f0664bb157ed14f6962ef651f5e811328bfab3bbf353086047975df2a87a2c2f

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe
Size 243KB
Sample260503-3p67saas21
SHA256 f0664bb157ed14f6962ef651f5e811328bfab3bbf353086047975df2a87a2c2f
MD5 02fefc92e2153978f49df6512975fa3d
SHA1 a41e863885ea2ac4c7c8f397e4bdec38aefa881e
SHA512 9be4daf9baa279683a74dc28127816494c86c6b7c3bb179c1789beb79b4588aa78f745684d86179cc7e08572502685b88f9b7dc8a0bd33b46d54c1464556fe40
SSDEEP 3072:f+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:f+59tBBLkQa3lLNngoqRttA7k
TLSH
T15534490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2148	CP.exe
4652	czurmkecxr.exe
1132	CP.exe
3008	CP.exe
3772	i_czurmkecxr.exe
1480	mgezwrojhb.sys
2696	CP.exe
5064	bztrljeywr.exe
3384	CP.exe
2448	CP.exe
2656	i_bztrljeywr.exe
3964	geywrojhbz.sys
2792	CP.exe
692	rljdbvtolg.exe
2016	CP.exe
3056	CP.exe
2252	i_rljdbvtolg.exe
4640	vtnlgdywqo.sys
3244	CP.exe
1416	olgeywqogd.exe
1156	CP.exe
3408	CP.exe
532	i_olgeywqogd.exe
3556	nlgdyvqoig.sys
1480	CP.exe
2420	gaysqlidbv.exe
540	CP.exe
4644	CP.exe
3728	i_gaysqlidbv.exe
1916	davsnlfdxv.sys
1660	CP.exe
4156	vpnhfaxsqk.exe
2076	CP.exe
4220	CP.exe
1236	i_vpnhfaxsqk.exe
4092	dxsqkicavs.sys
3876	CP.exe
3000	kfcxvpnhfz.exe
4236	CP.exe
4828	CP.exe
2180	i_kfcxvpnhfz.exe
4308	upnhfzxrpk.sys
4016	CP.exe
1356	nhfzxspkic.exe
3324	CP.exe
4836	CP.exe
4060	i_nhfzxspkic.exe
3780	jhczusmkec.sys
4700	CP.exe
1500	cwupmhezur.exe
2256	CP.exe
5000	CP.exe
408	i_cwupmhezur.exe
4284	bztrmjecwu.sys
2192	CP.exe
2488	uomgezwroj.exe
3152	CP.exe
2292	CP.exe
5032	i_uomgezwroj.exe
3632	zwrpjhbztr.sys
728	CP.exe
3300	jdbwtomgey.exe
1672	CP.exe
1900	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4056	ipconfig.exe
1892	ipconfig.exe
2576	ipconfig.exe
412	ipconfig.exe
1528	ipconfig.exe
4648	ipconfig.exe
3992	ipconfig.exe
3860	ipconfig.exe
3040	ipconfig.exe
4776	ipconfig.exe
4200	ipconfig.exe
608	ipconfig.exe
456	ipconfig.exe
4400	ipconfig.exe
1672	ipconfig.exe
3600	ipconfig.exe
2476	ipconfig.exe
3992	ipconfig.exe
2056	ipconfig.exe
2256	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f02e0c5666be904496cc22699d6d023000000000020000000000106600000001000020000000411251a0ab9f0e681b95ba581bf6f1f2131728592971f68c0602561b299dd1d6000000000e8000000002000020000000bf4626259be13d8723217e2130ce35c31a7acc00daaa9cc028175933f31d45c6200000004f17645f50b5fcebe071f487f11971f0a57ccf844e84e3903dc3d06deefe44d54000000073c9c0e86e97ec4e55cc4d7ebe7c5cab0a3d2af53d3b53255809b3eb18371f55a52e22e5fc86b72de56aa95e4291b60ae30e076be5b70fb9b5191abcb16c82bb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10323cfa5edbdc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2452052960"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "484616720"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2447053362"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200635fa5edbdc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31251286"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f02e0c5666be904496cc22699d6d023000000000020000000000106600000001000020000000ae504569a7c752189bb344e2f2e094db4890e9905934d118bf9d4222f2a7d2d0000000000e80000000020000200000002eab079d3a9f0891ba4893ae4382441f72623f4eeee68e82fffd27aba0cc9e6b20000000d766af5009a5b21821dd2e3cbafcffbb5fd2f164ca1f6d84e92d3a9930b9a6b84000000052a4cf0d5836a9a1676bdcee6c9473e341bc35aa2d25cdb8b272059fbb6f80428896d98681da7dd1a5baff3d75ad72884cc96d2551da6d24c47f6486823258e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BCF418BB-4749-11F1-A54E-66C00C35F2B8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31251286"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	i_czurmkecxr.exe
Token: SeDebugPrivilege	2656	i_bztrljeywr.exe
Token: SeDebugPrivilege	2252	i_rljdbvtolg.exe
Token: SeDebugPrivilege	532	i_olgeywqogd.exe
Token: SeDebugPrivilege	3728	i_gaysqlidbv.exe
Token: SeDebugPrivilege	1236	i_vpnhfaxsqk.exe
Token: SeDebugPrivilege	2180	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	4060	i_nhfzxspkic.exe
Token: SeDebugPrivilege	408	i_cwupmhezur.exe
Token: SeDebugPrivilege	5032	i_uomgezwroj.exe
Token: SeDebugPrivilege	3288	i_jdbwtomgey.exe
Token: SeDebugPrivilege	2384	i_gbztrljdbw.exe
Token: SeDebugPrivilege	4044	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	5008	i_sqkidavtnl.exe
Token: SeDebugPrivilege	1072	i_qkicavsnkf.exe
Token: SeDebugPrivilege	556	i_spkhcausmk.exe
Token: SeDebugPrivilege	3512	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	4060	i_kecwuomhez.exe
Token: SeDebugPrivilege	4020	i_hbztrmjebw.exe
Token: SeDebugPrivilege	1704	i_geywqojgbw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4080	iexplore.exe
4080	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4080	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	86
PID 4080 wrote to memory of 2980	4080	iexplore.exe	87
PID 4364 wrote to memory of 2148	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	88
PID 4652 wrote to memory of 1132	4652	czurmkecxr.exe	91
PID 4364 wrote to memory of 3008	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	95
PID 4364 wrote to memory of 2696	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	103
PID 5064 wrote to memory of 3384	5064	bztrljeywr.exe	105
PID 4364 wrote to memory of 2448	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	110
PID 4364 wrote to memory of 2792	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	116
PID 692 wrote to memory of 2016	692	rljdbvtolg.exe	118
PID 4364 wrote to memory of 3056	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	123
PID 4364 wrote to memory of 3244	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	129
PID 1416 wrote to memory of 1156	1416	olgeywqogd.exe	131
PID 4364 wrote to memory of 3408	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	135
PID 4364 wrote to memory of 1480	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	144
PID 2420 wrote to memory of 540	2420	gaysqlidbv.exe	146
PID 4364 wrote to memory of 4644	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	150
PID 4364 wrote to memory of 1660	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	160
PID 4156 wrote to memory of 2076	4156	vpnhfaxsqk.exe	162
PID 4364 wrote to memory of 4220	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	169
PID 4364 wrote to memory of 3876	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	179
PID 3000 wrote to memory of 4236	3000	kfcxvpnhfz.exe	181
PID 4364 wrote to memory of 4828	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	185
PID 4364 wrote to memory of 4016	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	191
PID 1356 wrote to memory of 3324	1356	nhfzxspkic.exe	193
PID 4364 wrote to memory of 4836	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	198
PID 4364 wrote to memory of 4700	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	204
PID 1500 wrote to memory of 2256	1500	cwupmhezur.exe	206
PID 4364 wrote to memory of 5000	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	210
PID 4364 wrote to memory of 2192	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	216
PID 2488 wrote to memory of 3152	2488	uomgezwroj.exe	218
PID 4364 wrote to memory of 2292	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	222
PID 4364 wrote to memory of 728	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	228
PID 3300 wrote to memory of 1672	3300	jdbwtomgey.exe	230
PID 4364 wrote to memory of 1900	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	234
PID 4364 wrote to memory of 2656	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	240
PID 3964 wrote to memory of 3740	3964	gbztrljdbw.exe	242
PID 4364 wrote to memory of 4772	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	246
PID 4364 wrote to memory of 4784	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	252
PID 3980 wrote to memory of 2196	3980	bvtnlgdyvq.exe	254
PID 4364 wrote to memory of 2252	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	258
PID 4364 wrote to memory of 5096	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	264
PID 396 wrote to memory of 1060	396	sqkidavtnl.exe	266
PID 4364 wrote to memory of 216	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	270
PID 4364 wrote to memory of 2564	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	276
PID 4104 wrote to memory of 3524	4104	qkicavsnkf.exe	278
PID 4364 wrote to memory of 3496	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	283
PID 4364 wrote to memory of 1680	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	289
PID 2960 wrote to memory of 2964	2960	spkhcausmk.exe	291
PID 4364 wrote to memory of 4696	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	295
PID 4364 wrote to memory of 2400	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	301
PID 4916 wrote to memory of 1152	4916	mhfzxrpjhc.exe	303
PID 4364 wrote to memory of 3792	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	307
PID 4364 wrote to memory of 4112	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	313
PID 2308 wrote to memory of 2084	2308	kecwuomhez.exe	315
PID 4364 wrote to memory of 716	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	319
PID 4364 wrote to memory of 2384	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	325
PID 3844 wrote to memory of 2644	3844	hbztrmjebw.exe	327
PID 4364 wrote to memory of 1172	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	333
PID 4364 wrote to memory of 1532	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	339
PID 660 wrote to memory of 3772	660	geywqojgbw.exe	341
PID 4364 wrote to memory of 900	4364	2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe	346

C:\Users\Admin\AppData\Local\Temp\2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_02fefc92e2153978f49df6512975fa3d_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecxr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2148
- - C:\Temp\czurmkecxr.exe
    C:\Temp\czurmkecxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\i_czurmkecxr.exe
    C:\Temp\i_czurmkecxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljeywr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Temp\bztrljeywr.exe
    C:\Temp\bztrljeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljeywr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_bztrljeywr.exe
    C:\Temp\i_bztrljeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2792
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqogd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\olgeywqogd.exe
    C:\Temp\olgeywqogd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqogd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_olgeywqogd.exe
    C:\Temp\i_olgeywqogd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1480
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4644
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\vpnhfaxsqk.exe
    C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\i_vpnhfaxsqk.exe
    C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3876
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4016
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4700
- - C:\Temp\cwupmhezur.exe
    C:\Temp\cwupmhezur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Temp\i_cwupmhezur.exe
    C:\Temp\i_cwupmhezur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Temp\uomgezwroj.exe
    C:\Temp\uomgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Temp\i_uomgezwroj.exe
    C:\Temp\i_uomgezwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:728
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  PID:2656
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  PID:4772
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdyvq.exe ups_run
  2⤵
  PID:4784
- - C:\Temp\bvtnlgdyvq.exe
    C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
  2⤵
  PID:2252
- - C:\Temp\i_bvtnlgdyvq.exe
    C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  PID:5096
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  PID:216
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnkf.exe ups_run
  2⤵
  PID:2564
- - C:\Temp\qkicavsnkf.exe
    C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnkf.exe ups_ins
  2⤵
  PID:3496
- - C:\Temp\i_qkicavsnkf.exe
    C:\Temp\i_qkicavsnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run
  2⤵
  PID:1680
- - C:\Temp\spkhcausmk.exe
    C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_spkhcausmk.exe
    C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  PID:2400
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  PID:3792
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run
  2⤵
  PID:4112
- - C:\Temp\kecwuomhez.exe
    C:\Temp\kecwuomhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins
  2⤵
  PID:716
- - C:\Temp\i_kecwuomhez.exe
    C:\Temp\i_kecwuomhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjebw.exe ups_run
  2⤵
  PID:2384
- - C:\Temp\hbztrmjebw.exe
    C:\Temp\hbztrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjebw.exe ups_ins
  2⤵
  PID:1172
- - C:\Temp\i_hbztrmjebw.exe
    C:\Temp\i_hbztrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgbw.exe ups_run
  2⤵
  PID:1532
- - C:\Temp\geywqojgbw.exe
    C:\Temp\geywqojgbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgbw.exe ups_ins
  2⤵
  PID:900
- - C:\Temp\i_geywqojgbw.exe
    C:\Temp\i_geywqojgbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1704

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:1480

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3964

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Temp\nlgdyvqoig.sys
C:\Temp\nlgdyvqoig.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:1916

C:\Temp\dxsqkicavs.sys
C:\Temp\dxsqkicavs.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:3780

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:3632

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
PID:456

C:\Temp\igbytqljdb.sys
C:\Temp\igbytqljdb.sys
1⤵
PID:1456

C:\Temp\dysqkicavs.sys
C:\Temp\dysqkicavs.sys
1⤵
PID:1556

C:\Temp\faxsqkicav.sys
C:\Temp\faxsqkicav.sys
1⤵
PID:3376

C:\Temp\cxvpnhfzxs.sys
C:\Temp\cxvpnhfzxs.sys
1⤵
PID:4748

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
PID:660

C:\Temp\rpjhczurmk.sys
C:\Temp\rpjhczurmk.sys
1⤵
PID:3976

C:\Temp\wrojhbztrm.sys
C:\Temp\wrojhbztrm.sys
1⤵
PID:2064

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljeywr.exe

Path C:\Temp\bztrljeywr.exe
Size 243KB
SHA256 71adf523d065754685f8becc3eee66b6b159f8b15ba45a46ed94dbd4ff520eda
MD5 ef842e89eff58007567fc5b742f96c27
SHA1 4768582d4555991740799841661738add96f1c87
SHA512 c3d75784f56ef1724fd26f5b4e14c1771754f63421662ae733e48fd861da8b9b7b72aab231c309fe1606213b65db360b77f9fadbf64635710dd57d5db9c75ee1
SSDEEP 3072:S+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:S+59tBBLkQa3lLNngoqRttA7r
TLSH
T1F334490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecxr.exe

Path C:\Temp\czurmkecxr.exe
Size 243KB
SHA256 8116422785dd06d3d94ad50166d58b5ae720ff433d0ab415a214326c7b46a935
MD5 0686a5c00ac0910f2630bc742fba9b86
SHA1 a775c4402bc69eb4decc7b97eff9668beacfd8a1
SHA512 2a0595391011f1587b31a40a8a92f9a9feefadecb62848c941858034ca726096b076c674425b36e7bda667e215f73dc6edb34be51c2ffc3b3f6851f4796a95ad
SSDEEP 3072:N+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:N+59tBBLkQa3lLNngoqRttA7K
TLSH
T14F34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlfdxv.sys

Path C:\Temp\davsnlfdxv.sys
Size 141KB
SHA256 2a6c457c71654967b054724eb70b21ca36ffd86a748d7e300bdbf0f5ebb99768
MD5 402d34b3afd6b14741e034061bc77c50
SHA1 58510a39a6a3aa536b50f75ba023ed9901efd20d
SHA512 e385e9520d626ac2e8048fda22907b8ab7720265613bc49217bfea524eb835adc1d1220212b458f00a0b6e4b73645c0b52febb045f8fd96602ecfec822381f54
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxsqkicavs.sys

Path C:\Temp\dxsqkicavs.sys
Size 141KB
SHA256 005aa9562daf5fe57b186404f68ac7c32f8d05d67c5a4ee9a1905aeded498776
MD5 af6561aa60452dae139da7407d3a8f8d
SHA1 75c1208e98273348059cb643e562e3ff0ce7a5bb
SHA512 676858b9122b95fdfbc369bf7ede6a69b35a1ac45d6c008de1c798dd172b5ce7521e4f71e70ba97e10c929d39017beca23bb237655cfc6fe042190568ea067e2
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlidbv.exe

Path C:\Temp\gaysqlidbv.exe
Size 243KB
SHA256 457eef04444728fafdbee3c91a4c9d4d6d18d432ec1b8dc01f37739d8fc7ea2e
MD5 9031244930bfa1669204d7c019ed9403
SHA1 efdb6c9405c30e701a709446b04f93a42a119516
SHA512 d411e66c1fbfe735e2acc9774b50ac06e72386d0cc5ee6dc4baf42f25fc7c5306665e9ca3586c753a80e6279ac4de8d65668fa75e1c7571c3174087af9246f5b
SSDEEP 3072:r+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:r+59tBBLkQa3lLNngoqRttA74
TLSH
T1F934490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.sys

Path C:\Temp\geywrojhbz.sys
Size 141KB
SHA256 f34b38727ed8010eb57495539f52e09773f8d01b08e26b1d18cd18b5229001d0
MD5 444b21b8f4a870eab7ea380ca62cb1a1
SHA1 97b33bab8e26d973ad560f89650c0c2b9e6f359d
SHA512 e922c34712f8b7675b43ec371188215091ff8217808b639c305b661e5a1e9ad33ac9b8dbd5eabd6b5ed28f11db73d55a3cc9fc8fd291f7d5348b69964da08ecb
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljeywr.exe

Path C:\Temp\i_bztrljeywr.exe
Size 243KB
SHA256 c42e2cbff90f8a4141049be0dd62f86276bddb8c4c4d90053936c60ee1d3e900
MD5 1c1c551ab592d0a8f12b57c1df2a536a
SHA1 df021f068ebd09b955949bbe82bb7e273d9b5c03
SHA512 60b4c7b3989f238a0039fa334362a19434e269e7e6dfd94e287fa9a236db46336759d8e1024c16cb981e7051b4aa4e6dc98b5e452aabebcd3244edc34bc51fa0
SSDEEP 3072:k+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:k+59tBBLkQa3lLNngoqRttA7B
TLSH
T10B34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmkecxr.exe

Path C:\Temp\i_czurmkecxr.exe
Size 243KB
SHA256 19117199ab165cf3c9ff1359c6d9f3a484d89d401cb0bcf6a217eed26265e279
MD5 bdc69aa2fc3fd58baa900ed2fd35bf28
SHA1 08f60f93f33a92fa1fa2e61fab761153c26d711b
SHA512 0e63c8b6634577a5c14fa35e9ff51350501941533a7d88057c3c3004b064634b4c79ad70e5b599224da7aae0dfbad802959964c32e0b92bee2489bf3195b2f4e
SSDEEP 3072:R+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:R+59tBBLkQa3lLNngoqRttA7q
TLSH
T10834490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaysqlidbv.exe

Path C:\Temp\i_gaysqlidbv.exe
Size 243KB
SHA256 81ddd69903765fe3d8ae2581a16ece69b013fc42610ac520d2e9e0a45b020d5e
MD5 0c57bbdad86fd19c9f4e5130d13f9283
SHA1 4c20a9263ebe43c795f38f001abf44fa997bcea2
SHA512 64d920125b319417d5f5aee13a28ccb4b295781e2b9d0c8b2aaa83ccd32c2c0a367b2336750c3f787c253885e0615290cb1127dced7194cef6a3de22f4765972
SSDEEP 3072:D+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:D+59tBBLkQa3lLNngoqRttA7s
TLSH
T12C34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxvpnhfz.exe

Path C:\Temp\i_kfcxvpnhfz.exe
Size 243KB
SHA256 494c919eddcf1b753761cd6c440df28b6e9555712e595dee74bd52196a6234ed
MD5 869e628835f79ec02e371954247f797e
SHA1 82fd5fbd77756cf6b618236b6cbd61c3016fceb8
SHA512 a13a1a9c7ad8cf2d1caa3256f1c3c68f0b82e4e21a4bb8b71d66b5fa35311e35e4f8958f6e66b5156823363ffa57d82cfcac3ec50b7228fc2ec82637d939db35
SSDEEP 3072:z+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:z+59tBBLkQa3lLNngoqRttA7o
TLSH
T11D34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqogd.exe

Path C:\Temp\i_olgeywqogd.exe
Size 243KB
SHA256 016ac5acfbbb5b0679f016498d8ae9e17907d22ea24b4f68c22dc8ffc9081c76
MD5 a81719e12a6f3a83323cbe707d1561d8
SHA1 76582bacfd0eebb9b996a69d47d30e5f07d4cd6d
SHA512 faeba0bae90cfe2746c790579ace5dc0aa299a62af9d7842ee76dbde45b660b229dccf9caa6a643b8d864c6017d47a2297ddfab92f0bb115933821d3f342fc93
SSDEEP 3072:W+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:W+59tBBLkQa3lLNngoqRttA7b
TLSH
T13434490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbvtolg.exe

Path C:\Temp\i_rljdbvtolg.exe
Size 243KB
SHA256 1c44a69853f1fbb82eb2e200cf65741c494b1c7976b60c34512f192d3fc5485f
MD5 2b8d45fd26cc065860a80072071e5a7f
SHA1 3bd9ee8392108a7d8581941177e38841cf98c05f
SHA512 8a1e2e48c78cf3cd897de745e0e5e6a1c98f925216e1e18f93771c3b950a61038b9ef13b78ae33a2f9978bac4853200bb0858a567b5d99c7c9c12e7a7830a62a
SSDEEP 3072:q+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:q+59tBBLkQa3lLNngoqRttA7X
TLSH
T19B34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfaxsqk.exe

Path C:\Temp\i_vpnhfaxsqk.exe
Size 243KB
SHA256 cb2003f8e890c0087f6172a0e90f2d77cf2d09ad651116e183a4dd9e247c500c
MD5 5ab166ffe6f9bf5c88d7c629e95047a7
SHA1 03695b72b0ceef9e52583e55cc7fabd31ffaf8ab
SHA512 a5a585b1467cf36c7163bbc560358d4e080b9876f201cffedfdb7d3c0343faa60ae1efa10dbc2b084fbc59e15042f4996bfa4ff88957e0a2c48271774d2f5b1d
SSDEEP 3072:R+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:R+59tBBLkQa3lLNngoqRttA7G
TLSH
T18834490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.exe

Path C:\Temp\kfcxvpnhfz.exe
Size 243KB
SHA256 7fbdcde977a7c83bf04efe8c8b0359652716c285efb978545d93421c5e98f850
MD5 847f017e4be1845ed2fd846d174abaaa
SHA1 72dceaa321751eec88a4b06a976fbf8e3707c1e4
SHA512 a5859d4fe39a01eb9cf4b06b29ddce01e53d266359ee08ce4fda84196c2318ef644c303cf5ac94dda7a390695233b0361242bc03637876351cf151af82298aba
SSDEEP 3072:n+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:n+59tBBLkQa3lLNngoqRttA78
TLSH
T17C34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrojhb.sys

Path C:\Temp\mgezwrojhb.sys
Size 141KB
SHA256 dbf7cdb9655a56aa22aa76619b9f0d548c1323a8f68b35bbc10f2c51c22c9e9c
MD5 93021d75419484f4b869a6fedf00c609
SHA1 bdc84d75f17ad7969898e2c59eef518cd45fc6d6
SHA512 965af69f590ba90f2c7e54226a8fc8ae7e96a1d9f7699b7332a3ef6133c3fa88bfd4b2780839ee743bd059cb0abb1fdd324779b34b440761738e495a86953d0f
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 c0ca7f4924a58b8b013326df30db77856284f79a4a7144cb47b4bfa1f8f7790f
MD5 badcfa0c5db377e49197ec49fc841b60
SHA1 5a5cb771216aeee59d263f3e9b65337295c96306
SHA512 fea41bd7c33c3d50e0dca8cb068b15369e8b5d9824bba38d625185b4ec52a8f88c20185357e3c1e03b2a29c4cc6f57341a04e9b1c2cacb554a37e923e669c5c0
SSDEEP 3072:y+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:y+59tBBLkQa3lLNngoqRttA7P
TLSH
T19034490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoig.sys

Path C:\Temp\nlgdyvqoig.sys
Size 141KB
SHA256 480618e0f47baade3d7168ccc02df8fafed22fc98bb5053ed1e887a8744dd3a0
MD5 d8c469155cb0450e83b56ff6386caf1b
SHA1 9011e9055417699f6fb8199fc0df30ee5dd17d89
SHA512 26c26bebb0db85ae749d57930a4bd0f40779eaf9525ca98962c2bdf560a114bab289553433ec4afde41db63ad32552e285a80d9428a2e2078130b65e3e6d24eb
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T157E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqogd.exe

Path C:\Temp\olgeywqogd.exe
Size 243KB
SHA256 937e490fc45660ae7913db75a5f7702c2fd1977c58c5f78274ab6050823be64e
MD5 2b2cb65b5f3159e5a224b4a62a3eba9c
SHA1 2e03ed1b4c1aa65494b33a504c840dbc49885586
SHA512 d9d10b049f6b4a06227ee135de1e7195c58615c9ef517be4f2d5f863b37744ba5b564ae9797f1007ea9f7461ae945718f395a91a9444013229b16f4441672231
SSDEEP 3072:J+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:J+59tBBLkQa3lLNngoqRttA7q
TLSH
T14F34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtolg.exe

Path C:\Temp\rljdbvtolg.exe
Size 243KB
SHA256 6c103f23da39f830183fcd15150c0a2223b1ca898503b1db61428d8f4856b9d0
MD5 6359b39de987f9e85e3cb19ac5ef592f
SHA1 f1c9df212c02e0af75a3faf1a42d0ee154d77450
SHA512 ffc3c3a92dc50e9dae60516f066c5944a10bac3ec8e74df75e38b4cbc5bb09643182f1254de88e6bc696c4b090e8ca4513a4586dbb86827c5a57a32332fa1e02
SSDEEP 3072:j+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:j+59tBBLkQa3lLNngoqRttA78
TLSH
T1CA34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.sys

Path C:\Temp\upnhfzxrpk.sys
Size 141KB
SHA256 f7a0210f4a73043e18e1f86b54568e811472aa94f56c26658ae1298a71693859
MD5 f4190d92b4881dee9bc4c5231177caab
SHA1 cb4504189dc7de7b25f8e5dead80a87148fc1e90
SHA512 6d91c84910f4cff07c069d29c36f587a54861aa54a6aecd7d56a94ce790abf129ebdfd8f552c2dcf1c25d49a4f86fac290dd0bd8da36e4c704ebaded83f7ff77
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfaxsqk.exe

Path C:\Temp\vpnhfaxsqk.exe
Size 243KB
SHA256 819aea0db53c4ee82ae782248ef5b1f0da3552db5485f0ea590542c0d90f88e8
MD5 fcc9226080355693ae3ce0299cbf1f01
SHA1 0c995e14787703d812eccfada0a8e5773ee7cd08
SHA512 6b2d9ae2865b868c49c80f6eeca82356f989513441ca472ccd8484c1eab3b3a868ac4e4c805ba7479425c396706ddf5f1cc1871623d3b7782c547b2b314c1482
SSDEEP 3072:H+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:H+59tBBLkQa3lLNngoqRttA7I
TLSH
T1B334490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdywqo.sys

Path C:\Temp\vtnlgdywqo.sys
Size 141KB
SHA256 ce487387cb53a6ce95c7e743ccf6548927225f4fc4d135b5d8133397ca5d8a03
MD5 650fa9ebda54f696a4c76aecc20f0916
SHA1 23aa91cabd81b9fd60dc7694780ca38566ddabec
SHA512 59d105e9387b3af24f43c9ca94962cfde4d9e82e8a88c7e1025c79a91e6e7bdd25c5608e2bc635fc86de14b745fc337e3600475e746abab1c64b98720a295799
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a2578620d868479abb1dac538bf8b9afce6593c114a9c57cdb72d201958d22c0
MD5 4d47cc108989d4bb0e43658557b448c2
SHA1 7b369fe02bd9a869eb2a83facdbb1c69b39000c7
SHA512 530dc8c4d33c21b8cc2e4155f950fc743540137f94854ad7d91d5c6dba1a78f40f269b99077f5bb8f9373a4eb46caf4d49d5d6a545edbc7d8fd82be32a39f69a
TLSH
T19FF0D472146DF139A980ACEC0510CFF61073E02704B44992913CFBD42A7976CD61B476
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 e8b35fd0a3d13c94014c85eeb0595d9ab7034020476405b0345aa0f19d0f64bc
MD5 3a5088be7545451272d2230f74d840ab
SHA1 c7cdcb9abc179fc070fdbafc8f7b0a4d4dc51295
SHA512 b6747be8707a874734f00b3259935ece110ec187dcdf1875b30c564a0994e4aa1a8e834a5ad7155327de75bd3bf1ed3aba9d53eb7be5ed37747e463a070b1bcb
TLSH
T131E0C03419FA415FE6E4D43546E9B82586ABF122083DA3B525C45F08B702A40EE03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0G5RVZXX\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/660-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1456-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1480-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1916-77-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-166-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3376-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3556-65-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3632-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3780-112-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3964-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-162-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-170-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4748-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads