808d1a25611b4487eef1a33bf92a02fabf38d74cbfc1fbfd46092115
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1BF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqlid.exe

Path C:\Temp\nlfdyvqlid.exe
Size 226KB
SHA256 3ddc9a16248978abe67cdde7727ba143d399755563c40ea946407e79ff7734a9
MD5 fe7708868da6b77b340623072578b987
SHA1 bf2aaf066197cc3c6809d0925f1a8a156c077df9
SHA512 944ff6c91481bba3c4845343dd5324849e5b952f38a27a1389f3609142db0a79bfb0bc5f9a97078b086e7a35a1c6c78a0894a18bff89171838585d42c845ea00
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T16B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeztrlje.exe

Path C:\Temp\omgeztrlje.exe
Size 226KB
SHA256 fb9ba67340d90e6422ddf7e7918f773de6c209270a9003c340bb1df76616cf6a
MD5 eee7be8c9bfb6cc42865bc1eb052c2f7
SHA1 9abe7fc8c9f7e21cb612ac7a7234422a98342978
SHA512 f9e162b97a9513a2e373e38afa511f85a6c03fe6d86196f2ae1050af57365d74bfbeaec6055e3d74b334720924183fc9af0b0233863deb34dd52e73fe17632d1
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T1B934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczusmke.sys

Path C:\Temp\pjhczusmke.sys
Size 141KB
SHA256 b66d48a1fa414770f8bb815499b870e86a24aba99de1c0b94a5021f8ceb16aed
MD5 e17d92ba718f9d6b05fee5a62d4c6e88
SHA1 0244c252486743b7eed5922b20f7c7ba40a93599
SHA512 e957a672c6122f70afb6ffafca230d390c870fd2057990dd33a71f643aed94d6ef7c2cc6db0a7aa096bad610015d6d8a50ed2247523ddf22ea0cec6cff51d5b7
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqki.sys

Path C:\Temp\qnifaysqki.sys
Size 141KB
SHA256 5ed9f076ac636c4e7a8fef348e2b05fe83e19c0848a1c555abd6e31153a0f353
MD5 49271d2452135b6d352df4da9eb86821
SHA1 c6fdc166776cdbff958eaad87c561e79c325b3d1
SHA512 f3a87af91861cf7ba16092ed73b73a737fe94ae82ae2824305de378bab8ed0478ce0d798e933defe819a50932a7a2deda03dc55adbae01cc1f4141913617d5b4
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.sys

Path C:\Temp\upnhfzxrpk.sys
Size 141KB
SHA256 f7a0210f4a73043e18e1f86b54568e811472aa94f56c26658ae1298a71693859
MD5 f4190d92b4881dee9bc4c5231177caab
SHA1 cb4504189dc7de7b25f8e5dead80a87148fc1e90
SHA512 6d91c84910f4cff07c069d29c36f587a54861aa54a6aecd7d56a94ce790abf129ebdfd8f552c2dcf1c25d49a4f86fac290dd0bd8da36e4c704ebaded83f7ff77
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfaxsqk.exe

Path C:\Temp\vpnhfaxsqk.exe
Size 226KB
SHA256 340b1a1acdcaadd62caedcc47470a080871769cc87d9bf355e27b0694aef528b
MD5 da2487b9af59737270cf8d4803585d27
SHA1 59142defb41f4f72b8ad9de330e4027bf66f5c51
SHA512 88caf555ff32bc6da85c971a333862d8d736a14db6a523d60db3c4be9d95cc35c5353a5578e21e96fd092e2e4cb61db1a0906d325dfe6995d4f2a2878ba0dd5f
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T12434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.sys

Path C:\Temp\wuomgeywro.sys
Size 141KB
SHA256 ec71d72df8e70eb84975a9c6fa74b8a61509c7820a6dd04eded1296144349081
MD5 244ab9f2af5282529764cb3727948a44
SHA1 4f5b292824767a8f69496bbc9672598e74b4c62f
SHA512 87719c1751010caf668fd2713820a39992ffaa2c7c4eb43eeeaacf774ebdf0d1043da966f3bc8bce16ec78d178aa23cc5737ae09e59ba137b534b65bd61df06a
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjecwuo.sys

Path C:\Temp\zurmjecwuo.sys
Size 141KB
SHA256 a0d4a06b490c857a297623dd78a32c1946bea9ee9df4280aca15eeac37d5f254
MD5 89358055b9bd4e35651463ba786ae711
SHA1 a228b870033b09b9611c89440fa8b68fbfe3097d
SHA512 440bda7ea6602115df2e11d21df02499a87af115826111b494fed5378ffcf22043f6a98a4c904aa939fd68f800bbf48d884b8118947186659f77e26a55881c37
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 61aee0fc9f0251f2390d08b72a621b23fd5533163899f81a8a33ded042797b7e
MD5 d06d868e9e32ae4f5883dadbc70d8a87
SHA1 3abbfb62d2911bc894d9e6906c5a1cd657b46977
SHA512 02e46f07aab1081b5f18dd6582b688d826af101fedf696c0435ac955f63e4244378516360ecc72df5f1bb4748e5c6acfe6f6cd8590886d0173a20587dd682481
TLSH
T177F09E22D4BEF4919E4048FD1A3D870934344075094941E6E23CCBA1576D3EA5A5D832
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 ec9ece6ba46a3164da203ba13706950b806aa56a0f3a4826e91ad92b831a224e
MD5 50b06c2a66a2d339e34c265e46cc0cf8
SHA1 dfaaea701dd228cf851d99778fa25393bfdc7108
SHA512 e5c0fb5f17c49dcf5694712b98ae6ddaa5e2a17799eea2ed2825b998217c7ffefde773f5790e0ef022570279b91692a2079cc6ae8dc81fa0a4f8359b48cc6115
TLSH
T157E0C02811F6413FF1E4E5394BCA7432D56EF0335518A2F42FC89B04A7026409D12E29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1948-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2216-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2216-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2260-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3232-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3992-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4384-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4488-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5196-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5432-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5524-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads