718a837b59254adc5017064a2874a548ebfc21e2a7aef62193bf17a5e14740c1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
Size 243KB
Sample260415-12jadadt71
SHA256 718a837b59254adc5017064a2874a548ebfc21e2a7aef62193bf17a5e14740c1
MD5 1bfe36e38c9ac41f0ac9e4e28c3dde1f
SHA1 1da80f7435a59acd0cbbf2d26bf70710ad70a161
SHA512 aabee3bcb14f52f4f52d2a09de9dd88c875603b8e38dad80b535e0ef5f3b27341e312a6325d9dbce149f7b6c3a1cf2e066bd2e246a86cf4b45abe27e410cb107
SSDEEP 3072:r48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:c8AqOLctGa3lLNngoqRttA7c
TLSH
T109345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3092	CP.exe
5412	rpjhczupmh.exe
6048	CP.exe
2520	CP.exe
1652	i_rpjhczupmh.exe
5708	mhezxrpjhb.sys
3996	CP.exe
4364	bztrmjecwu.exe
3560	CP.exe
6016	CP.exe
3272	i_bztrmjecwu.exe
2940	gbztrmjecw.sys
5396	CP.exe
1716	wuomgeywro.exe
3284	CP.exe
5160	CP.exe
3664	i_wuomgeywro.exe
4992	ztrljdbwto.sys
6132	CP.exe
2804	olgeywqojg.exe
3612	CP.exe
3032	CP.exe
3976	i_olgeywqojg.exe
764	trljdbvtol.sys
1708	CP.exe
2480	dysqlidbvt.exe
5740	CP.exe
2212	CP.exe
3852	i_dysqlidbvt.exe
5460	oigaysqlid.sys
988	CP.exe
2544	davtnlfdxv.exe
4676	CP.exe
3704	CP.exe
4500	i_davtnlfdxv.exe
1980	cavtnlfdxv.sys
5212	CP.exe
2720	vpnifaysnk.exe
332	CP.exe
4960	CP.exe
776	i_vpnifaysnk.exe
1920	xspkicausm.sys
1104	CP.exe
5124	mkfcxupnhf.exe
1792	CP.exe
2140	CP.exe
4532	i_mkfcxupnhf.exe
3540	ausmkfcxvp.sys
1652	CP.exe
5980	hfzxrpkhcz.exe
1572	CP.exe
4440	CP.exe
5140	i_hfzxrpkhcz.exe
4136	urmkecwuom.sys
2948	CP.exe
5552	mkecwupmhf.exe
3272	CP.exe
1544	CP.exe
1732	i_mkecwupmhf.exe
5572	uomgezwrpj.sys
3700	CP.exe
996	jhbwuomgey.exe
4260	CP.exe
3664	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3836	ipconfig.exe
704	ipconfig.exe
3652	ipconfig.exe
3180	ipconfig.exe
2284	ipconfig.exe
100	ipconfig.exe
1440	ipconfig.exe
4876	ipconfig.exe
2076	ipconfig.exe
5204	ipconfig.exe
5600	ipconfig.exe
788	ipconfig.exe
5976	ipconfig.exe
6056	ipconfig.exe
3180	ipconfig.exe
4776	ipconfig.exe
5888	ipconfig.exe
5404	ipconfig.exe
2148	ipconfig.exe
2372	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0efcde02ccddc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "483055897"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A9ED3E55-3917-11F1-A918-CEEB04D51BF9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2127585713"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000246e1cf290e2664880c6b0e6bd29a87000000000020000000000106600000001000020000000f34cb684cf0aefff087b3356d509ffe1b9c7997ad982068f42be8b9542c5b12e000000000e80000000020000200000004eeaa7c142b3b63eeaa0c565dc7c882529eed066632590cce4e154004e9893d0200000009fcfdba5f233af68ed0aba8d9969af10991235c216a48b20ab7beeea6609c3244000000011c168babdaa7e4b79dc471824ff3d6c62f2bd98409053a23ec72ce0101061e2f9881f977f19628a905011de5c52e3a16aef43e385c7671de6ea74e998fc17ec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000246e1cf290e2664880c6b0e6bd29a87000000000020000000000106600000001000020000000dacb6dafe61235cf3f9ecfef4189fca9a130df8e205b8e20bfced64472885ec7000000000e8000000002000020000000c76d22d16b91a093ddfa9fd9809563e6bf6e7b9bc10bd89edf20f62e356f6de120000000b5ac8f832f4d994b695d80db962ce97c448f5d3da32d96b800247c0c6cf85b0040000000a1d6d3617f1d92503abd6493870a066324247f16189af1efe0a7e0c7678561464918531dfac77c44626fde305fa60b88ed9a4c4be4a3ee05380978b73404e0fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01bd5e02ccddc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31247652"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	i_rpjhczupmh.exe
Token: SeDebugPrivilege	3272	i_bztrmjecwu.exe
Token: SeDebugPrivilege	3664	i_wuomgeywro.exe
Token: SeDebugPrivilege	3976	i_olgeywqojg.exe
Token: SeDebugPrivilege	3852	i_dysqlidbvt.exe
Token: SeDebugPrivilege	4500	i_davtnlfdxv.exe
Token: SeDebugPrivilege	776	i_vpnifaysnk.exe
Token: SeDebugPrivilege	4532	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	5140	i_hfzxrpkhcz.exe
Token: SeDebugPrivilege	1732	i_mkecwupmhf.exe
Token: SeDebugPrivilege	5564	i_jhbwuomgey.exe
Token: SeDebugPrivilege	4700	i_gbztrljdbw.exe
Token: SeDebugPrivilege	2104	i_geywigbytq.exe
Token: SeDebugPrivilege	1620	i_aysqlidbvt.exe
Token: SeDebugPrivilege	5600	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	5380	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	1248	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	1812	i_smkecwupmh.exe
Token: SeDebugPrivilege	4852	i_mjecwuomge.exe
Token: SeDebugPrivilege	4112	i_mgeywrojhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3512	iexplore.exe
3512	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3512	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	86
PID 3512 wrote to memory of 2396	3512	iexplore.exe	87
PID 3768 wrote to memory of 3092	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	88
PID 5412 wrote to memory of 6048	5412	rpjhczupmh.exe	91
PID 3768 wrote to memory of 2520	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	96
PID 3768 wrote to memory of 3996	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	103
PID 4364 wrote to memory of 3560	4364	bztrmjecwu.exe	105
PID 3768 wrote to memory of 6016	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	110
PID 3768 wrote to memory of 5396	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	114
PID 1716 wrote to memory of 3284	1716	wuomgeywro.exe	116
PID 3768 wrote to memory of 5160	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	119
PID 3768 wrote to memory of 6132	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	123
PID 2804 wrote to memory of 3612	2804	olgeywqojg.exe	125
PID 3768 wrote to memory of 3032	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	128
PID 3768 wrote to memory of 1708	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	133
PID 2480 wrote to memory of 5740	2480	dysqlidbvt.exe	136
PID 3768 wrote to memory of 2212	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	139
PID 3768 wrote to memory of 988	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	143
PID 2544 wrote to memory of 4676	2544	davtnlfdxv.exe	145
PID 3768 wrote to memory of 3704	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	148
PID 3768 wrote to memory of 5212	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	152
PID 2720 wrote to memory of 332	2720	vpnifaysnk.exe	154
PID 3768 wrote to memory of 4960	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	157
PID 3768 wrote to memory of 1104	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	161
PID 5124 wrote to memory of 1792	5124	mkfcxupnhf.exe	163
PID 3768 wrote to memory of 2140	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	166
PID 3768 wrote to memory of 1652	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	170
PID 5980 wrote to memory of 1572	5980	hfzxrpkhcz.exe	172
PID 3768 wrote to memory of 4440	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	175
PID 3768 wrote to memory of 2948	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	179
PID 5552 wrote to memory of 3272	5552	mkecwupmhf.exe	181
PID 3768 wrote to memory of 1544	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	184
PID 3768 wrote to memory of 3700	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	188
PID 996 wrote to memory of 4260	996	jhbwuomgey.exe	190
PID 3768 wrote to memory of 3664	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	193
PID 3768 wrote to memory of 5912	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	197
PID 364 wrote to memory of 5820	364	gbztrljdbw.exe	199
PID 3768 wrote to memory of 3024	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	202
PID 3768 wrote to memory of 3568	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	206
PID 5984 wrote to memory of 5128	5984	geywigbytq.exe	208
PID 3768 wrote to memory of 5688	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	211
PID 3768 wrote to memory of 5436	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	215
PID 6004 wrote to memory of 2640	6004	aysqlidbvt.exe	217
PID 3768 wrote to memory of 5376	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	220
PID 3768 wrote to memory of 2404	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	224
PID 1936 wrote to memory of 4512	1936	vtnlfdxvqn.exe	226
PID 3768 wrote to memory of 5948	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	229
PID 3768 wrote to memory of 4272	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	233
PID 4264 wrote to memory of 2472	4264	smkfcxvpnh.exe	235
PID 3768 wrote to memory of 5576	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	238
PID 3768 wrote to memory of 3160	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	242
PID 5244 wrote to memory of 2792	5244	xvpnhfzxsp.exe	244
PID 3768 wrote to memory of 4160	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	247
PID 3768 wrote to memory of 4036	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	251
PID 2392 wrote to memory of 6036	2392	smkecwupmh.exe	253
PID 3768 wrote to memory of 5960	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	256
PID 3768 wrote to memory of 2288	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	260
PID 6012 wrote to memory of 5888	6012	mjecwuomge.exe	262
PID 3768 wrote to memory of 4072	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	265
PID 3768 wrote to memory of 1760	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	269
PID 984 wrote to memory of 3780	984	mgeywrojhb.exe	271
PID 3768 wrote to memory of 5324	3768	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3512 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3092
- - C:\Temp\rpjhczupmh.exe
    C:\Temp\rpjhczupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2520
- - C:\Temp\i_rpjhczupmh.exe
    C:\Temp\i_rpjhczupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3996
- - C:\Temp\bztrmjecwu.exe
    C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6016
- - C:\Temp\i_bztrmjecwu.exe
    C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5160
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\olgeywqojg.exe
    C:\Temp\olgeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3032
- - C:\Temp\i_olgeywqojg.exe
    C:\Temp\i_olgeywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1708
- - C:\Temp\dysqlidbvt.exe
    C:\Temp\dysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2212
- - C:\Temp\i_dysqlidbvt.exe
    C:\Temp\i_dysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:988
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3704
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaysnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5212
- - C:\Temp\vpnifaysnk.exe
    C:\Temp\vpnifaysnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaysnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_vpnifaysnk.exe
    C:\Temp\i_vpnifaysnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1104
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Temp\hfzxrpkhcz.exe
    C:\Temp\hfzxrpkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4440
- - C:\Temp\i_hfzxrpkhcz.exe
    C:\Temp\i_hfzxrpkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2948
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbwuomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3700
- - C:\Temp\jhbwuomgey.exe
    C:\Temp\jhbwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbwuomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\i_jhbwuomgey.exe
    C:\Temp\i_jhbwuomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  PID:5912
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  PID:3024
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywigbytq.exe ups_run
  2⤵
  PID:3568
- - C:\Temp\geywigbytq.exe
    C:\Temp\geywigbytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywigbytq.exe ups_ins
  2⤵
  PID:5688
- - C:\Temp\i_geywigbytq.exe
    C:\Temp\i_geywigbytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  PID:5436
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  PID:5376
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run
  2⤵
  PID:2404
- - C:\Temp\vtnlfdxvqn.exe
    C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
  2⤵
  PID:5948
- - C:\Temp\i_vtnlfdxvqn.exe
    C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run
  2⤵
  PID:4272
- - C:\Temp\smkfcxvpnh.exe
    C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
  2⤵
  PID:5576
- - C:\Temp\i_smkfcxvpnh.exe
    C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  PID:3160
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  PID:4160
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  PID:4036
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  PID:5960
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomge.exe ups_run
  2⤵
  PID:2288
- - C:\Temp\mjecwuomge.exe
    C:\Temp\mjecwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomge.exe ups_ins
  2⤵
  PID:4072
- - C:\Temp\i_mjecwuomge.exe
    C:\Temp\i_mjecwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run
  2⤵
  PID:1760
- - C:\Temp\mgeywrojhb.exe
    C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins
  2⤵
  PID:5324
- - C:\Temp\i_mgeywrojhb.exe
    C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4112

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:5708

C:\Temp\gbztrmjecw.sys
C:\Temp\gbztrmjecw.sys
1⤵
- Executes dropped EXE
PID:2940

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4992

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:764

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
- Executes dropped EXE
PID:5460

C:\Temp\cavtnlfdxv.sys
C:\Temp\cavtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:1920

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
- Executes dropped EXE
PID:3540

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:4136

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:5572

C:\Temp\zuomgerojg.sys
C:\Temp\zuomgerojg.sys
1⤵
PID:884

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
PID:5788

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:4408

C:\Temp\gavsnlfdxv.sys
C:\Temp\gavsnlfdxv.sys
1⤵
PID:4864

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
PID:1224

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
PID:4300

C:\Temp\cxrpkhczus.sys
C:\Temp\cxrpkhczus.sys
1⤵
PID:5336

C:\Temp\wrpjhbzurm.sys
C:\Temp\wrpjhbzurm.sys
1⤵
PID:4412

C:\Temp\bzurmjecwu.sys
C:\Temp\bzurmjecwu.sys
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.exe

Path C:\Temp\bztrmjecwu.exe
Size 243KB
SHA256 df4e90e8501188a016789f1a937f62a0fb52a448e0cd45a0f7fbe24200b5d5e6
MD5 db45b4da9b6c32d2642700eecc51334e
SHA1 f08808b7fb87e29c99a420adcc92526ca2744733
SHA512 eb9a2aa1c102e33d4234db970437a65a7ed26359a5471e3f6b52a0bdd777b94f7774f5638d736e5b78a3e21323858047e31593709f4d46dbed75d1a6e21808f9
SSDEEP 3072:C48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:P8AqOLctGa3lLNngoqRttA7h
TLSH
T1F0345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavtnlfdxv.sys

Path C:\Temp\cavtnlfdxv.sys
Size 141KB
SHA256 304892ec6c45157417740e146e39bbf3a1c831b8dfeb57c02e9a4fc313db8088
MD5 55125fa3ab0901c9fd6ecde8f324692f
SHA1 8a2a2281b9ba23e0f3c2df9323fb1086ad98c6be
SHA512 78963eb08cd3bef4ca860654bdba5252a7cdc11aad20dbb72576a2b593c4ddf8b481e73d1a61c77459d39123faeebb83aefa3010c7e39834a9ba6b705cc2d287
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T163E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdxv.exe

Path C:\Temp\davtnlfdxv.exe
Size 243KB
SHA256 b41ffd8a8bef830bbc5f4e27ddd44d076386d3d3a2d2c726ac2c39a225d45ba8
MD5 a55fcf4d39dfe56d498b85a9130fd348
SHA1 963d52a35d0d982c8b56423fb362ee99e54dbaf0
SHA512 521ed6060a831f47877e0791b23d68b706c8610e76f8fec499c07b85181966bd2cdb5e2e2b4fbdda42b3f5cb956311c55ce65bcc617ca50763f0b34c26e59c0a
SSDEEP 3072:F48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:q8AqOLctGa3lLNngoqRttA7W
TLSH
T16D345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqlidbvt.exe

Path C:\Temp\dysqlidbvt.exe
Size 243KB
SHA256 a3688b3720e2e6bc6dcf8effbd07ed27882461c68e689c6687e2a222bfb3e0e6
MD5 07573ca308fdac68f4013a8f90f60d81
SHA1 38fbf2c7d98d3cbad69c3ffa0854d56ca0525af3
SHA512 13724e6b1026eec754aae241efb5de3b7b815d236a80de120e9f05e281a1bc768b5a3fb6fef4ad02669bed05520efd09f638581320665f83e35a489ee5b7a636
SSDEEP 3072:S48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:f8AqOLctGa3lLNngoqRttA7d
TLSH
T1AA345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrmjecw.sys

Path C:\Temp\gbztrmjecw.sys
Size 141KB
SHA256 d7c357a495619d750af5823e10edfd35af37d2dd601de5d4d4b45cec41117aba
MD5 38117b4ad2b750f7e6bc33a6207a058c
SHA1 b5c6b07010cf5ee1ca0b3fc9803d8dc06709fce9
SHA512 3c3a32fb40c9e3279a6f7d5013817aa9ca5e89063de430d3f163666541ced65cecb680aa8cc23c6b75a6a988cbf27326b0aabc780c531492bd751e28a7e3c14c
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T114E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmjecwu.exe

Path C:\Temp\i_bztrmjecwu.exe
Size 243KB
SHA256 30442e974818ae0454dbed3ed7f7e6c70f2aa605baf9f520a30c58db6f1c9024
MD5 b479b6974766647b506cb306d3f0516e
SHA1 08c080662e63aa7a727af4933a77c7904ea9c00f
SHA512 be2f22ae187d30d137132097e9c80c32aa0867fc0b74053b83616f78b65bc9d4d298134754592237715d41fe758d48698643d4e867f9cad7b09d46be94ed531c
SSDEEP 3072:N48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:y8AqOLctGa3lLNngoqRttA7m
TLSH
T169345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdxv.exe

Path C:\Temp\i_davtnlfdxv.exe
Size 243KB
SHA256 865d2a91bf59b0fede939e0f1a17013a95d1c6fec1fa15daf8950a7e47538714
MD5 a700f8a1e220cfb5a3d80a077b560972
SHA1 9c03bcf48a0f124178e792127561b75058f8284d
SHA512 b210339794aab1ff30d619b4f2b73289b158623cb54148c1eb2af40b6955eff0b062221d4a4b3165ebc5372b55f4a3461ab8c1e83c36e4d5a6d2cce84c7e72d6
SSDEEP 3072:848AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:18AqOLctGa3lLNngoqRttA7L
TLSH
T1CE345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dysqlidbvt.exe

Path C:\Temp\i_dysqlidbvt.exe
Size 243KB
SHA256 90fdf0a3e4b2fb10dc2532341cf97429152b2a43257d2890a02d386cbbed55d7
MD5 ac3e6b8198fd25e15c78dab2c207334b
SHA1 304fbfe6c5ba6b84b6d1bbd603e564aea2065751
SHA512 3c5e153937b3c0cde19647361697e8eee141f9e0167a419e71e959e9705f97dd3c1ee4948092d3cd8bae6f03c02a0fd658977b1d73a19e40df9affe3d0e9d57b
SSDEEP 3072:w48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:p8AqOLctGa3lLNngoqRttA7v
TLSH
T12D345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxupnhf.exe

Path C:\Temp\i_mkfcxupnhf.exe
Size 243KB
SHA256 cbb383c68e70114178f5009bbd9c7ac8001f2eb34dd9b2f8c2bc0a1d8ed0a317
MD5 3343a8ea798defda15aaa6581c1b6de1
SHA1 b09e16fecb68b188773dd91e94a496edd992e933
SHA512 97f2df16b46da9687f32b8d8bd6a88544bf6283c19728c565734620b67f48838ebfffd2c0d23eb00157c7dc639fc7ba3fd46e41d34f5c079b77dc1cb70e42020
SSDEEP 3072:548AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:e8AqOLctGa3lLNngoqRttA7e
TLSH
T108345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqojg.exe

Path C:\Temp\i_olgeywqojg.exe
Size 243KB
SHA256 dde38bd38fe0f0c9a76c1a5ab1d9483c4d9c43537b74d00909d1c6c62a164cb8
MD5 c90ccf45fb263f0f5baf3a09f7317239
SHA1 4c125941a93e45c061a69ed6e005f8146d779fea
SHA512 e755c6ad3f96a7ff4343b89dc6c41e7e5fdf717f26bb3ddbfc0569cdc47fa028682eded6e02eb114aaca06cf9e38af244332d3dc3716b9e39c510d72073bc4c4
SSDEEP 3072:F48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:q8AqOLctGa3lLNngoqRttA7i
TLSH
T177345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczupmh.exe

Path C:\Temp\i_rpjhczupmh.exe
Size 243KB
SHA256 c0e44d030172fa483d4d8c015a7fd2e4b3632d62b68daa831480aa7d78b192ef
MD5 3f5a96c3fe0e761a1696207bc9a197b9
SHA1 ad0f4c30d3e4ee0b46f21042e325be7de17fa008
SHA512 a210aa04e103095948faad55b9f3bc8b1ae88267f5d8105291508f3a6c074885dd140591219fffda56963f889bf20571aabcbb5c0ac44e1ca7e1b9c302d163e3
SSDEEP 3072:U48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:N8AqOLctGa3lLNngoqRttA7z
TLSH
T1A5345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnifaysnk.exe

Path C:\Temp\i_vpnifaysnk.exe
Size 243KB
SHA256 fd5f030fdb33cc364ede1776d0c458bc42cbf871354295b1eb641eded6abcd0b
MD5 9f70f552b7ba248d1fe9aa8e9df5f8e7
SHA1 5dc486f4b4318c6400697403a02fc015081c59d4
SHA512 19721e0bfc30dcb7d1f1bad0955127132ac07b316f1f5e089297bc2023e7f24a6a18e1320c1e5c2739c02e9b538a95d31ea5c743cb167f683d4b810bdb325e68
SSDEEP 3072:V48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:68AqOLctGa3lLNngoqRttA7m
TLSH
T13E345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 243KB
SHA256 42478cc8e4980295ceae12c748eec257befa464557f19c0783fb70fe348f3a27
MD5 e38a672df5e1fe099975bccd52bc7bad
SHA1 d7fd9c5a0022c5f9d04b237a53411fa6d3aa78b0
SHA512 f8c862f9cc206beeabcbb18a162541bee46bfdd8c28083d21d83121ade935e4b04c80413d0ccd3fd41f999e291fb5f53df03cfa457f11677d5310bfb4018ec34
SSDEEP 3072:d48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:C8AqOLctGa3lLNngoqRttA7+
TLSH
T12B345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.sys

Path C:\Temp\mhezxrpjhb.sys
Size 141KB
SHA256 6b56009249144240730bc01e12f82fd543b0c500e8b20373028fa7a7a5f1581f
MD5 04141210aed8cdc1a3b33b2bcf3d03e6
SHA1 c5ca5ab1e22673b93a289dc55ad161f85a520181
SHA512 08121712f3f7972ecc1edd958753766b0730aff50ed46a2dea6da39d4ffa19ae5721fe21550539b75a10b22edd0943428e007543ac345b618eb69b33202718ac
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T198E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.exe

Path C:\Temp\mkfcxupnhf.exe
Size 243KB
SHA256 6fcb401efbb7ee7e68442e45474e9efdc4b79e27442e64180b2f5fde68e0f128
MD5 76728da974b025884534ff71ca2e08f1
SHA1 77005ec33633f97a559a011275cf2a2ec510ed42
SHA512 7e0d931490cc1dada903c0f699e309f3dbbe933880f2cb4186542c67ee25e6171dffc4a70d4247c0a173b04cb5b054c110d9a6bf10fe92e8efb242f6e737e378
SSDEEP 3072:Z48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:+8AqOLctGa3lLNngoqRttA76
TLSH
T17F345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.sys

Path C:\Temp\oigaysqlid.sys
Size 141KB
SHA256 4750e785eeea54b53ac3435775862adbab2a9a28f88e1ff56d42b0d6d50dd436
MD5 6f64771c6da1783156eddd2dda3b8cb3
SHA1 f956f65c3df872fd275c0dcadd270b0f4c6e2750
SHA512 d92ccb3ce7d60d848f51eb8f56419ed95d06a0a19713d2b311e4ba95b3840520bb0a1ba446c83fa5a0ec618231602a1e83089807f7dbf84939e3c5534a3e7e04
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqojg.exe

Path C:\Temp\olgeywqojg.exe
Size 243KB
SHA256 7431500542ae8e089bd68cf6f2f424b450ddbe3568249241f78a9a8cc0242db6
MD5 c2432569b223e1b4ff21dc667c76eb84
SHA1 9e010e7f74d8e3007ce70ef00c9c4f75d516f37f
SHA512 2a17a23934b8b29a805ebfd19d8132b53b15e7e8e2d43a43d148a3c73c704774b2e82b271ca235180cebcecfd072e3d6c26d9e3e768d5745c3f834ed82174cfa
SSDEEP 3072:Q48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:J8AqOLctGa3lLNngoqRttA7H
TLSH
T19F345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczupmh.exe

Path C:\Temp\rpjhczupmh.exe
Size 243KB
SHA256 700baaea48d6b67b0aa34c57e5d1eba5cdbb169b8aad532ee48af84159f8ed75
MD5 4c9c6cc014d9b64c63cb3f4fb27de93a
SHA1 aea2239e4ed5d2d273190a5a548b214700ca6606
SHA512 bf84e30b332bf89a18173a79030160e331c3516e1f781410dca2e4e072bb687dff630c1d69fd38fd8ef753b209cf4eeb7b3eab2cff309d715bd0af0deb6ae16c
SSDEEP 3072:M48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:F8AqOLctGa3lLNngoqRttA7P
TLSH
T1AA345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 8786a786fa2096c0f376814baa526ca37bca9322015454e06b1ac9f077a782ee
MD5 980ef279b8ded144edba83e824202b1e
SHA1 cfedd5e866812d75227da3b01a89ed07dc6dfe49
SHA512 b730025b927764cebec86876497f97fd34dc17d4e61910e8fea2e85b254b8d54ce1cfc5600c481e96241b91188142379de461d731717a9f8d2495e5014dde784
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysnk.exe

Path C:\Temp\vpnifaysnk.exe
Size 243KB
SHA256 eb1b9f1b655fd9d8882fd7ff26753f6388ad9c9993f7c5d4d3df80fd01ac228c
MD5 f406b959ce1548a2bcdd1fa7592fbec9
SHA1 b922274c2d34211425b623639ad157e20868b323
SHA512 90d5ed8ccb8434935ea2b7dc924e9e4509770fdaff026d8e82c31ff8fa2cd542641ad3c8c0904a20660902a91264e8d14daea3e6d7fae72b9024d87f3b621dc0
SSDEEP 3072:B48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:G8AqOLctGa3lLNngoqRttA7W
TLSH
T1B5345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 243KB
SHA256 06024f7674661647680a707e700694398a075345c24f4a7f82106b67ea8ad896
MD5 0f757f56b49f93a882a287118fb58686
SHA1 a2f090ad82b5f214cd7b32dfe6d4cce6ab4aeb81
SHA512 0acde4b092a592226dd68c2cdb522305a6fd1863c8d1564ee656750872c42fc8a1bf742f4de76b4461713beee127c61906aca1ec91fb5d94aeb1023fec8e0a11
SSDEEP 3072:w48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:p8AqOLctGa3lLNngoqRttA73
TLSH
T169345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.sys

Path C:\Temp\xspkicausm.sys
Size 141KB
SHA256 ef0e839513e6c89896551b81ae820645fb567141dba51c67f49fd1afec0ab5d8
MD5 faab65e6afe9f1c3b26e8aa4c363eeef
SHA1 814d485beeb75ffef177677b07cec6ac7d5029ec
SHA512 fbe1cd3821942e395c48c28351c35fc9c2fb13d6e102dd6c34346f4593e49cd7a3e669c5e16e9e72e60a9874bca4c18934f90eda1741529783810acfae0a27cf
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 76fe0b18278cf5a1101b0ee0bb3e22d390cf3e4766c2aae63ae12a650dfd7a9d
MD5 fb416fbe49c46d3baf900c17e7c8ab1a
SHA1 8b6d34ed550efbb59ba31ccf59e676171e7a1bd9
SHA512 8b265684433f7be6c6d6066193f2cc3cbdd97a43798e58edf1bee74651f5e1383bd90c1b60520a61a0473c03bffac85038895c92f5365e33b9c476b4088d7c5e
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VGXOU86\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/764-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/884-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1224-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1920-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1980-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4408-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4408-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4412-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4864-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5336-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-72-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5572-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5708-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5788-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads