c785d079250f174f7eed840fe0ba0b6b152e093ba6a87308e89e5c4b990b101e

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
Size 243KB
Sample261006-r2laascv5k
SHA256 c785d079250f174f7eed840fe0ba0b6b152e093ba6a87308e89e5c4b990b101e
MD5 28fd7a7511eafe85804c62414fc620f0
SHA1 87c59eab12ed61e92700c5688fd29191c4905569
SHA512 be3be6a5700691c1b550bb76fd774c7042de328361a478ef81922c3c0348ec4026ad9dfc7fd2447f0b9b9fe1b5c5e5ec6ad35c6fc9fecb4f3dfee6b1a0b8d06e
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:d3frLQsa3lLNngoqRttA7T
TLSH
T1D9345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
904	CP.exe
884	faysqkidav.exe
1976	CP.exe
3792	CP.exe
3464	i_faysqkidav.exe
1044	fdxvpnifax.sys
2772	CP.exe
5052	pkfcxupnhf.exe
3704	CP.exe
3076	CP.exe
2012	i_pkfcxupnhf.exe
1880	smkfcxvpnh.sys
1364	CP.exe
4680	ecxupnhfzx.exe
4052	CP.exe
1356	CP.exe
3500	i_ecxupnhfzx.exe
3656	ecxupmhfzx.sys
4328	CP.exe
364	xrpkecwupm.exe
1548	CP.exe
1728	CP.exe
4392	i_xrpkecwupm.exe
1144	uomhezxrpj.sys
2348	CP.exe
5108	jebwuomgez.exe
3800	CP.exe
4444	CP.exe
3476	i_jebwuomgez.exe
5044	rljebwuomg.sys
936	CP.exe
4876	ywqojgboge.exe
4596	CP.exe
556	CP.exe
2088	i_ywqojgboge.exe
3184	jdbwtomgey.sys
1096	CP.exe
4400	ywigbytqlj.exe
1316	CP.exe
4000	CP.exe
3276	i_ywigbytqlj.exe
2868	tqlidbvtnl.sys
1556	CP.exe
1236	lgdywqoiga.exe
3500	CP.exe
4904	CP.exe
3064	i_lgdywqoiga.exe
4436	lfdyvqniga.sys
1980	CP.exe
3196	aysqkidavt.exe
3920	CP.exe
644	CP.exe
872	i_aysqkidavt.exe
3480	nifaqkicau.sys
4008	CP.exe
1724	usnkfcxvpn.exe
876	CP.exe
2900	CP.exe
488	i_usnkfcxvpn.exe
2756	faxspkicau.sys
3828	CP.exe
3064	usmcxupnhc.exe
5092	CP.exe
1324	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmcxupnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgboge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmcxupnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgboge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczusmke.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4204	ipconfig.exe
4888	ipconfig.exe
4804	ipconfig.exe
2236	ipconfig.exe
1492	ipconfig.exe
5072	ipconfig.exe
3512	ipconfig.exe
1200	ipconfig.exe
1752	ipconfig.exe
4932	ipconfig.exe
4608	ipconfig.exe
1144	ipconfig.exe
2012	ipconfig.exe
4928	ipconfig.exe
4788	ipconfig.exe
3692	ipconfig.exe
4296	ipconfig.exe
4324	ipconfig.exe
3692	ipconfig.exe
2252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3587660874"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282592"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a58b39a955dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498062659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d19239a955dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000007c076eb48ceed8b016384109812303ca90485f97f819983bd7efee8dacf3c122000000000e800000000200002000000089f0bfbfc3dfa7c143523dbd4faaab1b90c5938f297eb651ccfb14a181b3074620000000288108f428b636f779155e2f52313626945d472b9634c3d1b983ead8d6756abf40000000ca0e5daa64f472040dcfef68eeb33f86f0717c4b12dbf6d72de32e65f9c8c783c112f7ae62f339dd7b2827a3f049eb2b4c2db93d804d01a53c3a56fdb95354b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{012FD51F-C194-11F1-895E-CAA8D6BDFC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000f6c06564e6fae3e4605fba710614e86ea534fe445ac730071804dcf4aa9ab2f1000000000e800000000200002000000002f3630506ce41a590b02715592f0653c18c7d09e04b9ebbb477d2dd028cd12620000000536b70c33ef1870618da8d6c67a89e6cc8c25a38b9f7ff7658b4d3e2c5a99ded40000000c00778f3fad90500d020116ff0da13953eaff2b7a5985f744d8b9673272ff6450709edf010cc1ac919560a7fa52981c35c4a162e08f4fa24294537865afb3830	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282592"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3593598431"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	i_faysqkidav.exe
Token: SeDebugPrivilege	2012	i_pkfcxupnhf.exe
Token: SeDebugPrivilege	3500	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	4392	i_xrpkecwupm.exe
Token: SeDebugPrivilege	3476	i_jebwuomgez.exe
Token: SeDebugPrivilege	2088	i_ywqojgboge.exe
Token: SeDebugPrivilege	3276	i_ywigbytqlj.exe
Token: SeDebugPrivilege	3064	i_lgdywqoiga.exe
Token: SeDebugPrivilege	872	i_aysqkidavt.exe
Token: SeDebugPrivilege	488	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	4540	i_usmcxupnhc.exe
Token: SeDebugPrivilege	4440	i_kecwupmhfz.exe
Token: SeDebugPrivilege	2024	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	688	i_rljeywrojg.exe
Token: SeDebugPrivilege	4508	i_qoiytqljdb.exe
Token: SeDebugPrivilege	4460	i_gdywqoigay.exe
Token: SeDebugPrivilege	8	i_aysqlidbvt.exe
Token: SeDebugPrivilege	2856	i_vpnifaxsqk.exe
Token: SeDebugPrivilege	2408	i_vpnhfspkhc.exe
Token: SeDebugPrivilege	4780	i_pkhczusmke.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1448	iexplore.exe
1448	iexplore.exe
3316	IEXPLORE.EXE
3316	IEXPLORE.EXE
3316	IEXPLORE.EXE
3316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1448	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	87
PID 1448 wrote to memory of 3316	1448	iexplore.exe	88
PID 4644 wrote to memory of 904	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	92
PID 884 wrote to memory of 1976	884	faysqkidav.exe	95
PID 4644 wrote to memory of 3792	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	102
PID 4644 wrote to memory of 2772	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	107
PID 5052 wrote to memory of 3704	5052	pkfcxupnhf.exe	109
PID 4644 wrote to memory of 3076	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	114
PID 4644 wrote to memory of 1364	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	118
PID 4680 wrote to memory of 4052	4680	ecxupnhfzx.exe	120
PID 4644 wrote to memory of 1356	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	123
PID 4644 wrote to memory of 4328	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	127
PID 364 wrote to memory of 1548	364	xrpkecwupm.exe	129
PID 4644 wrote to memory of 1728	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	132
PID 4644 wrote to memory of 2348	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	138
PID 5108 wrote to memory of 3800	5108	jebwuomgez.exe	140
PID 4644 wrote to memory of 4444	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	143
PID 4644 wrote to memory of 936	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	153
PID 4876 wrote to memory of 4596	4876	ywqojgboge.exe	155
PID 4644 wrote to memory of 556	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	158
PID 4644 wrote to memory of 1096	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	162
PID 4400 wrote to memory of 1316	4400	ywigbytqlj.exe	164
PID 4644 wrote to memory of 4000	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	167
PID 4644 wrote to memory of 1556	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	171
PID 1236 wrote to memory of 3500	1236	lgdywqoiga.exe	173
PID 4644 wrote to memory of 4904	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	176
PID 4644 wrote to memory of 1980	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	180
PID 3196 wrote to memory of 3920	3196	aysqkidavt.exe	182
PID 4644 wrote to memory of 644	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	185
PID 4644 wrote to memory of 4008	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	189
PID 1724 wrote to memory of 876	1724	usnkfcxvpn.exe	191
PID 4644 wrote to memory of 2900	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	194
PID 4644 wrote to memory of 3828	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	200
PID 3064 wrote to memory of 5092	3064	usmcxupnhc.exe	202
PID 4644 wrote to memory of 1324	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	205
PID 4644 wrote to memory of 796	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	209
PID 5000 wrote to memory of 2096	5000	kecwupmhfz.exe	211
PID 4644 wrote to memory of 4692	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	214
PID 4644 wrote to memory of 3296	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	218
PID 3492 wrote to memory of 1564	3492	zwrpjhbztr.exe	220
PID 4644 wrote to memory of 1612	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	223
PID 4644 wrote to memory of 960	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	227
PID 2360 wrote to memory of 5044	2360	rljeywrojg.exe	229
PID 4644 wrote to memory of 4564	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	232
PID 4644 wrote to memory of 4172	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	236
PID 4540 wrote to memory of 4216	4540	qoiytqljdb.exe	238
PID 4644 wrote to memory of 372	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	242
PID 4644 wrote to memory of 2420	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	246
PID 1812 wrote to memory of 4960	1812	gdywqoigay.exe	248
PID 4644 wrote to memory of 3164	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	251
PID 4644 wrote to memory of 2092	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	253
PID 3092 wrote to memory of 2192	3092	aysqlidbvt.exe	255
PID 4644 wrote to memory of 2756	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	258
PID 4644 wrote to memory of 1104	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	262
PID 4804 wrote to memory of 4924	4804	vpnifaxsqk.exe	264
PID 4644 wrote to memory of 4800	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	267
PID 4644 wrote to memory of 4308	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	271
PID 2640 wrote to memory of 1752	2640	vpnhfspkhc.exe	273
PID 4644 wrote to memory of 3380	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	276
PID 4644 wrote to memory of 792	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	280
PID 3424 wrote to memory of 3336	3424	pkhczusmke.exe	282
PID 4644 wrote to memory of 1856	4644	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	285

C:\Users\Admin\AppData\Local\Temp\2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkidav.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:904
- - C:\Temp\faysqkidav.exe
    C:\Temp\faysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\i_faysqkidav.exe
    C:\Temp\i_faysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\pkfcxupnhf.exe
    C:\Temp\pkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3076
- - C:\Temp\i_pkfcxupnhf.exe
    C:\Temp\i_pkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\ecxupnhfzx.exe
    C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\i_ecxupnhfzx.exe
    C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Temp\xrpkecwupm.exe
    C:\Temp\xrpkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1728
- - C:\Temp\i_xrpkecwupm.exe
    C:\Temp\i_xrpkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\jebwuomgez.exe
    C:\Temp\jebwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Temp\i_jebwuomgez.exe
    C:\Temp\i_jebwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgboge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Temp\ywqojgboge.exe
    C:\Temp\ywqojgboge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgboge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:556
- - C:\Temp\i_ywqojgboge.exe
    C:\Temp\i_ywqojgboge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywigbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Temp\ywigbytqlj.exe
    C:\Temp\ywigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywigbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4000
- - C:\Temp\i_ywigbytqlj.exe
    C:\Temp\i_ywigbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1556
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4904
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1980
- - C:\Temp\aysqkidavt.exe
    C:\Temp\aysqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:644
- - C:\Temp\i_aysqkidavt.exe
    C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4008
- - C:\Temp\usnkfcxvpn.exe
    C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2900
- - C:\Temp\i_usnkfcxvpn.exe
    C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmcxupnhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\usmcxupnhc.exe
    C:\Temp\usmcxupnhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmcxupnhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\i_usmcxupnhc.exe
    C:\Temp\i_usmcxupnhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run
  2⤵
  PID:796
- - C:\Temp\kecwupmhfz.exe
    C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins
  2⤵
  PID:4692
- - C:\Temp\i_kecwupmhfz.exe
    C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  PID:3296
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  PID:1612
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljeywrojg.exe ups_run
  2⤵
  PID:960
- - C:\Temp\rljeywrojg.exe
    C:\Temp\rljeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljeywrojg.exe ups_ins
  2⤵
  PID:4564
- - C:\Temp\i_rljeywrojg.exe
    C:\Temp\i_rljeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoiytqljdb.exe ups_run
  2⤵
  PID:4172
- - C:\Temp\qoiytqljdb.exe
    C:\Temp\qoiytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoiytqljdb.exe ups_ins
  2⤵
  PID:372
- - C:\Temp\i_qoiytqljdb.exe
    C:\Temp\i_qoiytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  PID:2420
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  PID:3164
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  PID:2092
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  PID:2756
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaxsqk.exe ups_run
  2⤵
  PID:1104
- - C:\Temp\vpnifaxsqk.exe
    C:\Temp\vpnifaxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaxsqk.exe ups_ins
  2⤵
  PID:4800
- - C:\Temp\i_vpnifaxsqk.exe
    C:\Temp\i_vpnifaxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfspkhc.exe ups_run
  2⤵
  PID:4308
- - C:\Temp\vpnhfspkhc.exe
    C:\Temp\vpnhfspkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfspkhc.exe ups_ins
  2⤵
  PID:3380
- - C:\Temp\i_vpnhfspkhc.exe
    C:\Temp\i_vpnhfspkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhczusmke.exe ups_run
  2⤵
  PID:792
- - C:\Temp\pkhczusmke.exe
    C:\Temp\pkhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhczusmke.exe ups_ins
  2⤵
  PID:1856
- - C:\Temp\i_pkhczusmke.exe
    C:\Temp\i_pkhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
- Executes dropped EXE
PID:1044

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:1880

C:\Temp\ecxupmhfzx.sys
C:\Temp\ecxupmhfzx.sys
1⤵
- Executes dropped EXE
PID:3656

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
- Executes dropped EXE
PID:1144

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
- Executes dropped EXE
PID:5044

C:\Temp\jdbwtomgey.sys
C:\Temp\jdbwtomgey.sys
1⤵
- Executes dropped EXE
PID:3184

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\lfdyvqniga.sys
C:\Temp\lfdyvqniga.sys
1⤵
- Executes dropped EXE
PID:4436

C:\Temp\nifaqkicau.sys
C:\Temp\nifaqkicau.sys
1⤵
- Executes dropped EXE
PID:3480

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
PID:3300

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:1856

C:\Temp\jecwugeywr.sys
C:\Temp\jecwugeywr.sys
1⤵
PID:2868

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
PID:2848

C:\Temp\qljdbvtolg.sys
C:\Temp\qljdbvtolg.sys
1⤵
PID:2028

C:\Temp\kidavtndxv.sys
C:\Temp\kidavtndxv.sys
1⤵
PID:5116

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
PID:4436

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupmhfzx.sys

Path C:\Temp\ecxupmhfzx.sys
Size 141KB
SHA256 e5bb6e0a0c71eeb3d5a05d4cd6e0bce78bcf3d072848e136fb1549b1c3ff39f2
MD5 53698ec5e837e75da7fdd55c2e84bca8
SHA1 d5209bb9944fb093e2d006eeaccb84eae786b2af
SHA512 e2860f6ba7be1ef50b237589291d5eca1bba8642fb99aed2a178023a5de62ffdfaf8ec5690c0e0dc91980259bd84c0eb7437a407053e60137b83637c87225401
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupnhfzx.exe

Path C:\Temp\ecxupnhfzx.exe
Size 243KB
SHA256 1ac6a94af8711e53524c9b61f972ee8b332b0d4b181068961983b1e7a8204495
MD5 5bcbf379d8530cdf412c513b0a60069e
SHA1 12281f285a804f1dd39a71926ed834503ece3b4d
SHA512 062a95689425f64b28812108e6d2e007d0d84a39ea27f12eefc64d7e5692f2ef0e9bd47b2b843513c6a7e419a5be4dbc1ce249775b4c77ea211532113f23605d
SSDEEP 3072:MF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:Y3frLQsa3lLNngoqRttA7c
TLSH
T10B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkidav.exe

Path C:\Temp\faysqkidav.exe
Size 243KB
SHA256 ffa70d17a40686fe26525737a898a54268d4011b7b704ddb7b885673637ff659
MD5 fc23fc07dbf01bdc6977c896ca0ff45d
SHA1 0942743c64ad3dab88e52163439eb568f6bbd674
SHA512 c822ae05b2171df48ccd48c1774cd258b09ed940ac75f8a21f47b26156dd5845da7cc7893869234ee1df2b2701513dcc5c475bbfd3a8aa2b52d7202be7845821
SSDEEP 3072:hF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:j3frLQsa3lLNngoqRttA71
TLSH
T170345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifax.sys

Path C:\Temp\fdxvpnifax.sys
Size 141KB
SHA256 b8ecd687a49c9aed9751acf67c915677c1a8cb7ee611b49025feb816e2a22484
MD5 4b0587e85e2f46212ab053a5ba0f7cb8
SHA1 eb642f585ef1967f24b8ec57babe274e11ce5eda
SHA512 9f8bc96ad34ba24c83c3172f90bf16e12859b5d767f1bebac10f2dee6f3037105e9569e4e06a38d4ebed281c892a26f7365b65d992b66ffa179d2bf7522331f6
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecxupnhfzx.exe

Path C:\Temp\i_ecxupnhfzx.exe
Size 243KB
SHA256 248c9bd4334c12dee5d33fdc92004ec70a3583776f34abfd40b38df0938872e8
MD5 a998e14badf3ba0e70b41c26d97778ec
SHA1 fd4587e911ee1f492acf3c9c54dec2eb6d56b2b9
SHA512 9f7071d93a4ea90335d8c64e03e317046d25ca960f027c062cdd71d156e5c7ed7888c0fba97daef236b612ef1bf9d7c1afe99ffefc7727cd4b8488cda8c98165
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:g3frLQsa3lLNngoqRttA7s
TLSH
T11A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqkidav.exe

Path C:\Temp\i_faysqkidav.exe
Size 243KB
SHA256 9a772aab70ff6b13a6b045c96b3993692641ec8e31fbfe35b2ff7d9cfcd2f400
MD5 b613a32643627afa54ca3f560d9347a2
SHA1 2aeecaba9eb018721f4d0557fdc4f9c079e6cd3a
SHA512 0b44a32f165475acaf01cfd600d54a4cbc080005588d6fa32b4b95b9c60622bc755c330c10d67de38182ad8985afe9ab30435fac8200132edcc301491136d7c5
SSDEEP 3072:YF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:U3frLQsa3lLNngoqRttA70
TLSH
T108345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebwuomgez.exe

Path C:\Temp\i_jebwuomgez.exe
Size 243KB
SHA256 7e8cee29fd1667b954b902c262c712017fc3e3daf4a742c82483be440d933722
MD5 a2161088a38807c8d2d32437225ebebe
SHA1 8b441d3dd0967f8879804d61554aef029881d6f3
SHA512 5a59c7dbd22a0141ad2faea307f3fc1e48ca6581a08a04a1abc7697a1347e953586a19851219c9113456100236612cba4bedf6612f752ba4bc043d7a513e5c30
SSDEEP 3072:FF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:n3frLQsa3lLNngoqRttA7B
TLSH
T1B3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkfcxupnhf.exe

Path C:\Temp\i_pkfcxupnhf.exe
Size 243KB
SHA256 b44d4580327897cbcad9c96b02523fba0f32aa88dc9174ecac089d6a31933dde
MD5 a0fd04998a311e39cb4bf4d5e851398d
SHA1 e8c11823fe2bc82b4f0ea1712b116d4e4a7b8ecb
SHA512 a1d4abcd9c9124305533a920e66fd6d728862df863411248ca6412f044639e825cb352e2d518a6e1d0329bf5c02ea924ed02e860c2bef5f8023914664e4c3943
SSDEEP 3072:gF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:83frLQsa3lLNngoqRttA7I
TLSH
T1AE345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpkecwupm.exe

Path C:\Temp\i_xrpkecwupm.exe
Size 243KB
SHA256 0f4d418734c58266a564841af32f4578ad26a6a749298d16db5bd1b29e8f4561
MD5 1eb2658f79678a46306d8a7012832b81
SHA1 84b6af85105a0e061854df4b690e5c79b2ca706f
SHA512 30fc1098dc8f8c35ba0c82776e40a98fe3a67dab8d3a4f8f1f77c945e18a9b19784d5b50a65a42fcc1beadc9f4eb477f9e9fbbb28ef8cadaa38221d06d8af806
SSDEEP 3072:9F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:/3frLQsa3lLNngoqRttA7l
TLSH
T129345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywigbytqlj.exe

Path C:\Temp\i_ywigbytqlj.exe
Size 243KB
SHA256 a4ef9568ab5f850cdeb2395ce0dd7f2101a09964cdb65833b37f8e5fa82d56a0
MD5 334020e4ce406468f0993d3d02440a6b
SHA1 49987aaff102dcd38ce6b11452471d413d8b2783
SHA512 01470228aca28a7a17087e92e566afe7f67891c477050cc10504e292bc18a07d0ea250cbedb2efdad1ddb87fc8bd62e1c170ff3e1a309a8ee7c9ad0c6e3d38ad
SSDEEP 3072:kF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:w3frLQsa3lLNngoqRttA7s
TLSH
T1F6345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqojgboge.exe

Path C:\Temp\i_ywqojgboge.exe
Size 243KB
SHA256 f12c817213950bebfae12f5955ea6f54a95596b6cea330fa9a69efa6e764365f
MD5 1ee3e1adc79f19a6e9d0d3c0cf558b96
SHA1 3a67349188a9fa7722cbfb52d47680c41da89396
SHA512 c8fb69d29708c5c08122ac0584b5865030a1f9ea2c3732ab1fe6af87101bd1d06398af663b7a0558360a4fa240c9f86ebccd8c31f93ecce56b45e670356d962d
SSDEEP 3072:qF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:63frLQsa3lLNngoqRttA7m
TLSH
T12A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.sys

Path C:\Temp\jdbwtomgey.sys
Size 141KB
SHA256 f6a8ee730f3944c515fb921b9d16943656454bad2aa46b74efc8f839bf99af78
MD5 53c01b4715712ca8f0a247d2effa0c54
SHA1 25086d949a6173f88d25acd664ef8c2486a4ed82
SHA512 daec5b68a01456d4c50480af1646c5d96491092c12a1344a52f50738e9d229ae9ea13c28514364b87c4208ab01d1de6ddd6ba0f15ba2163d21a7d7e6af132851
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgez.exe

Path C:\Temp\jebwuomgez.exe
Size 243KB
SHA256 2da1a7ebf14b7ef00021a9e218a13b937267af1dd40dbbe282843cf956b1d0d0
MD5 c453688f8601b4fecccbc4e422cb3bcd
SHA1 8084276d37723479629e169fc470d4f265d1eea9
SHA512 d57355e93654d0a60bf65b74bbcd57a6c41874b3c531d03808fb3ba66d20b7df82163f6be024de861e8600b1f08e780f39ba0fa5cefb2980006585d45012a43d
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:03frLQsa3lLNngoqRttA7g
TLSH
T159345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.exe

Path C:\Temp\lgdywqoiga.exe
Size 243KB
SHA256 87c5d6f13953291d5d849553d6372b3caa62f16b4d483d1fed8ea9a747753a7d
MD5 8445285230b1a9b5b4fb880cae9b8280
SHA1 8402b36183de09cf985362e6805a5fce5c1228a5
SHA512 8f64c2da33b794afbc71bf9f27bb7a8008d236c6ee6559e2cdc9d61ed29bbef58bf9e6271479313c05a5d6428c4112f106e577c22d1a88befe8b58f8b8adf4c4
SSDEEP 3072:IF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:k3frLQsa3lLNngoqRttA7g
TLSH
T1AC345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkfcxupnhf.exe

Path C:\Temp\pkfcxupnhf.exe
Size 243KB
SHA256 7b3900c47de915fe119cbc215bcc1518bee3304e4209c1ae9d45bfe22035ecda
MD5 914c7d8aa4131dc28883069ec7be0209
SHA1 8e80911737ec3748e7d7021653c5fb6ce6654ae9
SHA512 eb29049489b17e25cf45860fc84e219cd0e8c4c21f1982fcdd354a61de9112941f0b9517fe5d1bc32b20a7fe3b29526b5ed83858252c81c2b5faf919b4ec32ee
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:d3frLQsa3lLNngoqRttA73
TLSH
T15E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.sys

Path C:\Temp\rljebwuomg.sys
Size 141KB
SHA256 4d9bb56ed3a59333e29bed74269fb8ec177cb0d180404be15d30dbc7ffbb6aac
MD5 b7fe61f813838bc2a713526fe2fc2f82
SHA1 0c6921d2ff8506db691aa63fd25c2f7f0cbd1585
SHA512 e330a8f352ac2b907a0c14ee1e4fd940d335bf9a110ee0a0c03e3cdfd40a93c47d03e441f7a0263b7b7bf2be65934a172ac97443a95b612be16b1599fb911260
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.sys

Path C:\Temp\smkfcxvpnh.sys
Size 141KB
SHA256 49209555b8c68dd97dc0b6b0872dc26aac15240bfef3bb631978cd39aeff5019
MD5 50ee2ea1b2c6aac932b6c2af7ac82ecb
SHA1 be054d6882b15c0f252bde68771cb00ab70e8260
SHA512 e3fce85dd25c31f77bcff39ac5271b4cf6cd624b70c4e905d6868db4689c2270a585721fbef47adec36c154d6a433b0590bbf214b2fb5d0a15b84f1b3ee15dfd
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.sys

Path C:\Temp\tqlidbvtnl.sys
Size 141KB
SHA256 2fd28abd15fc619eb71fe85f0de85f139284973f7605b9e2faa2ef47f14940f5
MD5 844f27fd2e1105409a60cec3dc531a7d
SHA1 0b014857f399a749cb1456aebc6f740c7e04c268
SHA512 76eaad4b4f7d8a77ad886ade4750cd7fab8105d478917000ddffec16606d5f896c422805427d0974386d1102b03b2690e5a7f762eab2436ad41b2047dd7c65ba
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T114E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezxrpj.sys

Path C:\Temp\uomhezxrpj.sys
Size 141KB
SHA256 114e15c77fa97fabb9cfa0b1130471f8ea815716bccd704f26ee748eaa3269f7
MD5 fa91f666be05f6b996799c614de996cf
SHA1 79b93006fbb5dfaa7c43e416626658b452b5446a
SHA512 7491f4283118606c256d56fbcfae5e6717ea7fc40d9f603c886cabc3ac5d87f76e01ae4c865d096729bfc0416f6fe908f8b432f09b6a867ccffaf16b509c1688
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13EE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkecwupm.exe

Path C:\Temp\xrpkecwupm.exe
Size 243KB
SHA256 9e8f628afc4ae1cda30f91993f34e666d19e479c2f60613416de2a13004d6c01
MD5 c37ba2063e21fe432aa2493c45a98214
SHA1 185cdb34550810cfa0e58ad4f63fee52a1766f1f
SHA512 7942ea03da4e04a1fc71b1d8eab702eb12d6c4ba2f25cac4ab212832c02ed2e451c864b8107c090d1a890ae295fdb010f8e601353bdc9562831cdc29189c2f54
SSDEEP 3072:vF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:t3frLQsa3lLNngoqRttA7n
TLSH
T17B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywigbytqlj.exe

Path C:\Temp\ywigbytqlj.exe
Size 243KB
SHA256 13a6aaf07df7e1522f4a23b2628cc9af9d144a4257fd2dad9d95f7fa54a93705
MD5 41e0fbf86f51cbb76bfd2d34c0b32f75
SHA1 548df9123c07a000179510bbeb134108f365ca2e
SHA512 411403a330fefaddbf234bc94638561b4c7f0fe97f3db114d142cae34a434a93ac6eb606438b05073469ba0f798a74be142af49e3f177adbfda54472f2e95753
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:Q3frLQsa3lLNngoqRttA7A
TLSH
T1D4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgboge.exe

Path C:\Temp\ywqojgboge.exe
Size 243KB
SHA256 7a11f77d26b4eebef4076c99c2c1f2e96e4c53679b084670a422c76f52a1c2e2
MD5 1081b7b839d75ec17c759877ee716abc
SHA1 74b6ef9596eda12b37394040d70d1dd9e95b4936
SHA512 e74917642ad70b92aa5bf4be1b2fd6d5cad9833b24c0b6cdaa5c621969fbf729e8bb1fbcf28c47770d2d2424d0b8a3c50273b8f28889fefa312af59007f0d9d9
SSDEEP 3072:6F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:q3frLQsa3lLNngoqRttA76
TLSH
T1E1345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 eabe6065f5fd95f5cb608a8659f165e451168e0e8eb424bb8e1face9e8e9bc17
MD5 8b848c0616bf8c2ba6a2d2f04022047b
SHA1 e519b4e5d3f99f8d95029182097eee435b22e388
SHA512 a69b7ffe56840454bdbf8f16b159890cc671c6dfd2834b39171bf0a0314ea4d3a2af4bd2e7a98d74d63a1bbad7ef8e2d486fb695bc69b25733f6196fa301c940
TLSH
T186F0D4619529F972AFC1B8DD01345A553C20B4F76185C12214756C75055237F2E0A03C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 38717e098d370b5aff17a09e03f2f8c8416d06ff1a5897100017566730d6ef7c
MD5 34d5724fadeb142ae4fda91bc9f2adf5
SHA1 f0ca26969554839ff6b78e49f747e885c621733c
SHA512 04cb98c343939aec0152d27299550b5939fcc9e1b2f1e8ff5260ba1a48a0f056fa38d815a6c0719e64f899bdc5ccaa59d373628ca96dc5637e7e6cccd74b267f
TLSH
T193E0C02411FA411FE0F4D4358FC9792259A9F122152893B42DC4DB08B713A00AC02926
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1144-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1856-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1880-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2028-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2848-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3184-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3480-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3656-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4828-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5044-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads