4a8e8eecf51580276665f8efb04f9cb40cac19ed6e9cd28b87838b8a15e6b967

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe
Size 243KB
Sample260930-msvedsys5m
SHA256 4a8e8eecf51580276665f8efb04f9cb40cac19ed6e9cd28b87838b8a15e6b967
MD5 697822d58c5039cc1be13df913314051
SHA1 7b972c496719db2cfec60110c061356e8e9639fe
SHA512 41fb2232e84583ef96a9219f83f64698f9e7e02d956159f0613376b0771255dca3e9bb5cf81410333d80dcd80915c5acfe1da385b7fbfd0cce7c1a51420b1bf5
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:Rb3TfLAUa3lLNngoqRttA7H
TLSH
T14434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2448	CP.exe
1544	rlgeytqljd.exe
4040	CP.exe
1872	CP.exe
4132	i_rlgeytqljd.exe
4032	ysqlidbvtn.sys
2748	CP.exe
3540	oigaytqlid.exe
2380	CP.exe
4528	CP.exe
3640	i_oigaytqlid.exe
5100	faxsqkicav.sys
1128	CP.exe
3360	ysqkidavpn.exe
2032	CP.exe
2172	CP.exe
4928	i_ysqkidavpn.exe
2652	cavsnlfdxv.sys
4600	CP.exe
4820	nhfzxspkic.exe
4324	CP.exe
4524	CP.exe
2816	i_nhfzxspkic.exe
4448	pkicausmkf.sys
3996	CP.exe
2592	fzxrpkhcxv.exe
3124	CP.exe
632	CP.exe
880	i_fzxrpkhcxv.exe
3224	zurmkecwuo.sys
3812	CP.exe
1400	smhfzxzrmk.exe
1536	CP.exe
4840	CP.exe
4284	i_smhfzxzrmk.exe
4556	pjebwuomge.sys
1636	CP.exe
3196	ezwrpjhbzt.exe
2808	CP.exe
2120	CP.exe
896	i_ezwrpjhbzt.exe
1808	erojgbztrl.sys
1376	CP.exe
4808	lgeywqoigb.exe
4452	CP.exe
4404	CP.exe
3796	i_lgeywqoigb.exe
3772	trljdbvtol.sys
3184	CP.exe
3048	dywqoigbyt.exe
3020	CP.exe
4108	CP.exe
4824	i_dywqoigbyt.exe
1072	gaytqljdbv.sys
1036	CP.exe
4924	vtnlfdyvqo.exe
3704	CP.exe
5116	CP.exe
2620	i_vtnlfdyvqo.exe
2348	ysqlfdxvqn.sys
4864	CP.exe
3796	nidxvqnifa.exe
3716	CP.exe
3916	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nidxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgeytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nidxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhfzxzrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhfzxzrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfaxsqkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlgeytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavpn.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4012	ipconfig.exe
3428	ipconfig.exe
3348	ipconfig.exe
1440	ipconfig.exe
2600	ipconfig.exe
4976	ipconfig.exe
4676	ipconfig.exe
3424	ipconfig.exe
4680	ipconfig.exe
2680	ipconfig.exe
1976	ipconfig.exe
4988	ipconfig.exe
4556	ipconfig.exe
2004	ipconfig.exe
3308	ipconfig.exe
3252	ipconfig.exe
2820	ipconfig.exe
1192	ipconfig.exe
220	ipconfig.exe
2924	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281352"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07a2015d150dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DDFF5983-BCBB-11F1-8007-768FA1516246} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2995257683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000004e1e9117040d56c0c10b8435efbf211e7164376dd6bd288547e061f7adb231fa000000000e8000000002000020000000427964b4124bbcb892acd654aa9ccd3e684a1fb8cb9881ded80209a78e8f6b002000000017e746ce95a94664f0d082872b5499fd2dd9daed8d5f716a18578887ae60f8f34000000094f67f4cfe2aaaf9e0f6dd0c23a0c46121c7fcbfc1be6702c4b0aa44a748048a2a953bd03821e8a87e619ef633675529dcc63599199d6739f89c1009c165eea2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497530024"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000c978c454af5b5eb1f76c1f576810cc853bbca608f23c1c738996e3eea3221f6b000000000e8000000002000020000000d75aa81256e567a1344d78ba034bcef4d1eb3e64b28ea4ecf70bbd550e64bfcc200000000c160f4c304653f91b817395b2e75e17d500af19a5aa37fa0d762fbd589afff040000000d62f2a42a1625a6ae38f8eb28bd39b40c40ebdf1b3f926ab87a97a143789da0b8e7e83907fbaee165596476bdc9108dd5efd6a6fbfa1b43ad5f897f692ed2e71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281352"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00051715d150dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3001976362"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	i_rlgeytqljd.exe
Token: SeDebugPrivilege	3640	i_oigaytqlid.exe
Token: SeDebugPrivilege	4928	i_ysqkidavpn.exe
Token: SeDebugPrivilege	2816	i_nhfzxspkic.exe
Token: SeDebugPrivilege	880	i_fzxrpkhcxv.exe
Token: SeDebugPrivilege	4284	i_smhfzxzrmk.exe
Token: SeDebugPrivilege	896	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	3796	i_lgeywqoigb.exe
Token: SeDebugPrivilege	4824	i_dywqoigbyt.exe
Token: SeDebugPrivilege	2620	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	220	i_nidxvqnifa.exe
Token: SeDebugPrivilege	2240	i_faxsqkicav.exe
Token: SeDebugPrivilege	2924	i_usmkecxupn.exe
Token: SeDebugPrivilege	2192	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	764	i_mkecwuomhb.exe
Token: SeDebugPrivilege	4908	i_bztrljebwu.exe
Token: SeDebugPrivilege	4904	i_aytqljdbvt.exe
Token: SeDebugPrivilege	3780	i_aytqigaytq.exe
Token: SeDebugPrivilege	3068	i_sqlidbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2828	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	87
PID 2828 wrote to memory of 592	2828	iexplore.exe	88
PID 4092 wrote to memory of 2448	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	92
PID 1544 wrote to memory of 4040	1544	rlgeytqljd.exe	97
PID 4092 wrote to memory of 1872	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	102
PID 4092 wrote to memory of 2748	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	109
PID 3540 wrote to memory of 2380	3540	oigaytqlid.exe	111
PID 4092 wrote to memory of 4528	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	114
PID 4092 wrote to memory of 1128	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	118
PID 3360 wrote to memory of 2032	3360	ysqkidavpn.exe	120
PID 4092 wrote to memory of 2172	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	123
PID 4092 wrote to memory of 4600	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	127
PID 4820 wrote to memory of 4324	4820	nhfzxspkic.exe	129
PID 4092 wrote to memory of 4524	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	132
PID 4092 wrote to memory of 3996	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	138
PID 2592 wrote to memory of 3124	2592	fzxrpkhcxv.exe	140
PID 4092 wrote to memory of 632	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	143
PID 4092 wrote to memory of 3812	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	154
PID 1400 wrote to memory of 1536	1400	smhfzxzrmk.exe	156
PID 4092 wrote to memory of 4840	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	159
PID 4092 wrote to memory of 1636	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	163
PID 3196 wrote to memory of 2808	3196	ezwrpjhbzt.exe	165
PID 4092 wrote to memory of 2120	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	168
PID 4092 wrote to memory of 1376	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	172
PID 4808 wrote to memory of 4452	4808	lgeywqoigb.exe	174
PID 4092 wrote to memory of 4404	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	177
PID 4092 wrote to memory of 3184	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	181
PID 3048 wrote to memory of 3020	3048	dywqoigbyt.exe	183
PID 4092 wrote to memory of 4108	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	186
PID 4092 wrote to memory of 1036	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	190
PID 4924 wrote to memory of 3704	4924	vtnlfdyvqo.exe	192
PID 4092 wrote to memory of 5116	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	195
PID 4092 wrote to memory of 4864	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	201
PID 3796 wrote to memory of 3716	3796	nidxvqnifa.exe	203
PID 4092 wrote to memory of 3916	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	206
PID 4092 wrote to memory of 2816	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	210
PID 1216 wrote to memory of 828	1216	faxsqkicav.exe	212
PID 4092 wrote to memory of 3004	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	215
PID 4092 wrote to memory of 4284	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	219
PID 4996 wrote to memory of 892	4996	usmkecxupn.exe	221
PID 4092 wrote to memory of 4696	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	224
PID 4092 wrote to memory of 4636	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	228
PID 4184 wrote to memory of 3296	4184	upmhfzxrpj.exe	230
PID 4092 wrote to memory of 4180	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	233
PID 4092 wrote to memory of 3468	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	237
PID 400 wrote to memory of 4856	400	mkecwuomhb.exe	239
PID 4092 wrote to memory of 4936	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	243
PID 4092 wrote to memory of 728	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	247
PID 2240 wrote to memory of 564	2240	bztrljebwu.exe	249
PID 4092 wrote to memory of 4580	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	252
PID 4092 wrote to memory of 4104	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	256
PID 2692 wrote to memory of 4008	2692	aytqljdbvt.exe	258
PID 4092 wrote to memory of 720	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	261
PID 4092 wrote to memory of 4140	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	265
PID 2360 wrote to memory of 2984	2360	aytqigaytq.exe	267
PID 4092 wrote to memory of 756	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	270
PID 4092 wrote to memory of 3028	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	274
PID 2680 wrote to memory of 1952	2680	sqlidbvtnl.exe	276
PID 4092 wrote to memory of 952	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	279
PID 4092 wrote to memory of 2932	4092	2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe	283
PID 2168 wrote to memory of 640	2168	kfaxsqkidx.exe	285

C:\Users\Admin\AppData\Local\Temp\2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_697822d58c5039cc1be13df913314051_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rlgeytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2448
- - C:\Temp\rlgeytqljd.exe
    C:\Temp\rlgeytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rlgeytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\i_rlgeytqljd.exe
    C:\Temp\i_rlgeytqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\oigaytqlid.exe
    C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4528
- - C:\Temp\i_oigaytqlid.exe
    C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Temp\ysqkidavpn.exe
    C:\Temp\ysqkidavpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Temp\i_ysqkidavpn.exe
    C:\Temp\i_ysqkidavpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4524
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3996
- - C:\Temp\fzxrpkhcxv.exe
    C:\Temp\fzxrpkhcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:632
- - C:\Temp\i_fzxrpkhcxv.exe
    C:\Temp\i_fzxrpkhcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smhfzxzrmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3812
- - C:\Temp\smhfzxzrmk.exe
    C:\Temp\smhfzxzrmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smhfzxzrmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\i_smhfzxzrmk.exe
    C:\Temp\i_smhfzxzrmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2120
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1376
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3184
- - C:\Temp\dywqoigbyt.exe
    C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\i_dywqoigbyt.exe
    C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nidxvqnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Temp\nidxvqnifa.exe
    C:\Temp\nidxvqnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nidxvqnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3916
- - C:\Temp\i_nidxvqnifa.exe
    C:\Temp\i_nidxvqnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run
  2⤵
  PID:2816
- - C:\Temp\faxsqkicav.exe
    C:\Temp\faxsqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins
  2⤵
  PID:3004
- - C:\Temp\i_faxsqkicav.exe
    C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  PID:4284
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_usmkecxupn.exe
    C:\Temp\i_usmkecxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run
  2⤵
  PID:4636
- - C:\Temp\upmhfzxrpj.exe
    C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
  2⤵
  PID:4180
- - C:\Temp\i_upmhfzxrpj.exe
    C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhb.exe ups_run
  2⤵
  PID:3468
- - C:\Temp\mkecwuomhb.exe
    C:\Temp\mkecwuomhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhb.exe ups_ins
  2⤵
  PID:4936
- - C:\Temp\i_mkecwuomhb.exe
    C:\Temp\i_mkecwuomhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  PID:728
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  PID:4580
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run
  2⤵
  PID:4104
- - C:\Temp\aytqljdbvt.exe
    C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins
  2⤵
  PID:720
- - C:\Temp\i_aytqljdbvt.exe
    C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqigaytq.exe ups_run
  2⤵
  PID:4140
- - C:\Temp\aytqigaytq.exe
    C:\Temp\aytqigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqigaytq.exe ups_ins
  2⤵
  PID:756
- - C:\Temp\i_aytqigaytq.exe
    C:\Temp\i_aytqigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  PID:3028
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  PID:952
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfaxsqkidx.exe ups_run
  2⤵
  PID:2932
- - C:\Temp\kfaxsqkidx.exe
    C:\Temp\kfaxsqkidx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3308

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:4032

C:\Temp\faxsqkicav.sys
C:\Temp\faxsqkicav.sys
1⤵
- Executes dropped EXE
PID:5100

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\pkicausmkf.sys
C:\Temp\pkicausmkf.sys
1⤵
- Executes dropped EXE
PID:4448

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
- Executes dropped EXE
PID:3224

C:\Temp\pjebwuomge.sys
C:\Temp\pjebwuomge.sys
1⤵
- Executes dropped EXE
PID:4556

C:\Temp\erojgbztrl.sys
C:\Temp\erojgbztrl.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:3772

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:1072

C:\Temp\ysqlfdxvqn.sys
C:\Temp\ysqlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:2348

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:2156

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
PID:3900

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:3876

C:\Temp\xrpjhczurm.sys
C:\Temp\xrpjhczurm.sys
1⤵
PID:4044

C:\Temp\ugbztrljdb.sys
C:\Temp\ugbztrljdb.sys
1⤵
PID:2964

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
PID:3424

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
PID:4708

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
PID:3300

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.sys

Path C:\Temp\cavsnlfdxv.sys
Size 141KB
SHA256 5ac9f48cafc35582701b7a7ed17207b480016edbbd9e7a806f9ae6a5039e9f4e
MD5 0189bf940a942af0afa1d1d14dc631ce
SHA1 2b16dba6bc9f573b86edc7734e90a8ae6b1316f5
SHA512 07fea41f65736415a5815ccfb0c89f3585a7628902ecd652580d1df22c100e420fc11786ef3cba9381747f21456e7471c720b914a65c4eb04d42eccb6e516ea3
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erojgbztrl.sys

Path C:\Temp\erojgbztrl.sys
Size 141KB
SHA256 5aae2b9d9c24be04a460eb1952dce3fa8949d1eec6683ab7d3abde5f5c32df2a
MD5 0d9b2420df2c3965245cf46369a3a843
SHA1 0ae2def96c53d0649d5d8d7ab3c980193187de6b
SHA512 4ab56c715b443955c28b9dd2f1ca58316d7a7016cebbe787c68124d3cc9513b18e176fb55a7b43e7de5561b635dd4a33ff8107a2e22c57afbb6722a77433572d
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.exe

Path C:\Temp\ezwrpjhbzt.exe
Size 243KB
SHA256 1422dcdc7f9d164da0f023d2a4b9c3865f2224eb946dacc639f819488d1c1dd0
MD5 ddfc50fcd919d39300b2c032b2f764d2
SHA1 85073f4471d8edaaed7ed445d875cfe9adcdbbbd
SHA512 377cb84db9a64d35fc6935c7e924b4d69c796d7986de184e462f08bf4a066f22592d719d163da3a7ca748d23da6aacd126c6664c7f35989299f14e9eb92e739c
SSDEEP 3072:rBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:db3TfLAUa3lLNngoqRttA7T
TLSH
T1CB34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicav.sys

Path C:\Temp\faxsqkicav.sys
Size 141KB
SHA256 31a34ca29a52d5da31baae97c088cd74416f461a8005e46a349286d26e3688e4
MD5 2a61886fe2ea19bf128582bf83ce21eb
SHA1 79c662a258c7d22dc0c69940a0d8ac12d40991ce
SHA512 a9b8b16e6759b616bea1e3f500c039c11f2ef77f350edc9d2abdddc7a8fb5aa936363d18940d87bcf7a54aaa79d3626f5236ad4cb81416c36e0df2870a50ab75
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcxv.exe

Path C:\Temp\fzxrpkhcxv.exe
Size 243KB
SHA256 673dee762dad075f2ba9e5204bdeb00b41986f6bd4e3e92aa83533331a6258a9
MD5 7bc217ddfcb84b6dc6396e4d9bd292b7
SHA1 6c27bfacd5741e0948fae6fcba60db471f2a5b7d
SHA512 07026149ebe1986931d2ed32e68468554aca4c529006e127bd98b4867651934d7343021ce855f5b0365c2ba343b20768697df6fc0778a2a6a8a3b365e02f659a
SSDEEP 3072:7Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:Nb3TfLAUa3lLNngoqRttA7r
TLSH
T19634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjhbzt.exe

Path C:\Temp\i_ezwrpjhbzt.exe
Size 243KB
SHA256 1bca2431b43f73dea589529b954db54dbed888df4f0ec27e6cb728b209804da5
MD5 d9a919a8c5cdcf27a5447b7d00de2607
SHA1 f124678aa9ed8ee83f75941e297f9a9a833b7e14
SHA512 045bdb34e8a69ef08aa4238ba3c1bc21690fe8b776291034bdb969ad63432b57bdbbf18de30853bffd4624e03a55fbef3df3879d87c768d98ec7f0f5118b08f5
SSDEEP 3072:MBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:Eb3TfLAUa3lLNngoqRttA7Y
TLSH
T1AC34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhcxv.exe

Path C:\Temp\i_fzxrpkhcxv.exe
Size 243KB
SHA256 ea3d968dc4753664c0b4879727c2417dc2d6fa77b6fffb93bae1d8b150ec3f0d
MD5 8735454871914da58368a763559f9ec7
SHA1 a880049e26bb5b7078eb56694249fec3cfe8fd57
SHA512 982b055f5e4b0ddb7765bbfc0a9feb661c62f8ac9a40d9bde2063414fbc1dbb236386a4a0319807490e14b264a1f08c5a80e31f45403b47b24fda9a9f9905311
SSDEEP 3072:IBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:4b3TfLAUa3lLNngoqRttA7c
TLSH
T1CE344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 243KB
SHA256 4fc001418d794eb6497c0775caff7d35bb1a0c56f9036dbe0031d21174f8e372
MD5 c2b569b9025d98ee1bfde34cddeebcfb
SHA1 aa13063918527ace43e40cf18e32cbb987c88c72
SHA512 23829123569b8b5d84f97855312325d1841c6968700b3157adfd52389974a7de5c3982034553bfff08b10cec830dd46b7a2f1058e38005c22abdfc4564f5bc2d
SSDEEP 3072:TBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:lb3TfLAUa3lLNngoqRttA73
TLSH
T18434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaytqlid.exe

Path C:\Temp\i_oigaytqlid.exe
Size 243KB
SHA256 4292e31acb141a2c108d6da008980f05cce8b8b200a4e4658525ac3f7e770b01
MD5 40ff400abafff8492b83561181202845
SHA1 afd746a0f5f48216497b8fcebb7098cb8d0ec857
SHA512 4e3452ead8e6d40ba6d63cbddd3371bdd4dcc5497b431b6aefc49d257d0e3d91d83824fb2963ac0ea12fefd5dd78617b07026174ef5a6e5e46877580ae1981a7
SSDEEP 3072:YBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:ob3TfLAUa3lLNngoqRttA7U
TLSH
T1C934490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rlgeytqljd.exe

Path C:\Temp\i_rlgeytqljd.exe
Size 243KB
SHA256 b685070d893043f13e9e8ec67ce193ab0a95e5f05b629d6994cfe7dbff4e4faf
MD5 d3ba741bd086e86daeb8c96d97bb25fa
SHA1 b3ed3fd89bd01f721f0c8b752aa9b5bcf2ccc04e
SHA512 41bb4ffebdc8339275bca92f26e05d8e2a59d147a3cb4b5db8006a17387c50e6e3dc585a45000e3f53953cc7f05546bc9a4afd895a6f8edc15378c0fee791d72
SSDEEP 3072:HBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:hb3TfLAUa3lLNngoqRttA7X
TLSH
T1D534490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smhfzxzrmk.exe

Path C:\Temp\i_smhfzxzrmk.exe
Size 243KB
SHA256 12e144abb59fa31dc7fab1f4df05144b31aea8a3041f3002cf7f8c4e4e224999
MD5 b93cdbafc437e333a9fdf3a5480d6972
SHA1 ef5863dbdf6a968b802ce356878261a87340b628
SHA512 b5b533552ebb9d669d23c966c23dfe9cc05454fc147e4cad1d0036d40bd1242d6f53290aa4ca51afea50cbb3c521005453cc7ee4b870c21e62d4fbf9d5c337c2
SSDEEP 3072:oBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:Yb3TfLAUa3lLNngoqRttA7g
TLSH
T18434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkidavpn.exe

Path C:\Temp\i_ysqkidavpn.exe
Size 243KB
SHA256 d803f2a5a209519331e00e0bb096b3922cce1f683e1e4858ad7e110d03a12bfb
MD5 1b5e996631e868f3a8d9bffc524eff54
SHA1 53011ca3c4b6d5c3dcccd898ef99bf7b21557f6f
SHA512 3c7909b0fda2699b42f5c9266392b957501382d03ad830901c9ce7028b75681333b91c63e657348ee89363a3513690046a2fe1394dd29e45362f9e64561abd19
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:Rb3TfLAUa3lLNngoqRttA7j
TLSH
T10F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.exe

Path C:\Temp\lgeywqoigb.exe
Size 243KB
SHA256 57b1f439b16a6a6900b106a1ab9e771b9b799fb4ef3117ef81f988d3cad200c3
MD5 0bab8df97dfecda72f7faf885e4ed51a
SHA1 bae65efcbfad244f8517cecbfebf8bf8e4491a81
SHA512 316510413359fec8ea7fef7a7be7930081d9212ad86f25b93edf08d5e422cd30adbc8188b8874a51491135f3f8b3df151ef549c0b31502ee4cd63112797e504d
SSDEEP 3072:OBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:ub3TfLAUa3lLNngoqRttA7u
TLSH
T17C34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 638185c5f4ab9c63439207409b6fcab27e0d5df18903e433c05846d40da84c5c
MD5 f0f41725f199595a74d72e055eb326c3
SHA1 5ec2b2992383f08cc8463d65453b6010c8def98f
SHA512 338f2de5774716dc93d040853a56a0aeacebd2ecd6c348b97529c0cad98f7857d8046cc2956445baa0c10bd4311dcb0694e9ee1f5da240ae05044b41fff3f01a
SSDEEP 3072:dBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:Hb3TfLAUa3lLNngoqRttA7t
TLSH
T12F344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqlid.exe

Path C:\Temp\oigaytqlid.exe
Size 243KB
SHA256 9411a482d1c7b06d7cf255c05e5ff1c48c4c964b81847a4819cda34eb0df72ac
MD5 bc52c3d90f51ca3f1691008dcc5e4b31
SHA1 8d67e795e5f682fdd0d90350186e057aefe2f407
SHA512 c1e6de96ed0e27b5ca226bac2256b9122bd049e4685ab0e6b6614d0d0de631b49f2869a449edb9781e1e339fb101a1b27adc64e86bed23a82d777a301fcb3578
SSDEEP 3072:dBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:Hb3TfLAUa3lLNngoqRttA7N
TLSH
T19834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjebwuomge.sys

Path C:\Temp\pjebwuomge.sys
Size 141KB
SHA256 3263b05d279b3af266352042e301da084997f5ed8ab26b5dec6d394c4dcecee9
MD5 37561ba221f3698a1b7c96b76ca22081
SHA1 c1b14b0ce5a652edde47f45b5ace83c38350ce80
SHA512 5bf34996831b0b72b32c1d4cba7919fc2d084cce4df9e4d83fb411c62f8665d9fa5c20ed0ea0aff1d5dcd3407af2c6963c51c46c3e6a2aa96f88f78e334c9a94
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkf.sys

Path C:\Temp\pkicausmkf.sys
Size 141KB
SHA256 9cd2b1329132b947128f43ea4cb5c7bac5eaec684db768be08256e40295911f6
MD5 bc24619577c525ca27101e85786cef2a
SHA1 4303fd152b0014a78ff86844aa5432b5d761e0cd
SHA512 7d9908add4a24a1ca7948eb63244ae3816a03596ed9f6e44e3b1dba35e8a84c4c69d8d4dbe4cb8a8118b1620348d8e7011d3d681cbc9e8efc0b8b64c33eeee62
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgeytqljd.exe

Path C:\Temp\rlgeytqljd.exe
Size 243KB
SHA256 e994abae7e3c25d3e4e7caa8db6223581cf3a77e4884bdfe40e21ac7b87c7374
MD5 bdfd522173ac94dc5eed1a84f3b9f714
SHA1 93f41d2bc98ddcf44ca2c8628f3ecc672a4bbf9b
SHA512 3b0f02dda5a86580c08738291c7ecefd083fcae0e5be88434ce6c46be2926d4336b9d57b9dafb734bfedebbc852c5068e960701c9c2380c44fa7fa291218dc3d
SSDEEP 3072:fBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:5b3TfLAUa3lLNngoqRttA7f
TLSH
T13934490172818071E75A0B74046AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smhfzxzrmk.exe

Path C:\Temp\smhfzxzrmk.exe
Size 243KB
SHA256 90487865ac89401c695e0301cbc9788bdfcc5dcaeb9badfecb9941a2d5b88373
MD5 8971d511dc95a75827de6534eeed78b3
SHA1 0194fa9968fff3065d676fad43d3e46561c85795
SHA512 23148ba57871ff875dcba3716bad82767f699188f3b2cae9387981ac132bc5176394766800e8d48e8e31fd20ebc98ab60bd30580b5e423885c1fc2346ecda604
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:ab3TfLAUa3lLNngoqRttA7K
TLSH
T13B344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidavpn.exe

Path C:\Temp\ysqkidavpn.exe
Size 243KB
SHA256 253eb4b5c656380cde962bea82dd59462a2444ec551c899bc71943f11ac3a6d4
MD5 4f96515499c3e381b39cbb5bd1659a17
SHA1 a9bca5f3b72a0c060a19f0983d36a5c96b679ab3
SHA512 fd66f9ac11dbce63f5a453d23c3c505504d3b82b5d16d282ad73f5620fa163d9a2b972b3adf910836e20f1e54238095d33fb5b53089ccb16ff34d6b49a852c40
SSDEEP 3072:nBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:Bb3TfLAUa3lLNngoqRttA7n
TLSH
T12C34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.sys

Path C:\Temp\ysqlidbvtn.sys
Size 141KB
SHA256 521602d7a6d82c35b175fbc8dbe2937af4860850f33d74659c3dc941abe301e6
MD5 20c97fb2c26b995d207e7c990924c3bc
SHA1 36eb990f4064c8d32e3cb64e006c87559a97bd10
SHA512 180c6f046536e2e7762c2b8c8c109efef41397a5f92274d2ac1ae77a068e88145f169b185b798c15833c16a108bf0dd01eb3b988ffaf24feeb5499a2c9f45c11
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.sys

Path C:\Temp\zurmkecwuo.sys
Size 141KB
SHA256 7554383baf462337aee181c46ee761484236616ec79d5dbc0fc00e76cd14161e
MD5 8d03b38a317fd696fc120be6824c227b
SHA1 d6909de4039c7f049a53ea5ad9855ae5dc5241fb
SHA512 fee642d437a9863dde2391442bde414aec3041362e0bc4dffac3505fd9a48d72bd746b0544072711d9c4a7999e2dba5aa5f9d92d223098e503f317f1dcda265a
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
MD5 c594b726a66926272d1a36f611dbee07
SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
TLSH
T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 fb71aae4861e566a535a13c0d61000e811f979e91f5f65bad5413a062ca86f96
MD5 b2ab8f8679a09ab04c3e18e5e4f578e3
SHA1 3ff40a2c5f650bd1e455841ef923c7f280698d53
SHA512 5538a6bf21b2b8d68e37da64637cd7d8760fe7db39f03f4bc36e3684adda11da8855c93aea5ab37f4db844cea46d47c4a5760405b671503ea31c7f909a3e03ce
TLSH
T13EE0C03822F7411FE4E4D8354BC67421547EF026141993F42ED4AB18B702A40AC12A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0OIDP0T3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1808-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2156-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2348-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2652-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3224-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3424-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3772-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4032-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4288-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4708-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5100-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads