systex | 9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
Size 361KB
Sample260827-rsplcsvxct
SHA256 9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5
MD5 42b95513c9348ac4886f6b5698f832cd
SHA1 109a04f757c1133b8c21c55cf78afda30634a3a8
SHA512 8d303590f3b78f3571f1e82ef45e843a68cfaf82e31de99ed9d78cb76772f574e7c5ec77b25bbde6cdb5ab17f7836ddf15fdc5732a72ec8b2713187b8abe042b
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1E9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3840	mgeywrojgbztrljd.exe
4212	CreateProcess.exe
2132	wrljebwtom.exe
1952	CreateProcess.exe
2520	mgeywrojgbztrljd.sys
3204	CreateProcess.exe
4600	i_wrljebwtom.exe
4828	jdbwtolgey.sys
5028	CreateProcess.exe
1056	ywqoigbytr.exe
2576	CreateProcess.exe
4444	CreateProcess.exe
1252	i_ywqoigbytr.exe
2572	aytqljdbvt.sys
1956	CreateProcess.exe
4820	lgdyvqoiga.exe
3848	CreateProcess.exe
4248	CreateProcess.exe
4624	i_lgdyvqoiga.exe
4952	qlidbvtnlg.sys
3764	CreateProcess.exe
4016	fdyvqoigay.exe
3504	CreateProcess.exe
836	CreateProcess.exe
1328	i_fdyvqoigay.exe
4628	dxvpnifays.sys
4532	CreateProcess.exe
4552	snkfdxvpnh.exe
3944	CreateProcess.exe
3500	CreateProcess.exe
2948	i_snkfdxvpnh.exe
2904	fdxvpnhfax.sys
1012	CreateProcess.exe
1900	xsmkfcxupn.exe
4648	CreateProcess.exe
968	CreateProcess.exe
3448	i_xsmkfcxupn.exe
1564	xupnhfzxrp.sys
4708	CreateProcess.exe
1576	hczusmkecx.exe
2036	CreateProcess.exe
960	CreateProcess.exe
5032	i_hczusmkecx.exe
4980	kezxrpjhbz.sys
2364	CreateProcess.exe
1064	wuomhezxrp.exe
3336	CreateProcess.exe
3436	CreateProcess.exe
2912	i_wuomhezxrp.exe
1836	wrojhbztrl.sys
2408	CreateProcess.exe
4792	pjhbztrmje.exe
5112	CreateProcess.exe
3056	CreateProcess.exe
1448	i_pjhbztrmje.exe
1100	rljdbwtomg.sys
4544	CreateProcess.exe
956	gbytrljebw.exe
3416	CreateProcess.exe
4052	CreateProcess.exe
1220	i_gbytrljebw.exe
3100	olgeywqoig.sys
2524	CreateProcess.exe
4852	ytqlidbvtn.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtomg.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2180	ipconfig.exe
2180	ipconfig.exe
1664	ipconfig.exe
456	ipconfig.exe
828	ipconfig.exe
3208	ipconfig.exe
4628	ipconfig.exe
4252	ipconfig.exe
3308	ipconfig.exe
4828	ipconfig.exe
4868	ipconfig.exe
4100	ipconfig.exe
2352	ipconfig.exe
4524	ipconfig.exe
3124	ipconfig.exe
3132	ipconfig.exe
1012	ipconfig.exe
1244	ipconfig.exe
3000	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{73B886FD-A223-11F1-B995-EEE306B5526A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274544"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1218161050"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000be7da78f7a91214180c82fdc27a228cc00000000020000000000106600000001000020000000178d25f619f9968af2260c34038df293083aa30fc4dd1dbf47794848faad1390000000000e8000000002000020000000293d196e4c48056122dd13f7ba3004a3db166420115a782bf5aed30eda6c0fd62000000099a67183d03127df8e9cf76779875e7bcd1c872213823b36795f577956f31e814000000015ae7ed464ed30510365b82efa2bbb52c3f5181f5a5e6fb9980d452d03ca7c1fe1c0bacbaa138a479fdc2a0a7776530e404a0311c487c5f210824a52ff5bf7b3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0019cfc10e36dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1215973521"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274544"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000be7da78f7a91214180c82fdc27a228cc00000000020000000000106600000001000020000000c6600fa5929e555229943c64dddc2f28c09f31aac9b515d819673ff523708504000000000e8000000002000020000000b545e50206ea0a5a25243072dee9d206441139d9f643e3d1ebf308051bab9c9b200000007f6ad9b6c38bfd825b7ee05209aebb4792d7a49a1ecd21882f6a32fac265212a40000000d3dd0d56dbf0301761d4cdd3a5e26e8213dd48c47726898d6ef3c73f5333f2295f489d8b5c163ce5b9938258f5b4c9a54b51bcc092c8fad34fb32c9b20d21fac	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2032c3c10e36dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494605833"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
3840	mgeywrojgbztrljd.exe
3840	mgeywrojgbztrljd.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	i_wrljebwtom.exe
Token: SeDebugPrivilege	1252	i_ywqoigbytr.exe
Token: SeDebugPrivilege	4624	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	1328	i_fdyvqoigay.exe
Token: SeDebugPrivilege	2948	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	3448	i_xsmkfcxupn.exe
Token: SeDebugPrivilege	5032	i_hczusmkecx.exe
Token: SeDebugPrivilege	2912	i_wuomhezxrp.exe
Token: SeDebugPrivilege	1448	i_pjhbztrmje.exe
Token: SeDebugPrivilege	1220	i_gbytrljebw.exe
Token: SeDebugPrivilege	4904	i_ytqlidbvtn.exe
Token: SeDebugPrivilege	3272	i_yvqoigavtn.exe
Token: SeDebugPrivilege	1844	i_sqkidavtnl.exe
Token: SeDebugPrivilege	4580	i_kicausnkfd.exe
Token: SeDebugPrivilege	1996	i_cxupnhfzxr.exe
Token: SeDebugPrivilege	1176	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	4440	i_zurmkecwuo.exe
Token: SeDebugPrivilege	716	i_rljdbwtomg.exe
Token: SeDebugPrivilege	4464	i_bytrljdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
4104	IEXPLORE.EXE
4104	IEXPLORE.EXE
4104	IEXPLORE.EXE
4104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3840	4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe	89
PID 4164 wrote to memory of 2204	4164	9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe	90
PID 2204 wrote to memory of 4104	2204	iexplore.exe	91
PID 3840 wrote to memory of 4212	3840	mgeywrojgbztrljd.exe	94
PID 2132 wrote to memory of 1952	2132	wrljebwtom.exe	98
PID 3840 wrote to memory of 3204	3840	mgeywrojgbztrljd.exe	103
PID 3840 wrote to memory of 5028	3840	mgeywrojgbztrljd.exe	109
PID 1056 wrote to memory of 2576	1056	ywqoigbytr.exe	111
PID 3840 wrote to memory of 4444	3840	mgeywrojgbztrljd.exe	114
PID 3840 wrote to memory of 1956	3840	mgeywrojgbztrljd.exe	118
PID 4820 wrote to memory of 3848	4820	lgdyvqoiga.exe	120
PID 3840 wrote to memory of 4248	3840	mgeywrojgbztrljd.exe	123
PID 3840 wrote to memory of 3764	3840	mgeywrojgbztrljd.exe	127
PID 4016 wrote to memory of 3504	4016	fdyvqoigay.exe	129
PID 3840 wrote to memory of 836	3840	mgeywrojgbztrljd.exe	133
PID 3840 wrote to memory of 4532	3840	mgeywrojgbztrljd.exe	138
PID 4552 wrote to memory of 3944	4552	snkfdxvpnh.exe	140
PID 3840 wrote to memory of 3500	3840	mgeywrojgbztrljd.exe	143
PID 3840 wrote to memory of 1012	3840	mgeywrojgbztrljd.exe	147
PID 1900 wrote to memory of 4648	1900	xsmkfcxupn.exe	149
PID 3840 wrote to memory of 968	3840	mgeywrojgbztrljd.exe	152
PID 3840 wrote to memory of 4708	3840	mgeywrojgbztrljd.exe	156
PID 1576 wrote to memory of 2036	1576	hczusmkecx.exe	158
PID 3840 wrote to memory of 960	3840	mgeywrojgbztrljd.exe	161
PID 3840 wrote to memory of 2364	3840	mgeywrojgbztrljd.exe	165
PID 1064 wrote to memory of 3336	1064	wuomhezxrp.exe	167
PID 3840 wrote to memory of 3436	3840	mgeywrojgbztrljd.exe	170
PID 3840 wrote to memory of 2408	3840	mgeywrojgbztrljd.exe	174
PID 4792 wrote to memory of 5112	4792	pjhbztrmje.exe	176
PID 3840 wrote to memory of 3056	3840	mgeywrojgbztrljd.exe	179
PID 3840 wrote to memory of 4544	3840	mgeywrojgbztrljd.exe	183
PID 956 wrote to memory of 3416	956	gbytrljebw.exe	185
PID 3840 wrote to memory of 4052	3840	mgeywrojgbztrljd.exe	188
PID 3840 wrote to memory of 2524	3840	mgeywrojgbztrljd.exe	192
PID 4852 wrote to memory of 3392	4852	ytqlidbvtn.exe	194
PID 3840 wrote to memory of 2868	3840	mgeywrojgbztrljd.exe	197
PID 3840 wrote to memory of 2448	3840	mgeywrojgbztrljd.exe	201
PID 4244 wrote to memory of 2812	4244	yvqoigavtn.exe	203
PID 3840 wrote to memory of 668	3840	mgeywrojgbztrljd.exe	206
PID 3840 wrote to memory of 2436	3840	mgeywrojgbztrljd.exe	210
PID 3292 wrote to memory of 3456	3292	sqkidavtnl.exe	212
PID 3840 wrote to memory of 4128	3840	mgeywrojgbztrljd.exe	215
PID 3840 wrote to memory of 1100	3840	mgeywrojgbztrljd.exe	219
PID 2300 wrote to memory of 2832	2300	kicausnkfd.exe	221
PID 3840 wrote to memory of 4240	3840	mgeywrojgbztrljd.exe	224
PID 3840 wrote to memory of 3284	3840	mgeywrojgbztrljd.exe	228
PID 1828 wrote to memory of 3484	1828	cxupnhfzxr.exe	230
PID 3840 wrote to memory of 4116	3840	mgeywrojgbztrljd.exe	233
PID 3840 wrote to memory of 1548	3840	mgeywrojgbztrljd.exe	237
PID 1772 wrote to memory of 2076	1772	fzxrpjhczu.exe	239
PID 3840 wrote to memory of 388	3840	mgeywrojgbztrljd.exe	242
PID 3840 wrote to memory of 2472	3840	mgeywrojgbztrljd.exe	246
PID 216 wrote to memory of 408	216	zurmkecwuo.exe	248
PID 3840 wrote to memory of 3904	3840	mgeywrojgbztrljd.exe	251
PID 3840 wrote to memory of 1104	3840	mgeywrojgbztrljd.exe	255
PID 4736 wrote to memory of 3240	4736	rljdbwtomg.exe	257
PID 3840 wrote to memory of 752	3840	mgeywrojgbztrljd.exe	260
PID 3840 wrote to memory of 4572	3840	mgeywrojgbztrljd.exe	264
PID 2124 wrote to memory of 4828	2124	bytrljdbvt.exe	266
PID 3840 wrote to memory of 3200	3840	mgeywrojgbztrljd.exe	269

C:\Users\Admin\AppData\Local\Temp\9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe
"C:\Users\Admin\AppData\Local\Temp\9762091f4399087b1f890b45c3ba7e12e57648baf8c09bf43c71ffe3706e77f5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Temp\mgeywrojgbztrljd.exe
  C:\Temp\mgeywrojgbztrljd.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrljebwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\Temp\wrljebwtom.exe
      C:\Temp\wrljebwtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrljebwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\i_wrljebwtom.exe
      C:\Temp\i_wrljebwtom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5028
  - - C:\Temp\ywqoigbytr.exe
      C:\Temp\ywqoigbytr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4444
  - - C:\Temp\i_ywqoigbytr.exe
      C:\Temp\i_ywqoigbytr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1956
  - - C:\Temp\lgdyvqoiga.exe
      C:\Temp\lgdyvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\i_lgdyvqoiga.exe
      C:\Temp\i_lgdyvqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3764
  - - C:\Temp\fdyvqoigay.exe
      C:\Temp\fdyvqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:836
  - - C:\Temp\i_fdyvqoigay.exe
      C:\Temp\i_fdyvqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4532
  - - C:\Temp\snkfdxvpnh.exe
      C:\Temp\snkfdxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3500
  - - C:\Temp\i_snkfdxvpnh.exe
      C:\Temp\i_snkfdxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsmkfcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1012
  - - C:\Temp\xsmkfcxupn.exe
      C:\Temp\xsmkfcxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsmkfcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:968
  - - C:\Temp\i_xsmkfcxupn.exe
      C:\Temp\i_xsmkfcxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4708
  - - C:\Temp\hczusmkecx.exe
      C:\Temp\hczusmkecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:960
  - - C:\Temp\i_hczusmkecx.exe
      C:\Temp\i_hczusmkecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Temp\wuomhezxrp.exe
      C:\Temp\wuomhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\i_wuomhezxrp.exe
      C:\Temp\i_wuomhezxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2408
  - - C:\Temp\pjhbztrmje.exe
      C:\Temp\pjhbztrmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\i_pjhbztrmje.exe
      C:\Temp\i_pjhbztrmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\gbytrljebw.exe
      C:\Temp\gbytrljebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4052
  - - C:\Temp\i_gbytrljebw.exe
      C:\Temp\i_gbytrljebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2524
  - - C:\Temp\ytqlidbvtn.exe
      C:\Temp\ytqlidbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqlidbvtn.exe ups_ins
    3⤵
    PID:2868
  - - C:\Temp\i_ytqlidbvtn.exe
      C:\Temp\i_ytqlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigavtn.exe ups_run
    3⤵
    PID:2448
  - - C:\Temp\yvqoigavtn.exe
      C:\Temp\yvqoigavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigavtn.exe ups_ins
    3⤵
    PID:668
  - - C:\Temp\i_yvqoigavtn.exe
      C:\Temp\i_yvqoigavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    PID:2436
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    PID:4128
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfd.exe ups_run
    3⤵
    PID:1100
  - - C:\Temp\kicausnkfd.exe
      C:\Temp\kicausnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    PID:4240
  - - C:\Temp\i_kicausnkfd.exe
      C:\Temp\i_kicausnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnhfzxr.exe ups_run
    3⤵
    PID:3284
  - - C:\Temp\cxupnhfzxr.exe
      C:\Temp\cxupnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxr.exe ups_ins
    3⤵
    PID:4116
  - - C:\Temp\i_cxupnhfzxr.exe
      C:\Temp\i_cxupnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    PID:1548
  - - C:\Temp\fzxrpjhczu.exe
      C:\Temp\fzxrpjhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    PID:388
  - - C:\Temp\i_fzxrpjhczu.exe
      C:\Temp\i_fzxrpjhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    PID:2472
  - - C:\Temp\zurmkecwuo.exe
      C:\Temp\zurmkecwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    PID:3904
  - - C:\Temp\i_zurmkecwuo.exe
      C:\Temp\i_zurmkecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbwtomg.exe ups_run
    3⤵
    PID:1104
  - - C:\Temp\rljdbwtomg.exe
      C:\Temp\rljdbwtomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomg.exe ups_ins
    3⤵
    PID:752
  - - C:\Temp\i_rljdbwtomg.exe
      C:\Temp\i_rljdbwtomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:4572
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:3200
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4104

C:\Temp\mgeywrojgbztrljd.sys
C:\Temp\mgeywrojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\jdbwtolgey.sys
C:\Temp\jdbwtolgey.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Temp\qlidbvtnlg.sys
C:\Temp\qlidbvtnlg.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:1564

C:\Temp\kezxrpjhbz.sys
C:\Temp\kezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:4980

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
- Executes dropped EXE
PID:1836

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
- Executes dropped EXE
PID:1100

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:3100

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:1304

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
PID:4260

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
PID:2124

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
PID:2092

C:\Temp\mkecxupmhf.sys
C:\Temp\mkecxupmhf.sys
1⤵
PID:2180

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
PID:4184

C:\Temp\ywrojgbztr.sys
C:\Temp\ywrojgbztr.sys
1⤵
PID:1652

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
PID:4292

C:\Temp\oigaytqlid.sys
C:\Temp\oigaytqlid.sys
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 a3ec14ce8a5404799521b2ea6e9019f6fd34ad15ce8c415be46403c28decb70e
MD5 a8d34af2fba14e62934a790769ad368e
SHA1 2225a623356ff2faa8fcc7fe8b6e531b002e1dc8
SHA512 dbd47cc153b63d9d895290066134b3fc9f9ae72df9d3bcd5f36fbb3f10d02b338e2ffd655ba20c1b65bca55af2f8eb3386bb637a44ffd4363e89094a8336c61d
TLSH
T10671008357B9C5B2C5DA5BF102835648F6BF22384B2370240BA1554AAB30ABA24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

aytqljdbvt.sys

Path C:\Temp\aytqljdbvt.sys
Size 293KB
SHA256 695ab2bee9588773a7079ecad0d3f70aff627284c3048833af2f44ee9464a536
MD5 e5ec82af3ee46445360dc71a2a3c7aa3
SHA1 d01cfe8f500f476e938965f29fc2213996b5cfdc
SHA512 8288553e7a8a74777dec1a50eb68da60cddf99adb2216b5378ee014ffdb63a2dc537ca6e60eac53957a4cd5de00f60fe53ac6a4455cf5480aea3822e9e3933a4
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifays.sys

Path C:\Temp\dxvpnifays.sys
Size 293KB
SHA256 f3495c990276a2924d929ac6dc35b798b182b86ba09ec356493397aef0e6fa23
MD5 61c16944e78a2a01fa26f0811bc7c2bf
SHA1 92bbe89ce5fd0301c5ef1c46bbdb4595fa41452e
SHA512 19f3e7cc03b73a156828974eb180d9b2779089516d978d5663e0ca2de9710ddc3fb802f989110b5ba330faa8ea96957e258b61f35955642a21cada398febde0d
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.sys

Path C:\Temp\fdxvpnhfax.sys
Size 293KB
SHA256 904caefbcbac70e636b4064aa2892ed15cc5781648cd892ff0b30002ea9f77ca
MD5 7289c116caa547ff33096a322d42ba14
SHA1 66b7197f6f09fd77d9d03a37976c3d2c7324eb5b
SHA512 78bc8627c81e22318313db699893e3849eb90399583eafa6771300f16672cc574c68e99231780fdef3089322ef055f55b017b8020efb6c47082b4d8844f709e2
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.exe

Path C:\Temp\fdyvqoigay.exe
Size 361KB
SHA256 0058181668501186093d68d098ec77ffc5c4ff7ff1b9a98e5ff5850003e60758
MD5 dc81fe326245be758539759d95e8fd01
SHA1 c99df9d5844862e97c11a1d61662fee828941361
SHA512 6b568f3b84b0823c717f4462dd26216b8a9d0a4b715fcb14347d878d367f735c7d06fb84fb5fd3abe4ef00a707a55fd27be7361ad53f01f6b0f51b60318505d4
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T110747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecx.exe

Path C:\Temp\hczusmkecx.exe
Size 361KB
SHA256 f173452bb0aeac2f8c3997aa8c8c7d6fa1b2316694f298ad19a39e04c94d511b
MD5 eb6d15133e7e123326e5262d99736dee
SHA1 312735995b719affe65c93b0e929c52793c44b80
SHA512 a37275ddd43b4f22c172049fd8765894b5bdda163c4fa3a43c9f852fb02ea7f66938d6f22eb1c210940f9aa674c85da396539d004fd03113519f82c19f663842
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T17B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdyvqoigay.exe

Path C:\Temp\i_fdyvqoigay.exe
Size 361KB
SHA256 a8bede36bb803a568c2814738dd100fba6ff1c54a46a38d6592006e8f4dec02e
MD5 6337418f5e1f78f14dee198f35a8f360
SHA1 7bdb38e0a05f46cf01be9470f89a5b849e8249c5
SHA512 3bbcaa56b066417dea5b74f13e13e994b8c57bc10a5ff19ffb240f8d4590a262424ddcdde66c70a95099268b9e8994cbbcc40bda6df84a16da1ab6c608ea0f5d
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T140747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkecx.exe

Path C:\Temp\i_hczusmkecx.exe
Size 361KB
SHA256 6fca3d6f9a647e0cbf91f9cd8da2b680570a6c03bd367d53f416ea01057a7076
MD5 d48b9629f15eed8e5846a8b1055ad4af
SHA1 6ff3b8ef8af317ccffcb5927d276ce78501e8d94
SHA512 8291bbe39ed2823810fdd6ed109ca62b1a34670e337c4feb4617a3dfaaa5ceadcf9d66c631b71f826cdf41a4c1be070ffec0009d6d8cdeaade8c06eb9f830802
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T141747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvqoiga.exe

Path C:\Temp\i_lgdyvqoiga.exe
Size 361KB
SHA256 dbfa1b31e90750cbe219528f008f9d4abbc8b2aad984abf3ce832080d32158e9
MD5 252d14db356b8af95d44f41dfcb5b77c
SHA1 0030e2bdb4152b715443a3a7d766036807fb79fb
SHA512 2b3ba35e1e9aac973f1748e5076a803bb0a1ff940d988eb2f0035bd21f76570c2094aaac2c547af96c6e78b1b09c70c44eb5dc6ac5e05d2f64494a1a1c231c77
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T1A6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpnh.exe

Path C:\Temp\i_snkfdxvpnh.exe
Size 361KB
SHA256 b732f793c4d23ca1814b3cc01292ac2c8fbcbe1e2607307821bda7a0ca3c7519
MD5 1cb3b94cb7686fdc3d1f0903e3e517ac
SHA1 0cc638b091f3e64fa3bdc1fff80989ef28f3945f
SHA512 06fac1b4993b49c1b8d4c86cec8e8bc897a941215e90105d0e83ad7da9c8eb9f451bccadb8a6b502aaca091e8b77fef6a9ef2ce21fcb9ea1b0646d8fd010814f
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T192747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrljebwtom.exe

Path C:\Temp\i_wrljebwtom.exe
Size 361KB
SHA256 888f6f06cea698239d7934536acee4c8a82e48b06e73acf7dfe455ba3f1c5087
MD5 7710d0a3718b13c26104298c73d3b08c
SHA1 d20b7cfab8379d25b8f220b33882c29896d6d535
SHA512 4f03cbf07d20a2b653018ed1703377d48bbb2f58a580378cc3fe6ac34eafc5411b4ff59415ebb4908babf2ec98cdbfc02e4ab76e891148446a0c996545640496
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T112747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsmkfcxupn.exe

Path C:\Temp\i_xsmkfcxupn.exe
Size 361KB
SHA256 e4f8fd80d5fd7be8a42c16db30c9925dfd77f9363e27d2a5f7fc3f16728eba3e
MD5 cf3b2e7fdad96afc12e5012d781d2148
SHA1 d53f6eeada7339793dfcadfe4c8be94b2751ea92
SHA512 420ad67078786bc6674c7d0669d883710fd8a9a6f4df0ffd2b04dd06dd9949238e95a56e08c6f6ed0f72f13a38166cbec4dbda78266652ff42f4a0f807a54cb0
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T12E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigbytr.exe

Path C:\Temp\i_ywqoigbytr.exe
Size 361KB
SHA256 efab03d82dd24ed65ea60a2db9bf3a12a539a094c1132a613cb1db95787fbba1
MD5 3b523a14401e9aeee9043aef20a8e286
SHA1 6598826e9a23b9d7a23d85431171398896ef6785
SHA512 16f768bc3aeb8dbede512796ca77b614d717011f28e0f616fcde275168ead381af54dba51788222248680b26de44406f35a96fcc8e987dc12b8e70cbada7c16c
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T14E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtolgey.sys

Path C:\Temp\jdbwtolgey.sys
Size 293KB
SHA256 1af767a9140d682eb4e4a6938543dd0eed110952ad4ba7aca2f313e5c0a6db9d
MD5 46adbdd5ef91fd0f029794a948b82b62
SHA1 29ffdcef8e5c9746b5874e516d8cd66786625879
SHA512 eeb335a0261d7f7480bd04f46b000c901fa1a3e9dbf293af7f5956df9bfb387595ce6b96ef9cec97197baa64364113465d8ccf6896f607f5415898bf3f93d446
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kezxrpjhbz.sys

Path C:\Temp\kezxrpjhbz.sys
Size 293KB
SHA256 a6dc1736193a42c56bb825dcb25f1417625e1d2269bd800cf0fa0fc6712325fd
MD5 673f8aae71b02b89448d4c99b990f830
SHA1 cacfd31e39ccb55c839e608b4e97aa1f462c130e
SHA512 1281c8202e3a2863fb081c4d5479bf46473b2bd6b1e5f2e5d435cfc13ec43840c242e7d768a5b01041acb2c5d4ec514e0567523fb8db5854da585da20c312b4e
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T122545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.exe

Path C:\Temp\lgdyvqoiga.exe
Size 361KB
SHA256 13ceceed03d5cfc9fd950f9f0a503880a57dea4f427e51713850186170bf65d1
MD5 021ea7fd3dbcf8e03a536154efaa700e
SHA1 f22ad1fe56b2a6835762a6ad3772995bff2d705e
SHA512 adf9645d5a6327970f9ae15856dae9788e9a424317e87484a701b4c34d45c5bd90386177a8caf15b3a38c7f86b1bd14c10fdee00e73248f7df81db2c98f7d2f7
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T161747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojgbztrljd.exe

Path C:\Temp\mgeywrojgbztrljd.exe
Size 361KB
SHA256 e86c40307fe4e1f05841a4af39916a5189a8ff5e5b71df013b6b0fa5ebe0ca99
MD5 9f53ad7c23101fc3f5d4b4d9b01e9042
SHA1 13b17b9708c655c4c21e74e1c8b191b3524f1b94
SHA512 48e7934f328d77812d1f7c4c43ca95673113e4df352ca0b13fd6eb309b67df73eabb0dcd5a6b199800646c23e911475768452608b565db3eb9a0cfdb6f0ab26d
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojgbztrljd.sys

Path C:\Temp\mgeywrojgbztrljd.sys
Size 293KB
SHA256 f7d918b6dc0675e120257fb47fc9a2d3753dc1f2ea3078280335fb384e2c0457
MD5 457fab34f7733eb9c34dd34632aadccf
SHA1 78276c1ac5f6ed71a81fd0ffddaf1be3b7b1b276
SHA512 3bef5bc72473909a771ee741c3e2c61136829c8a278fbd1c79d3fa9b3b8ec281370b4e14fad3d8b25facfbfe57bb8bd0c5b88c434f9038cce0e4c224be2b05ee
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.sys

Path C:\Temp\qlidbvtnlg.sys
Size 293KB
SHA256 9eec48ffb98a076b6c7eb83e04c713dc0c11ce1ffed244874b1b055cae9e356c
MD5 aab492985395d3c61b83b0149430f7a3
SHA1 0403222d881b5fc1e46abd4192263e96fbe4f2ba
SHA512 cbffc36f76cdf12b76bb71b06f94e4080252b8d19ac53ced31f4c36ca7c6a37b757539bbd9830222d7087316f9e204b190bf219a4342128fbebe13bd00425771
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T16C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.exe

Path C:\Temp\snkfdxvpnh.exe
Size 361KB
SHA256 0cff98f84580433122423aac8fc0d80ffd376af89de8a6f33b09773de9ea6b9e
MD5 6d96b54190ba21376ed385ee3d26d153
SHA1 fecc56e5b18272fff08de536c254febfb6b72636
SHA512 167e97ce46a92e2765f9e8a96428741a4684f378ac6cc32c462035da2888c7a3e30acc1018a2d80a76156d3d8caa60c75d85c64dbd54568e229cd7a8bb79e45d
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T149747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrljebwtom.exe

Path C:\Temp\wrljebwtom.exe
Size 361KB
SHA256 b6d6426a7f052029ced461040db43081091701476f4815d2c02232339cf8cd37
MD5 c78239b9dd3d27e24d1d934e4e5e4b10
SHA1 b47cdcc34c28d8920e113513a76f9dbda7dd7817
SHA512 4cbf8c73c9b164db04bb8eca94517cd9bc442949857c76ab1bf55fbb1686168fc647f168d250b7dc2af370375f405efe0314396ced7d1c851ad5dffdeb435b94
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T102747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezxrp.exe

Path C:\Temp\wuomhezxrp.exe
Size 361KB
SHA256 8c98ca728b5f488c51220c1533d186b54e56a9f25ec894b19b1cf69cabfabf94
MD5 3b1c36a13a60f1e59afdf9a172424952
SHA1 ad6085b724b5d3f4cb6a20b6c4fc15620ce97991
SHA512 6531345e7c1eb67dee2adf9159790c85e8ab8bd315202db721df2af75e70e913082e38381ec09fa40a690d10f6daad0bb2d3a7b1422a50eafdb5dc67052a0266
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T16F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkfcxupn.exe

Path C:\Temp\xsmkfcxupn.exe
Size 361KB
SHA256 c60c36ab4926531222d9f241d13d9120e264a8ccb89574682db797ed221fc927
MD5 2839f85de8e15033eb0920136a005a13
SHA1 8d903471d3424311d16e52d33a156a129519ade6
SHA512 284ce9fd5b882fe290248e5321d933868eed652ba9ad9c8c1320dd870472beb5a6c6d37c8442ce76fb81b4f97c86acd37c303c11b4b3d3a2c2713b394a4303a2
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxrp.sys

Path C:\Temp\xupnhfzxrp.sys
Size 293KB
SHA256 dd896d84e0542f8d424b6328523286c410cad4ef89526e28e758d1731aa1a037
MD5 4f2e6753b95eaf0a186904e1b874b2ab
SHA1 d754e7ed86776d17c979997ef8b00185452f9ce5
SHA512 e8cdb537eccab34512a58c487c65edb5271bb4ba6d20fa4a928f3d77617122f4b5f7bf4492ec5fa41904030a4c049739c3aee02a94b28e8cfab18a4e89e61455
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytr.exe

Path C:\Temp\ywqoigbytr.exe
Size 361KB
SHA256 150a2359c1b04ba90dcb5b0d82b055242766db17ad6619c08c87f5400f914bc5
MD5 a0ddc4c9465b07a47c2af01d0bf03799
SHA1 7bf39f809733d608c8f9cff452c504d6f30cfcf1
SHA512 c38a1d8f3b7fdf83fd037b30a36102129f10ba6653447dad80b34611895e74de699750ffa79c727c8920c00407a08958250fa144be5bbecdd93b6a8e924dfc58
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T16F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 744ae1f16edb48461f6c4a551e63d955f7e5cda7e04bf1012a781685c05d2448
MD5 abd4e03e652aac9abe0b308dcea36973
SHA1 9fd7d1987ce37458d32384dfd28aaeff4fd0696c
SHA512 b0a74b3bbadc5bdc83986f5717686eb7df6b0ca6f2652ea446edbbb3670da109a18971fef1799e5166c1a037498398bd997bac3c70e95496b7d6f37dcfe620cd
TLSH
T189F0DCF6A07FF0A01D55D8DC51A804AE34708ABE22950277E03C4BB7C93A73A771D038
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 dfb9deb684ca727910ee5f323255ad6db93bf773305ba9d2bd5a7b6274306187
MD5 9703b948910eb39858b9ae563169a73e
SHA1 bf25075f47eb979b59ea21db06733ad1d0112353
SHA512 9b9b59f15addcef128b9ad41e8b3c5113d5445a2cf66d7e8f933b5943974a983ba4e2267c8a35dd16b87104c3f6a7933a02d029b8173ff17e7c05fb43a5924bb
TLSH
T1A1E0C03825F7821FF5F8D4798BD87422C569F126112892F53DD4DB04A713A80AC22E2D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FVK2FCOF\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-128-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1100-123-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1304-132-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1564-88-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1652-157-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-106-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-144-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-149-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2124-140-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2180-148-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-14-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-33-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2904-76-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3100-127-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-165-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-153-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4260-136-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-161-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-21-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4952-45-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-100-0x0000000000010000-0x00000000000AB000-memory.dmp

Download