93119d2ccbedc61053510fe386332dca9d72111a2904374e5d54dc561bcd194a

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-gg7mpasvb1
SHA256 93119d2ccbedc61053510fe386332dca9d72111a2904374e5d54dc561bcd194a
MD5 afb97fb8a0154406355602b024f6ada8
SHA1 62dbc2d48da8cc72a8574e0f93beab7025db70ee
SHA512 301127984c436ea2c4d2c1864029c12fcf7011fd4de33745b86ac7fc1efe3bf3e446b51ef476097f708930e4f48362601e609d999a49cfa6e4f47097540e597c
SSDEEP 3072:n+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:n+59tBBLkQa3lLNngoqRttA7E
TLSH
T12534490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3816	CP.exe
4512	vqnifaysqk.exe
1116	CP.exe
1832	CP.exe
4432	i_vqnifaysqk.exe
2856	nicavsnlfd.sys
1840	CP.exe
3904	axsqkausmk.exe
4108	CP.exe
3108	CP.exe
1560	i_axsqkausmk.exe
4008	xupnhfzxsp.sys
4504	CP.exe
1096	pkicausmhc.exe
2656	CP.exe
4200	CP.exe
3068	i_pkicausmhc.exe
2452	mhfzxrpjhc.sys
3008	CP.exe
4100	bzusmkecxu.exe
896	CP.exe
2248	CP.exe
4704	i_bzusmkecxu.exe
4640	cwupezwrpj.sys
1416	CP.exe
4332	jhbztrmjey.exe
1280	CP.exe
2424	CP.exe
4672	i_jhbztrmjey.exe
2288	rmgezwrojh.sys
2512	CP.exe
3224	geywqojdbw.exe
3368	CP.exe
2832	CP.exe
2252	i_geywqojdbw.exe
4228	bvtolgeywq.sys
1520	CP.exe
2520	tomgeytrlj.exe
3372	CP.exe
4996	CP.exe
3088	i_tomgeytrlj.exe
3100	tnlfdyvqoi.sys
2508	CP.exe
1544	lgdywqoiga.exe
3952	CP.exe
1108	CP.exe
4920	i_lgdywqoiga.exe
4008	idxvqnifay.sys
4112	CP.exe
3900	yvqnigaysq.exe
3772	CP.exe
628	CP.exe
3632	i_yvqnigaysq.exe
4376	fdxvpnifax.sys
3020	CP.exe
2412	qkfdxvpnhf.exe
4260	CP.exe
532	CP.exe
1988	i_qkfdxvpnhf.exe
1744	vpnhfzxspk.sys
1588	CP.exe
4684	kicausnkfc.exe
632	CP.exe
2820	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4476	ipconfig.exe
4536	ipconfig.exe
2880	ipconfig.exe
1536	ipconfig.exe
1428	ipconfig.exe
4704	ipconfig.exe
3296	ipconfig.exe
1532	ipconfig.exe
4780	ipconfig.exe
4972	ipconfig.exe
4160	ipconfig.exe
1264	ipconfig.exe
3296	ipconfig.exe
4160	ipconfig.exe
2688	ipconfig.exe
4432	ipconfig.exe
3164	ipconfig.exe
3612	ipconfig.exe
1216	ipconfig.exe
1100	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281713"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D43AEFF8-BE24-11F1-86D4-CAA8D6BDFC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2831587105"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e2576000000000020000000000106600000001000020000000de27d3442c5c69a5bf3c164687edc0fdc038b0e09d0153aad6c864a75cede1d2000000000e800000000200002000000021b3312cfba18487c228506214b545eba26293c70eeb8827f92a69c7835f9e8c2000000079ce3a7d544cbb5b8cebb2f8e6b43be93e7c470d92cdc7d1763ba98f0ad2b323400000007e8e765f6b73c70e09cdd95b9dd9db1c34b0fae63fa5eea19a657ce395a07680708c5cd6e327b835e5968efe5737c326122197d783b60efbf1aa523aa7c1787c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281713"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10624e0b3a52dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2036470b3a52dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497685056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2835805800"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e257600000000002000000000010660000000100002000000079a9496afa9fc127d43440b6e418c5822c32a5aecd1fa93d7a61a6156e2fcb9d000000000e8000000002000020000000f4a0d287deabee33c35ef1fcd9184e747da30d5811984b7c24006d61c47e4f9920000000a22b5006279e1ddfed114e700288006b40be921c0ccdecb30d6031ed98ebedd340000000048c2e49282401409b6d08ae5c4461c7749a00f81fa89181143b0411ecc59300680cff9612302bff4c25f341dfe9c9199ecee08560b741ccc790b335d5f8b8f1	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	i_vqnifaysqk.exe
Token: SeDebugPrivilege	1560	i_axsqkausmk.exe
Token: SeDebugPrivilege	3068	i_pkicausmhc.exe
Token: SeDebugPrivilege	4704	i_bzusmkecxu.exe
Token: SeDebugPrivilege	4672	i_jhbztrmjey.exe
Token: SeDebugPrivilege	2252	i_geywqojdbw.exe
Token: SeDebugPrivilege	3088	i_tomgeytrlj.exe
Token: SeDebugPrivilege	4920	i_lgdywqoiga.exe
Token: SeDebugPrivilege	3632	i_yvqnigaysq.exe
Token: SeDebugPrivilege	1988	i_qkfdxvpnhf.exe
Token: SeDebugPrivilege	3916	i_kicausnkfc.exe
Token: SeDebugPrivilege	3844	i_cwupmhfzxr.exe
Token: SeDebugPrivilege	4216	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	2352	i_ojgbztrljd.exe
Token: SeDebugPrivilege	3812	i_omgeywqojg.exe
Token: SeDebugPrivilege	3516	i_gbytrljdbv.exe
Token: SeDebugPrivilege	3736	i_vqnigavtnl.exe
Token: SeDebugPrivilege	3572	i_dxvpnifays.exe
Token: SeDebugPrivilege	2160	i_xsqkicausn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3496	iexplore.exe
3496	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3496	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	86
PID 3496 wrote to memory of 2388	3496	iexplore.exe	87
PID 1540 wrote to memory of 3816	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	91
PID 4512 wrote to memory of 1116	4512	vqnifaysqk.exe	96
PID 1540 wrote to memory of 1832	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	101
PID 1540 wrote to memory of 1840	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	108
PID 3904 wrote to memory of 4108	3904	axsqkausmk.exe	110
PID 1540 wrote to memory of 3108	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	113
PID 1540 wrote to memory of 4504	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	117
PID 1096 wrote to memory of 2656	1096	pkicausmhc.exe	119
PID 1540 wrote to memory of 4200	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	122
PID 1540 wrote to memory of 3008	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	126
PID 4100 wrote to memory of 896	4100	bzusmkecxu.exe	128
PID 1540 wrote to memory of 2248	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	131
PID 1540 wrote to memory of 1416	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	137
PID 4332 wrote to memory of 1280	4332	jhbztrmjey.exe	139
PID 1540 wrote to memory of 2424	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	143
PID 1540 wrote to memory of 2512	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	153
PID 3224 wrote to memory of 3368	3224	geywqojdbw.exe	155
PID 1540 wrote to memory of 2832	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	158
PID 1540 wrote to memory of 1520	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	162
PID 2520 wrote to memory of 3372	2520	tomgeytrlj.exe	164
PID 1540 wrote to memory of 4996	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	167
PID 1540 wrote to memory of 2508	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	171
PID 1544 wrote to memory of 3952	1544	lgdywqoiga.exe	173
PID 1540 wrote to memory of 1108	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	176
PID 1540 wrote to memory of 4112	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	180
PID 3900 wrote to memory of 3772	3900	yvqnigaysq.exe	182
PID 1540 wrote to memory of 628	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	185
PID 1540 wrote to memory of 3020	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	189
PID 2412 wrote to memory of 4260	2412	qkfdxvpnhf.exe	191
PID 1540 wrote to memory of 532	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	194
PID 1540 wrote to memory of 1588	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	200
PID 4684 wrote to memory of 632	4684	kicausnkfc.exe	202
PID 1540 wrote to memory of 2820	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	205
PID 1540 wrote to memory of 4556	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	209
PID 964 wrote to memory of 3260	964	cwupmhfzxr.exe	211
PID 1540 wrote to memory of 2796	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	214
PID 1540 wrote to memory of 4788	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	218
PID 3360 wrote to memory of 3796	3360	wrpjhbztrm.exe	220
PID 1540 wrote to memory of 3728	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	223
PID 1540 wrote to memory of 4220	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	227
PID 4412 wrote to memory of 4464	4412	ojgbztrljd.exe	229
PID 1540 wrote to memory of 2164	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	232
PID 1540 wrote to memory of 3024	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	237
PID 3488 wrote to memory of 1868	3488	omgeywqojg.exe	239
PID 1540 wrote to memory of 2252	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	242
PID 1540 wrote to memory of 3968	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	246
PID 3760 wrote to memory of 4048	3760	gbytrljdbv.exe	248
PID 1540 wrote to memory of 3828	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	251
PID 1540 wrote to memory of 4064	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	255
PID 3352 wrote to memory of 4216	3352	vqnigavtnl.exe	257
PID 1540 wrote to memory of 4452	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	260
PID 1540 wrote to memory of 3336	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	264
PID 3240 wrote to memory of 2352	3240	dxvpnifays.exe	266
PID 1540 wrote to memory of 4268	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	269
PID 1540 wrote to memory of 5072	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	273
PID 3184 wrote to memory of 4976	3184	xsqkicausn.exe	275
PID 1540 wrote to memory of 3400	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	278
PID 1540 wrote to memory of 3116	1540	2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe	282
PID 3460 wrote to memory of 2212	3460	pnhfzxrpkh.exe	284

C:\Users\Admin\AppData\Local\Temp\2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_afb97fb8a0154406355602b024f6ada8_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3496 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnifaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3816
- - C:\Temp\vqnifaysqk.exe
    C:\Temp\vqnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnifaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1832
- - C:\Temp\i_vqnifaysqk.exe
    C:\Temp\i_vqnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1840
- - C:\Temp\axsqkausmk.exe
    C:\Temp\axsqkausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_axsqkausmk.exe
    C:\Temp\i_axsqkausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4504
- - C:\Temp\pkicausmhc.exe
    C:\Temp\pkicausmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\i_pkicausmhc.exe
    C:\Temp\i_pkicausmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzusmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\bzusmkecxu.exe
    C:\Temp\bzusmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzusmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2248
- - C:\Temp\i_bzusmkecxu.exe
    C:\Temp\i_bzusmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1416
- - C:\Temp\jhbztrmjey.exe
    C:\Temp\jhbztrmjey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2424
- - C:\Temp\i_jhbztrmjey.exe
    C:\Temp\i_jhbztrmjey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2512
- - C:\Temp\geywqojdbw.exe
    C:\Temp\geywqojdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\i_geywqojdbw.exe
    C:\Temp\i_geywqojdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Temp\tomgeytrlj.exe
    C:\Temp\tomgeytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Temp\i_tomgeytrlj.exe
    C:\Temp\i_tomgeytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1108
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\yvqnigaysq.exe
    C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\i_yvqnigaysq.exe
    C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkfdxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3020
- - C:\Temp\qkfdxvpnhf.exe
    C:\Temp\qkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkfdxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:532
- - C:\Temp\i_qkfdxvpnhf.exe
    C:\Temp\i_qkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\kicausnkfc.exe
    C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2820
- - C:\Temp\i_kicausnkfc.exe
    C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  PID:4556
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  PID:2796
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  PID:4788
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  PID:3728
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  PID:4220
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  PID:2164
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:3024
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:2252
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  PID:3968
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  PID:3828
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigavtnl.exe ups_run
  2⤵
  PID:4064
- - C:\Temp\vqnigavtnl.exe
    C:\Temp\vqnigavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigavtnl.exe ups_ins
  2⤵
  PID:4452
- - C:\Temp\i_vqnigavtnl.exe
    C:\Temp\i_vqnigavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  PID:3336
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  PID:4268
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicausn.exe ups_run
  2⤵
  PID:5072
- - C:\Temp\xsqkicausn.exe
    C:\Temp\xsqkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicausn.exe ups_ins
  2⤵
  PID:3400
- - C:\Temp\i_xsqkicausn.exe
    C:\Temp\i_xsqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:3116
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296

C:\Temp\nicavsnlfd.sys
C:\Temp\nicavsnlfd.sys
1⤵
- Executes dropped EXE
PID:2856

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:4008

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:2452

C:\Temp\cwupezwrpj.sys
C:\Temp\cwupezwrpj.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Temp\rmgezwrojh.sys
C:\Temp\rmgezwrojh.sys
1⤵
- Executes dropped EXE
PID:2288

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:4228

C:\Temp\tnlfdyvqoi.sys
C:\Temp\tnlfdyvqoi.sys
1⤵
- Executes dropped EXE
PID:3100

C:\Temp\idxvqnifay.sys
C:\Temp\idxvqnifay.sys
1⤵
- Executes dropped EXE
PID:4008

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:1744

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:4072

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
PID:3120

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
PID:1656

C:\Temp\ytrljebwto.sys
C:\Temp\ytrljebwto.sys
1⤵
PID:2460

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:3632

C:\Temp\gaytqlidbv.sys
C:\Temp\gaytqlidbv.sys
1⤵
PID:1688

C:\Temp\ytnlfdxvqn.sys
C:\Temp\ytnlfdxvqn.sys
1⤵
PID:4372

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
PID:684

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkausmk.exe

Path C:\Temp\axsqkausmk.exe
Size 243KB
SHA256 f8169ccaa06f757a2adb92edc5cfbbbc079eded31080b18001d4a2f5b4aa5bb2
MD5 198317932c78a8332bbd28ed347d7cfb
SHA1 c6101705b4b2684f790ba0176b693c14c4e1718d
SHA512 25a28e8e755f1850df0dc8e622e71f458d54e1f119fb6156f48f382b01deded5697b7067741b6ee79f9e6221e2bcf90579aacdb47853ce0b97891d764c28da41
SSDEEP 3072:t+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:t+59tBBLkQa3lLNngoqRttA7u
TLSH
T14B34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 141KB
SHA256 f68c8d47744f73ec7da7194474f541b4c9aad0bf66aa7116663456672f454be5
MD5 c4075738f2a29845a2161389c13ad272
SHA1 5944a5c465004702c5a535b214a370aa50086dc5
SHA512 b8451a184649f14dca57632e7e4c453179b7723d146668fe42122cfa76e8733315418f789eb34e4bfb42fe3f3da2e0e65dbd75513a7c8db158d6b1f659926673
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T164E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzusmkecxu.exe

Path C:\Temp\bzusmkecxu.exe
Size 243KB
SHA256 dbbf1bdde7df288d9db877f8f9ea76baeab88cc63cc7477e3d14e655e08e3df7
MD5 8246ede7b50358d45c1c110234e478a4
SHA1 6bfed34f2d39995ca178255111d2dd775b42973e
SHA512 ee86e1afa47cc98e9e43dc49d595ef14f94b66edb9a7b5f79c021950263a5bf3c489015f88880e53efe283bc0754dbdadcd510c9acb640984e09b827da87f8d4
SSDEEP 3072:C+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:C+59tBBLkQa3lLNngoqRttA7/
TLSH
T1E134490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupezwrpj.sys

Path C:\Temp\cwupezwrpj.sys
Size 141KB
SHA256 a0ec42b1a1348416a290277e87f73a4edb9ffc149b3d0b2ae642933254cb01dc
MD5 a5cae7fa7c488bd30dd9c9f131fdd6ba
SHA1 23f03c8bb3974e29f32dfeb79ac1c0d4403a7c3e
SHA512 015067af519e3bff70fe8254ab41b5bf6ece89e04a3422560115c3245aaba94129b17111375a98e95b76d94a53044500946a310cfa4fc18ebb5f7ef66c1ed6cf
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojdbw.exe

Path C:\Temp\geywqojdbw.exe
Size 243KB
SHA256 99b70e11ad447a13b055634ed9d2bf1d443b130241dc3bb53566e6f48b1b70d7
MD5 b5c48d3b7e1156903de3f3a55005aa78
SHA1 f9c4d6adef0051f71a8936ba55219f9ae4bf91a8
SHA512 ccd3fadd3b4209c3709b52f0fcaea12fbf165177a001cc4b8781e6a43a390b5eb6b6e47af0d877829585c071c8dfd4a7c69171b326da78e45c184cabf6442366
SSDEEP 3072:9+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:9+59tBBLkQa3lLNngoqRttA72
TLSH
T16034490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkausmk.exe

Path C:\Temp\i_axsqkausmk.exe
Size 243KB
SHA256 7fbdcde977a7c83bf04efe8c8b0359652716c285efb978545d93421c5e98f850
MD5 847f017e4be1845ed2fd846d174abaaa
SHA1 72dceaa321751eec88a4b06a976fbf8e3707c1e4
SHA512 a5859d4fe39a01eb9cf4b06b29ddce01e53d266359ee08ce4fda84196c2318ef644c303cf5ac94dda7a390695233b0361242bc03637876351cf151af82298aba
SSDEEP 3072:n+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:n+59tBBLkQa3lLNngoqRttA78
TLSH
T17C34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzusmkecxu.exe

Path C:\Temp\i_bzusmkecxu.exe
Size 243KB
SHA256 970509c8b6fc394b46313635cb83e13ce156323eec7b230f859ad449b2655f96
MD5 3d9acacb7c4a4c40783e6ebfab89ed02
SHA1 0f15a855bec2794ed4f733c3d68ac4dc7939c4e1
SHA512 139ec9b01fdfeca6722f31a2e7bd8234b931f95cdd7f08f419ffd7d661641904e4fb6c2976d2b8fddc1725d77f7c85616b1be50dd2bf297e530ce1d08cb8b7a4
SSDEEP 3072:1+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:1+59tBBLkQa3lLNngoqRttA7G
TLSH
T12D34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojdbw.exe

Path C:\Temp\i_geywqojdbw.exe
Size 243KB
SHA256 58794042c8f7571b9e53b85e476aeeb9344d63ce38bc7d0ee643286697614a82
MD5 82e7ae6f33e480eacadc485508a55266
SHA1 75f5716d0a5f244253d1ec1366e0cda84a6b8af7
SHA512 a372170ecad3c9c52ef426464bdf01796c464582261b82f112a256c043ea2ca950a2811ab02cddcfa68a57a2df7a20bdb834b673d68e336a4dc66d57f05a8d6d
SSDEEP 3072:E+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:E+59tBBLkQa3lLNngoqRttA7N
TLSH
T1EA34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbztrmjey.exe

Path C:\Temp\i_jhbztrmjey.exe
Size 243KB
SHA256 fa3d9ec6e81da961deccaa68ef4e01f91e36bacbe204fe07c0c2470b5e6d9470
MD5 c2a6493f5d7e58683bedd1847c2c30d5
SHA1 e385bd0e9b033a43361e1abce542f5d73c9aa538
SHA512 4e97774fff709d4562c5f482ce5d0b161838634dd37f296b2b39a4cc799deaf693d14b7d9742376bc274a9671ae6026be4a13b02a2a0bf73dc50a235bdb0a8a6
SSDEEP 3072:0+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:0+59tBBLkQa3lLNngoqRttA7x
TLSH
T14B34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausmhc.exe

Path C:\Temp\i_pkicausmhc.exe
Size 243KB
SHA256 6a1dba67be5b64542e5946bdbd998563cf9360af443b3389544ba3d62aa4305f
MD5 51b7861b7e7f80bfca9f2131e6383398
SHA1 d0e26772b90317ce2bbc8604aebac7c184809a81
SHA512 695497c1e8be17055d8814710097f73159bded160ef34bee489a0569e816d53b7e64eeb47628e94a192230e7140452700ec5b7bd16d01e9627f829f5ed935482
SSDEEP 3072:z+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:z+59tBBLkQa3lLNngoqRttA70
TLSH
T1F334490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeytrlj.exe

Path C:\Temp\i_tomgeytrlj.exe
Size 243KB
SHA256 b6100e702c0c8cb1d973e78fdb8dd4a82327f69e708366b08fed1708b354908b
MD5 f764ca40ec86a6e4117e0f89c6acb690
SHA1 063f77c3198b3b73208561ee2c9d7ea1c4c5dc17
SHA512 0da6d535a1c39a35fe7081630c94418a6f1b1ea494931bb44e3d00fdc65df2a6a4c3711da9525107e298fa2d2999c5678616d8755ea77170adb5146128207e9c
SSDEEP 3072:F+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:F+59tBBLkQa3lLNngoqRttA7S
TLSH
T19234490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifaysqk.exe

Path C:\Temp\i_vqnifaysqk.exe
Size 243KB
SHA256 37af95151bd2fc5919adc771cf9df2703cdb83a1312a7840d8b5efa0970945fb
MD5 dcc16758f4753a17665e0284ba96a703
SHA1 ef41c276c59a59018e9b4133048c631ecc0fcc12
SHA512 39169975b23da7326524e6e6db60f2e89f416c8fbcd216b8473c59e2babc089a298c1cfdab785a12b35ddd2ebe91d42b0b44e74a5eb3eb8da8cf910c834286a2
SSDEEP 3072:H+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:H+59tBBLkQa3lLNngoqRttA7M
TLSH
T1C834490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjey.exe

Path C:\Temp\jhbztrmjey.exe
Size 243KB
SHA256 e75c7ce860d0f1759e383710fefdeb3389dc2f88e8b6ae32ee599a5180c376e4
MD5 d24794d58a8c446421b606023d177fe4
SHA1 583d92fd4951dc01aed673ac4c7d02df42533c85
SHA512 05e6d10cbe670eca8fa48ee8cbb21b70590b1fa33229a1b3b288f184b54295e71e69bc856f91a43a78196570e06c7d310b6ebece9d78322b05d742982e65b2aa
SSDEEP 3072:4+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:4+59tBBLkQa3lLNngoqRttA7t
TLSH
T15F34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.exe

Path C:\Temp\lgdywqoiga.exe
Size 243KB
SHA256 6fedf8d443512074a515650a7e2df4bd05743eec3a8a0fe29c52d0b5c8ac79c2
MD5 6485b7fcdc4013d0ee71f311291eb376
SHA1 48ce00b0f7db9add5b12977051035a076368e876
SHA512 fd66b95114489651e72be55956be49f43b7807e2479f9343ad8dc932194f4c930f3dacc0eb0ba8906a7aeed2cb2a5c68b7da71ce0e89055cfa60ff6b511b5d9d
SSDEEP 3072:s+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:s+59tBBLkQa3lLNngoqRttA7F
TLSH
T15B34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.sys

Path C:\Temp\mhfzxrpjhc.sys
Size 141KB
SHA256 095a493ab2b40edac59c0c10e107453de9efbbeb98fd4c48be25b1e46c0bf44f
MD5 07c4aa21106d6fe161810a69b1833fa1
SHA1 aa1f6c5f76371f817566a3f50c7bd92a40ed2109
SHA512 e5e743557df40d32821674018191c74eac28d6a8755b9c206df33b4936c97dce6160fc52ce2c7471deacc8d69491c2af950c9f768af6278b6160317721606272
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicavsnlfd.sys

Path C:\Temp\nicavsnlfd.sys
Size 141KB
SHA256 df1326640e96f178c3c8598a7d33dc71728f09d9bbeabe47a03c22b1be915945
MD5 5d903dc5c6fa156283ee9e3f0235b6d1
SHA1 e34356c7a8782b965beba364cf682da777fd6888
SHA512 af75351dd6866c512ccba5a01848d507c1d219a6d76f0a44203698389676584b827a62ff5fd1a1f48ad10564d5fd6419ad2594ecf96d2393b1fd73c7e483f7bd
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmhc.exe

Path C:\Temp\pkicausmhc.exe
Size 243KB
SHA256 d9f337275c29d1cb44fccba01b42ab163e111b7cd308a17b77dfbffdbc58a4fd
MD5 0798362fe042e9345c64fd2d9b6d8a0b
SHA1 2c7951fa86789ab8b0a94b0da4022fcb1b2850ef
SHA512 8d997cb0f81febe38b9e8c741ff3e9a2706911ba914a7619258ab7c1563c00271dcbee081c7704beaebb4d7fffda6b01100f0d794c258ddd73cc59ea74a93d4a
SSDEEP 3072:F+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:F+59tBBLkQa3lLNngoqRttA7e
TLSH
T16234490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgezwrojh.sys

Path C:\Temp\rmgezwrojh.sys
Size 141KB
SHA256 a719ade5271acba28a2135f2ce79cd54a47bde7efbb9238d2cc85d161d23e529
MD5 261d8702c77c440e9ae710cde8bd894f
SHA1 4ab103b2d5d632876c39d4cbbfe350792b4565f4
SHA512 0500ff41ceaedf22fc50282890a7c3db6a4f8d58c182400624c4b9e44113b07a4817e0ecf6e79b6f871551f37aedb37db1d94ec9a67e3d9d18f9e544bb98e148
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.sys

Path C:\Temp\tnlfdyvqoi.sys
Size 141KB
SHA256 5d2a2dc6ffff8016cae58635c7cf09ee1fe523061ad56924d40deb003bbe9701
MD5 1ea2c5a5e164f3d52c65731454578b09
SHA1 98f55c6fee31642e55a285a704c3173a6d1bef3c
SHA512 cf4232971615f702ceb23dcf64dfd75f114f9847d739302d6e848a30928f8990290b74bc435d45e57a71627b3db93bb8c9ee915223d7827e7782c40dcb0912dd
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeytrlj.exe

Path C:\Temp\tomgeytrlj.exe
Size 243KB
SHA256 4e8c529976fc3a8074e77a9481bb59b41f124d93810027bf3d689c6f506e5d90
MD5 4dae3a5f7bd36df9450f91ab0b74dd0f
SHA1 4d37ba187fcf34b6f56e510072ed2193e334e48a
SHA512 98d04b4d9a8f74877d9be3800a00f8bb891200875b98ff94df38fc91c7a25d6c967811855e29b2f3d1e1ec76acd0420efa973e12139b36f7fc710ca9677290c5
SSDEEP 3072:n+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:n+59tBBLkQa3lLNngoqRttA7c
TLSH
T1BB34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifaysqk.exe

Path C:\Temp\vqnifaysqk.exe
Size 243KB
SHA256 8359d3c24f5aa55d68557653db8cac6f0d1e1abe4a3a159459116379918adbeb
MD5 7ea642c2e59fc12e8ac21fb76c665b37
SHA1 a25d1357db2dc023ec7ef25647262d45490451ef
SHA512 6388892ca4ee39e70da8dcf62af8c050041b89edbb02041732e25a7109c43166deac632b1279aa56416a63d2156a8f4890c6b6f8f5ea3cd6aaee267fbe4432c7
SSDEEP 3072:2+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:2+59tBBLkQa3lLNngoqRttA7X
TLSH
T12334490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxsp.sys

Path C:\Temp\xupnhfzxsp.sys
Size 141KB
SHA256 042b92c04a4b56cf496092cef0a9ea4d27867f2b15e94c58e7b554a9087f58ae
MD5 61aa98f8d313db091667ccacbf832b89
SHA1 10294b36fabba3b494fe07a9f016aad6d76dfbed
SHA512 5399d1451e877358349a654c8b53210da0c39203c1fba25421c4d8e2fa8be9126b961b1359a422826fe13fee03b4bcb3e0525166ae0c6f7fe2a07b0d3cf3f39c
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 fdea4fbcb9e71205600a719787fb7e324190c7a5e81a7c44682fafe6c0279ea7
MD5 7a163e385a4cf787aeb711c0f189294a
SHA1 da1a53027c836e698e639b0ecb08e48580a7a118
SHA512 e5764c1dcba811e9456fcea24926076a221b0e71a719e723c0cb2465ff71afc48fde2542a4f1858694eae9d1c0f68cf204411591a685d8aa4cb679b0143b6daa
TLSH
T1E7E0C03411F6425FE0F4E4348BDA7431D469F0221418E6B429C45B04A703A40AC03925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1540-125-0x0000000000A30000-0x0000000000A6D000-memory.dmp

Download

memory/1656-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1744-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2288-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2288-87-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2856-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3100-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3120-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3632-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4008-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4008-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4072-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4228-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads