330010b0e752794798a1a18507b834c15a970ef2d926dd0fdae02a93df201b30

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe
Size 243KB
Sample260827-13ptjsbb67
SHA256 330010b0e752794798a1a18507b834c15a970ef2d926dd0fdae02a93df201b30
MD5 185a72d2ce7fbbcd0ef999f51d87ebe0
SHA1 b5cc8680ec0142447b7f4200c9beac23cc23a025
SHA512 7ff20e8c2f44b93c8244c2c5ea3c9d097e2b3d5d0e43831905df863d647a7094491cb6290070e8a5f826251ee3b6b36356f330a8497a0408d51d65975353621e
SSDEEP 3072:FAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:CLC2PLhMma3lLNngoqRttA7F
TLSH
T1CA345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4772	CP.exe
3292	gbztrljdbw.exe
2992	CP.exe
4172	CP.exe
4196	i_gbztrljdbw.exe
3960	gbytrljdbv.sys
2896	CP.exe
4436	vtolgeywqo.exe
4176	CP.exe
2160	CP.exe
4748	i_vtolgeywqo.exe
4944	vtnlgdywqo.sys
1436	CP.exe
4964	oigaysqlid.exe
1052	CP.exe
1760	CP.exe
4680	i_oigaysqlid.exe
4156	nlfdyvqoig.sys
3236	CP.exe
4636	ysqkidxvpn.exe
4032	CP.exe
3944	CP.exe
3952	i_ysqkidxvpn.exe
1372	fdxvqnifay.sys
4940	CP.exe
3668	vsnkfdxvpn.exe
1036	CP.exe
3808	CP.exe
4316	i_vsnkfdxvpn.exe
3956	pnhfaxspki.sys
768	CP.exe
1976	spkicaupkh.exe
3504	CP.exe
4672	CP.exe
4020	i_spkicaupkh.exe
4452	mhezsmkecw.sys
796	CP.exe
3820	wupmhezxrp.exe
1472	CP.exe
2448	CP.exe
3196	i_wupmhezxrp.exe
1068	hcwuomhezx.sys
1704	CP.exe
4652	ojhbztrmje.exe
4860	CP.exe
2396	CP.exe
2016	i_ojhbztrmje.exe
1884	ywrojhbztr.sys
3708	CP.exe
3256	rpjhbztrmj.exe
3248	CP.exe
3956	CP.exe
5100	i_rpjhbztrmj.exe
2964	wqoigbytrl.sys
3704	CP.exe
2868	ojgbztrljd.exe
1668	CP.exe
4216	CP.exe
4796	i_ojgbztrljd.exe
4572	nigaytqlid.sys
2276	CP.exe
3576	gbytqljdbv.exe
1568	CP.exe
3828	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicaupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicaupkh.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
432	ipconfig.exe
5100	ipconfig.exe
2644	ipconfig.exe
4844	ipconfig.exe
2688	ipconfig.exe
3636	ipconfig.exe
4872	ipconfig.exe
4780	ipconfig.exe
3996	ipconfig.exe
2560	ipconfig.exe
3788	ipconfig.exe
3352	ipconfig.exe
632	ipconfig.exe
3100	ipconfig.exe
3352	ipconfig.exe
2152	ipconfig.exe
2068	ipconfig.exe
3408	ipconfig.exe
2936	ipconfig.exe
4492	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06ace5b7936dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4187311855"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4182780563"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{24D16BB1-A264-11F1-AA2C-EE6109102029} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9096d55b7936dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f75cc99035da44e92e861f5c56d56760000000002000000000010660000000100002000000084f3ed0a0c0d66ca878f616cbb4b8e81ec622add36f148ebe99af212b9add8c8000000000e8000000002000020000000cea74e3cffdd1dcbd0010f86891960137c82ac239d4973946682d707a1c27e3820000000b58c98c1c162ec4bed5bef06fca7faab871e34cfd7e1e3e91207311827846b1640000000e6d03a1c5ae7e8e35f02584ccaf3435122ab732108022af1e8896d5c4e208427bdd8c26345a9c3b71bc54657a787f3d7a836ddd9d9d183f82c3d7f910da48e25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274608"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f75cc99035da44e92e861f5c56d5676000000000200000000001066000000010000200000005b8cf00e552b1a4133068c6a961c29aa515764f9fb41d599e19dc3bb984c044f000000000e8000000002000020000000ad53079cc1f641565baf02d13e615fc373d6720951dcc9cc0c223598bc0b39f62000000053e3260804090cea3703138b9ed852587a99e86a15e69e7ce0bfc4d850f53aa840000000a6a6d3025878198ae5155370a7d437a5f4a850ae055cc42b9c460e29b9840a7a343d0c230dcf665ac8ff496540b12f1c216d62ecfc8ff262e14cacdba973165f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494633617"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	i_gbztrljdbw.exe
Token: SeDebugPrivilege	4748	i_vtolgeywqo.exe
Token: SeDebugPrivilege	4680	i_oigaysqlid.exe
Token: SeDebugPrivilege	3952	i_ysqkidxvpn.exe
Token: SeDebugPrivilege	4316	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	4020	i_spkicaupkh.exe
Token: SeDebugPrivilege	3196	i_wupmhezxrp.exe
Token: SeDebugPrivilege	2016	i_ojhbztrmje.exe
Token: SeDebugPrivilege	5100	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	4796	i_ojgbztrljd.exe
Token: SeDebugPrivilege	3788	i_gbytqljdbv.exe
Token: SeDebugPrivilege	2044	i_aysqlidavt.exe
Token: SeDebugPrivilege	4848	i_dxvpnifays.exe
Token: SeDebugPrivilege	3844	i_xspkicausm.exe
Token: SeDebugPrivilege	1080	i_rpjhczusmk.exe
Token: SeDebugPrivilege	4496	i_pjhczurmke.exe
Token: SeDebugPrivilege	404	i_pjhbzurmje.exe
Token: SeDebugPrivilege	3640	i_bztrljebwu.exe
Token: SeDebugPrivilege	464	i_wqoigaytql.exe
Token: SeDebugPrivilege	5012	i_qkidbvtnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3880	iexplore.exe
3880	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3880	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	85
PID 3880 wrote to memory of 2040	3880	iexplore.exe	86
PID 1580 wrote to memory of 4772	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	89
PID 3292 wrote to memory of 2992	3292	gbztrljdbw.exe	92
PID 1580 wrote to memory of 4172	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	100
PID 1580 wrote to memory of 2896	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	111
PID 4436 wrote to memory of 4176	4436	vtolgeywqo.exe	113
PID 1580 wrote to memory of 2160	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	116
PID 1580 wrote to memory of 1436	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	120
PID 4964 wrote to memory of 1052	4964	oigaysqlid.exe	122
PID 1580 wrote to memory of 1760	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	125
PID 1580 wrote to memory of 3236	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	129
PID 4636 wrote to memory of 4032	4636	ysqkidxvpn.exe	131
PID 1580 wrote to memory of 3944	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	134
PID 1580 wrote to memory of 4940	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	141
PID 3668 wrote to memory of 1036	3668	vsnkfdxvpn.exe	143
PID 1580 wrote to memory of 3808	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	146
PID 1580 wrote to memory of 768	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	152
PID 1976 wrote to memory of 3504	1976	spkicaupkh.exe	154
PID 1580 wrote to memory of 4672	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	157
PID 1580 wrote to memory of 796	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	164
PID 3820 wrote to memory of 1472	3820	wupmhezxrp.exe	166
PID 1580 wrote to memory of 2448	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	169
PID 1580 wrote to memory of 1704	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	173
PID 4652 wrote to memory of 4860	4652	ojhbztrmje.exe	175
PID 1580 wrote to memory of 2396	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	178
PID 1580 wrote to memory of 3708	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	182
PID 3256 wrote to memory of 3248	3256	rpjhbztrmj.exe	184
PID 1580 wrote to memory of 3956	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	187
PID 1580 wrote to memory of 3704	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	191
PID 2868 wrote to memory of 1668	2868	ojgbztrljd.exe	193
PID 1580 wrote to memory of 4216	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	196
PID 1580 wrote to memory of 2276	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	201
PID 3576 wrote to memory of 1568	3576	gbytqljdbv.exe	203
PID 1580 wrote to memory of 3828	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	206
PID 1580 wrote to memory of 1732	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	210
PID 3856 wrote to memory of 932	3856	aysqlidavt.exe	212
PID 1580 wrote to memory of 2472	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	215
PID 1580 wrote to memory of 1596	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	219
PID 1784 wrote to memory of 4384	1784	dxvpnifays.exe	221
PID 1580 wrote to memory of 1300	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	224
PID 1580 wrote to memory of 3544	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	228
PID 64 wrote to memory of 2164	64	xspkicausm.exe	230
PID 1580 wrote to memory of 2828	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	233
PID 1580 wrote to memory of 432	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	237
PID 1752 wrote to memory of 4312	1752	rpjhczusmk.exe	239
PID 1580 wrote to memory of 2168	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	242
PID 1580 wrote to memory of 3420	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	246
PID 832 wrote to memory of 4196	832	pjhczurmke.exe	248
PID 1580 wrote to memory of 4452	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	251
PID 1580 wrote to memory of 3188	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	255
PID 1788 wrote to memory of 2140	1788	pjhbzurmje.exe	257
PID 1580 wrote to memory of 4680	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	260
PID 1580 wrote to memory of 1980	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	264
PID 5004 wrote to memory of 1440	5004	bztrljebwu.exe	266
PID 1580 wrote to memory of 1916	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	269
PID 1580 wrote to memory of 4996	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	273
PID 3100 wrote to memory of 4348	3100	wqoigaytql.exe	275
PID 1580 wrote to memory of 4144	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	278
PID 1580 wrote to memory of 2864	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	282
PID 4020 wrote to memory of 2740	4020	qkidbvtnlf.exe	284
PID 1580 wrote to memory of 3604	1580	2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_185a72d2ce7fbbcd0ef999f51d87ebe0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3880 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4772
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\vtolgeywqo.exe
    C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2160
- - C:\Temp\i_vtolgeywqo.exe
    C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Temp\oigaysqlid.exe
    C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1760
- - C:\Temp\i_oigaysqlid.exe
    C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3236
- - C:\Temp\ysqkidxvpn.exe
    C:\Temp\ysqkidxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3944
- - C:\Temp\i_ysqkidxvpn.exe
    C:\Temp\i_ysqkidxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Temp\vsnkfdxvpn.exe
    C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\i_vsnkfdxvpn.exe
    C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicaupkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:768
- - C:\Temp\spkicaupkh.exe
    C:\Temp\spkicaupkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicaupkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4672
- - C:\Temp\i_spkicaupkh.exe
    C:\Temp\i_spkicaupkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:796
- - C:\Temp\wupmhezxrp.exe
    C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_wupmhezxrp.exe
    C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1704
- - C:\Temp\ojhbztrmje.exe
    C:\Temp\ojhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_ojhbztrmje.exe
    C:\Temp\i_ojhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3708
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3956
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3704
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\gbytqljdbv.exe
    C:\Temp\gbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_gbytqljdbv.exe
    C:\Temp\i_gbytqljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidavt.exe ups_run
  2⤵
  PID:1732
- - C:\Temp\aysqlidavt.exe
    C:\Temp\aysqlidavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidavt.exe ups_ins
  2⤵
  PID:2472
- - C:\Temp\i_aysqlidavt.exe
    C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  PID:1596
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  PID:1300
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  PID:3544
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  PID:2828
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run
  2⤵
  PID:432
- - C:\Temp\rpjhczusmk.exe
    C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins
  2⤵
  PID:2168
- - C:\Temp\i_rpjhczusmk.exe
    C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
  2⤵
  PID:3420
- - C:\Temp\pjhczurmke.exe
    C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
  2⤵
  PID:4452
- - C:\Temp\i_pjhczurmke.exe
    C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmje.exe ups_run
  2⤵
  PID:3188
- - C:\Temp\pjhbzurmje.exe
    C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmje.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_pjhbzurmje.exe
    C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  PID:1980
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  PID:1916
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run
  2⤵
  PID:4996
- - C:\Temp\wqoigaytql.exe
    C:\Temp\wqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins
  2⤵
  PID:4144
- - C:\Temp\i_wqoigaytql.exe
    C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidbvtnlf.exe ups_run
  2⤵
  PID:2864
- - C:\Temp\qkidbvtnlf.exe
    C:\Temp\qkidbvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidbvtnlf.exe ups_ins
  2⤵
  PID:3604
- - C:\Temp\i_qkidbvtnlf.exe
    C:\Temp\i_qkidbvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:3960

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\fdxvqnifay.sys
C:\Temp\fdxvqnifay.sys
1⤵
- Executes dropped EXE
PID:1372

C:\Temp\pnhfaxspki.sys
C:\Temp\pnhfaxspki.sys
1⤵
- Executes dropped EXE
PID:3956

C:\Temp\mhezsmkecw.sys
C:\Temp\mhezsmkecw.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\hcwuomhezx.sys
C:\Temp\hcwuomhezx.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
- Executes dropped EXE
PID:1884

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
- Executes dropped EXE
PID:2964

C:\Temp\nigaytqlid.sys
C:\Temp\nigaytqlid.sys
1⤵
- Executes dropped EXE
PID:4572

C:\Temp\qnigaysqli.sys
C:\Temp\qnigaysqli.sys
1⤵
PID:2740

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
PID:1680

C:\Temp\fcxvpnhfax.sys
C:\Temp\fcxvpnhfax.sys
1⤵
PID:4324

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:972

C:\Temp\ezxrpjhczu.sys
C:\Temp\ezxrpjhczu.sys
1⤵
PID:4852

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
PID:3436

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
PID:3836

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
PID:3084

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifay.sys

Path C:\Temp\fdxvqnifay.sys
Size 141KB
SHA256 aaa83b2b81129b55cef1dd9305050ef5514d420a3d070bf8ca0d144f85f19a48
MD5 f7336b57e816e305af0de0047636f0e3
SHA1 4a31ec7824bcfd35d18f60fca76c9de314be18a7
SHA512 1d61579784120b58888b95ae98877643afb0035f88ead2465e88f61c54b3f24128d4c10823e49f64bdc7deef5ba38f433b74e89e6823475c9d6135242753a8ac
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T195E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 57ce25921029653ede04f734d12dbcb64f8b1f3c186f562774eb29cedebf9b05
MD5 6748ad1fd7d457d237bcf56dcd51eb91
SHA1 2dea46b337ebc22dcce2c0e7ef6a6cd105a443eb
SHA512 94c72e27ada696a96d9d5bdab9637dc9181d5630ea741fca97afb99e4d7025017aba0777b9f2040c96c42974cef337ee6a60ef08a3c6fb185ff3b477da7625b4
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljdbw.exe

Path C:\Temp\gbztrljdbw.exe
Size 243KB
SHA256 787c2cc0c65667acedac0a612bba71fd3e6a04d95015f748612332e2e6a21636
MD5 c4f711463adb83846e59908075f985a5
SHA1 0ce6d3aadc4cf06c683d3005e1acb2b4c582bbbd
SHA512 af6a9df75cdfaced842356d2ead32594827f38f92b06a8e3208d36c527533e918fb77d6b13944bce9f9c6bc1eb9afb66e364aaf7a05c2f1ab2c45a26e7e8f5f4
SSDEEP 3072:TAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:8LC2PLhMma3lLNngoqRttA7b
TLSH
T165345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwuomhezx.sys

Path C:\Temp\hcwuomhezx.sys
Size 141KB
SHA256 2f8b2e121c68835cf10b5f1bbf8a36c93419d967af818fc424f493274c9bcfe2
MD5 5334fda01c1f04a3b352f13299d6dbec
SHA1 9647ae29e5b3a64c08a50e3b2569b0522ec9ead2
SHA512 c951d01d956e6d14ec01847c152ade7662570eb26b662f449cbf56bdf1b75ba1817ad9bf7044a0f8e8493b0e23861bcd20aee4e5e58df94a55b99b4295703845
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19DE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljdbw.exe

Path C:\Temp\i_gbztrljdbw.exe
Size 243KB
SHA256 67190ee221a3a4e94f82ae86b4dd2e95307377f8a145840269f2a9283f5ece3c
MD5 3d467acdf98d7150990c2ccb69df33b1
SHA1 63d5a30cb21c4587ff7d10c80251416343c69b1f
SHA512 60375554c84d1515ec30494f41856913b19d740270f252e441fa70eeb7671fbfab38cee182de8b3e6e207edc59f0277b8d134a5159101f8dc9facfddd7e22651
SSDEEP 3072:WAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:LLC2PLhMma3lLNngoqRttA7K
TLSH
T157345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqlid.exe

Path C:\Temp\i_oigaysqlid.exe
Size 243KB
SHA256 8930a63d7eaed9f02cb6c2d3083c49f466efdb041277e885a816d771f35c2ef9
MD5 6c1b7a2261706c3d332756cd0fb4c7ac
SHA1 adeb34795474b95d2e38459a947fd408d7c31783
SHA512 25de1031c5118ed4c867bbb8ce7320bf3ffb9968a72ac158f1e2f8e1eb5bfa014e491ca33d387f1492e7f89c8ea7ed12b668644df0f34ade39413bd79660678b
SSDEEP 3072:GAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:7LC2PLhMma3lLNngoqRttA7G
TLSH
T12A345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicaupkh.exe

Path C:\Temp\i_spkicaupkh.exe
Size 243KB
SHA256 c91fb11d766f6618cb06e1ecfcf8af5a484cba310a20b5d3dc310623736e7c25
MD5 525b9e679aa85f1f3268fa20268a0af4
SHA1 599b15744721ad964cf6ef711df859083a3c0964
SHA512 4a190e505c004aafb9faa1d403fec041c2644dc752736531cb783f60bc93a73f507c2ceeb5280f8962e209bf1682364a68c65cda62f2bc02dd4f504e361d0de4
SSDEEP 3072:DAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:sLC2PLhMma3lLNngoqRttA7T
TLSH
T12E345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 243KB
SHA256 3f92fb7b4723120766c1d752e2e94251738afb8f2ca782842e0946f432b87a21
MD5 c1e5895d15aa28bf1bda1345e25d5742
SHA1 607f7c0489c0ea721b0209a1da4b8329164573f2
SHA512 a792f2171cf973e99d955c59da4382cd046c64e50447fd0001b63aafa7c3f7c4041a4d8894fe1f6becdbb97296595bed943c94541e1d4462fc3af3f7c00aa611
SSDEEP 3072:cAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:tLC2PLhMma3lLNngoqRttA7k
TLSH
T149345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgeywqo.exe

Path C:\Temp\i_vtolgeywqo.exe
Size 243KB
SHA256 5d51119b9dcfe6dbe1807eedb358ed8911e172274fd0bca62cfd46492df21ee8
MD5 98d96c32543386c1b420069c83a81cb7
SHA1 30e9085f84b2e58cbe4e5c014ab091579d2e9528
SHA512 0083840586da14c7304e6d4c7966563c1c16d928e9ede4098f8ee86922ceba1a2802e0b6259aba65f182fe9453b59e7ccdbd0e078aa26dd747b51c35d5ce43f4
SSDEEP 3072:9AR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:KLC2PLhMma3lLNngoqRttA7x
TLSH
T120345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wupmhezxrp.exe

Path C:\Temp\i_wupmhezxrp.exe
Size 243KB
SHA256 e10baa6e604b29de34999f5ed268d615c4bef8a78ea6b38dc1642beb844c82fb
MD5 504cae9363f1eba0e2dce3307b7c0c0a
SHA1 ec2f96bd061e04ccdd8e9f2ee4a54245f027676a
SHA512 5a2142d731df20d6ec3af491579d83733668f6cd19521e9b8e6e530b221e2ec1662b668772fee08b1c03fae39e942d4ea8ac8bd1d3d524d865fe6f3572d7a3d4
SSDEEP 3072:WAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:LLC2PLhMma3lLNngoqRttA7G
TLSH
T176345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkidxvpn.exe

Path C:\Temp\i_ysqkidxvpn.exe
Size 243KB
SHA256 3144b3955e2f81dfa17c88e955ed63717777f5b467ab210b1e38413230c15af7
MD5 3bfeccb6b68f1a8cab114717084c1055
SHA1 0d94631455292538d37f4c79d28a6cc91d979309
SHA512 f3beaf9cacbe356b5ab86274a2958fd677d0937c8b0f2fd65c4eb743ef8654ab81c2f399c39d3a974237144195eb90b7524ddbddb8723ac4422796464ffa68c5
SSDEEP 3072:TAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:8LC2PLhMma3lLNngoqRttA7z
TLSH
T136345A0172818031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezsmkecw.sys

Path C:\Temp\mhezsmkecw.sys
Size 141KB
SHA256 16a3da82bc3f32cb103f1a523643d639169f056aac9ccbb0bcb5e9e7eb5f09a7
MD5 ba93a4341a5ad1e2d30ef0c5fb47aa32
SHA1 6b2c3477e1d73caec309fd6a2c8cb46580a5524e
SHA512 df95b8b08c44f769afc39273e8251bc5b073bfffbc326e0453a126af55410745d5c0aaf6c6db825ac7b90a54d76af428eec6a67540ae160abe70e598d6c51fca
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.sys

Path C:\Temp\nlfdyvqoig.sys
Size 141KB
SHA256 e8e660b372fec9b9e89429678952781b5a2e3e8e8b7e6def76f629c768e0ccbb
MD5 59be95ec607e3bf412c75b5127351502
SHA1 48d5ae09e636fe81eabac5b91c80fba8d25e5ee1
SHA512 caf1cc91cf1a9a57ea489c1572ce56654ec91aa5b50318ab425a5f0a731d64c82d308b9ea1195b8819d1f61903eab2fdda0660648a987ed997a9ee970b92b029
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.exe

Path C:\Temp\oigaysqlid.exe
Size 243KB
SHA256 ec8851a2429fea34d5715085bef68335d511500dae257ca83c578520aa80a7f4
MD5 aeecd6f6f8393a3ec7d8250c694b096d
SHA1 81a99a6dbaf13cae45f67efb5c0ab2e63c831b72
SHA512 a91ef2cf2a0d4aa123d688d94967cc71ae23844ebee2d7781d2cd96f8b96ae10dd2a724b549cd46646f04a3c00fcaddb3f145475b4aa82bd4af0996fbec67b22
SSDEEP 3072:xAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:uLC2PLhMma3lLNngoqRttA7N
TLSH
T1EA345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrmje.exe

Path C:\Temp\ojhbztrmje.exe
Size 243KB
SHA256 a5be95e9dc9029b80782227bbfd4772c16bc7a5a01b087258e14aac87604dde6
MD5 8f24891122be7af96628f7d58c5cf0f9
SHA1 f6f266a3173f538b7f8da4aada1ec9f54a6c17f4
SHA512 dc5ac74bb76e6d3bf5ded1c28ba2d980e26d24cb9c6e80b72a63b81df5567a9b9c2b518b663a17721d961c70e403864540e190d17bb0e273f37a91b7630c683f
SSDEEP 3072:0AR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:VLC2PLhMma3lLNngoqRttA7k
TLSH
T1B0345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxspki.sys

Path C:\Temp\pnhfaxspki.sys
Size 141KB
SHA256 ef78963a4e5febdbdc455bab06088976d986a76b7f44afc9dacb5136afcc0740
MD5 c2150a08f6c00fd311607e7d75048029
SHA1 eb20d52b8f538c25adba0f23cd2cb677d7669f2f
SHA512 7c1f9e7896185b9306bf2b8bcb5e565b9a9f1194c3032eabfe79ed1d9abc7af6a476b0caf905a22ba2d8838a62d32e506591878e836174116e937250a30fb79b
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T108E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicaupkh.exe

Path C:\Temp\spkicaupkh.exe
Size 243KB
SHA256 767372feef967461c29b544df4077e7a1ef02cd95c5c208f60cb8ace53bfd50d
MD5 d2a9c58881e092e66d22e3b4b2975bde
SHA1 7dff2c62fac3ddb06043b1bc6773e8346d9c8fd9
SHA512 dee2d264b5ccf21ad69292ab3ae56f7e7e31bb5ec5e7f879def5d0eec399a4770818ba49d22ca4316fb2458080c86f5a809c0c5255fa8d429892177f1716045d
SSDEEP 3072:uAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:zLC2PLhMma3lLNngoqRttA7+
TLSH
T1F3345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 243KB
SHA256 2a418f090deabb2dc6d1331aff524383d3d356c0f5d9c14b21c004e1ce206727
MD5 a6e8d16a4ecedfa00d8dcf4c94e064dc
SHA1 b638493a0852da6b1d95ae31e6dcfdf19a9e2bb4
SHA512 06e8d0fec0b6e1a31b3cb9287687a2b6098cf633a32367c0e06fedea3cf087e8bb64e027a9aa67094108eb4fc00af80950124cc6f0aba62ae25753658540a96b
SSDEEP 3072:xAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:uLC2PLhMma3lLNngoqRttA75
TLSH
T1AD345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdywqo.sys

Path C:\Temp\vtnlgdywqo.sys
Size 141KB
SHA256 ce487387cb53a6ce95c7e743ccf6548927225f4fc4d135b5d8133397ca5d8a03
MD5 650fa9ebda54f696a4c76aecc20f0916
SHA1 23aa91cabd81b9fd60dc7694780ca38566ddabec
SHA512 59d105e9387b3af24f43c9ca94962cfde4d9e82e8a88c7e1025c79a91e6e7bdd25c5608e2bc635fc86de14b745fc337e3600475e746abab1c64b98720a295799
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqo.exe

Path C:\Temp\vtolgeywqo.exe
Size 243KB
SHA256 e5e7c81566873639a34e3723ebd67db8b832f502f040b6c7d75d51b65ea4e7f5
MD5 5beac763c46d650b921102a385985337
SHA1 bd862e784d4cc00c166fa7c1b33a29648d4ad0d4
SHA512 3c1390c625e4da2b894294da44d8b9a3acf88360f239b37a767864d2c9a8e56c81b2c95b9e32dd7968404c03f9626d607329bbd04f8cba81615c9d43bce368b7
SSDEEP 3072:6AR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:PLC2PLhMma3lLNngoqRttA7i
TLSH
T16A345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhezxrp.exe

Path C:\Temp\wupmhezxrp.exe
Size 243KB
SHA256 590216b125c0f6c1654958c0ebb6bef821d25403ede1089aa1cd38b63d151d44
MD5 2fb41181ac3fc502925c90667b35b51a
SHA1 80daff7a403796229664bc088f4a611cf5dbbd79
SHA512 214d8627c15c36121bec0c4e61339dd04275233316d34a31cdbeda0ec952cd88cfdb8a1352a188fae9b36f4dd338383e3842d1199e940118087d0fe4fc9197f9
SSDEEP 3072:QAR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:hLC2PLhMma3lLNngoqRttA78
TLSH
T174345A0172918031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidxvpn.exe

Path C:\Temp\ysqkidxvpn.exe
Size 243KB
SHA256 674170224330bb2a264c871f35fa82766708cbbc46e0352b3a7f851b8841f0d6
MD5 070a3790f6767cafc1aedc2329d74461
SHA1 2afff491f70b6eff051d0b33d4ac5fbd43ba3c14
SHA512 a305a80dbedda46a09bb02065f47797f4c2e57516bb6b44078f75a26d6ca79e3645a817e665bab615fcea031ff0b67a739078bd421adf5d2c9ad77f64eff22be
SSDEEP 3072:1AR5C2PLhhibJhb7y5a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:yLC2PLhMma3lLNngoqRttA7p
TLSH
T152345A0172818031E75A0B78045AE7A1467E7D384BA5E6CFF7A83F791A312D3A93724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 2e09c313379a35b892e4a0c3fa127fd9d62eec08dc237c0ba7728a747449dc48
MD5 01ca47db13a7eaf0010fc1c1edb66bc1
SHA1 a3459d2bdfea244cc8c277d48aa0107ba8b369bd
SHA512 b48452b516412bceb992136d45180192c50fbf6f1424849b333ba858a48229bd85c149a74f5acbe1efad0e01a967b37bbfe2523477865e816a01deae17f25bea
TLSH
T1BFF0DC858839E6A689834EEC02A71EBB3C2073DF34AA4111A43D0EF405B67B5EF090B4
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 0dec36f44db03ce13250422f48316767e317a80461d99858b80304fb79d3aedf
MD5 ffc4ac50d7590ab922a78c4da9175997
SHA1 d55dd5931c57962331bf5446f73d58a71f2b97a7
SHA512 be4f4b2bb2b934479773291b960f01b336f2df25cfa7c9bfc32411a13dcfad342a3ff2c72ee38e448b5bd8d852cc257a13d1ba531bfc364dbef7dd7529cd4c5f
TLSH
T10CE0682426F6011EE5F4D0344FC474219599F126143992B42DE55B04A2465009C03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/972-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1068-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1372-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1884-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2740-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3084-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3436-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3836-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3956-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3960-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4156-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4324-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4572-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4852-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4944-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads