e5263cca2a15e2b36bd021f441679abcbae7cb80a975699173ba36c46e9546e1

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe
Size 243KB
Sample261006-whka4set2m
SHA256 e5263cca2a15e2b36bd021f441679abcbae7cb80a975699173ba36c46e9546e1
MD5 a5003098bd431eb1547084b3a625e3f3
SHA1 043a15415b6d1dd49ec2f281d2690900eb95c550
SHA512 eed9f7bb482062fd88750d327ab3646c41c279655b185fef4ea028a99e849a7f420c652e9fccab7c3f594cf3cd54199f58432056e2b979eb075f09aaa4c6c107
SSDEEP 3072:9+Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Dc:9+b3TfLAUa3lLNngoqRttA7Dc
TLSH
T10734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3200	CP.exe
3320	trljdbwqlj.exe
2532	CP.exe
4120	CP.exe
4396	i_trljdbwqlj.exe
4432	nlgdyvqoig.sys
1888	CP.exe
3300	davtnlfdyv.exe
1256	CP.exe
2716	CP.exe
4152	i_davtnlfdyv.exe
2316	idyvqoigay.sys
3880	CP.exe
4696	qkicavsnlf.exe
3292	CP.exe
3800	CP.exe
520	i_qkicavsnlf.exe
3680	qkicavsnkf.sys
4968	CP.exe
2564	fdxvpnhfax.exe
3220	CP.exe
3332	CP.exe
1856	i_fdxvpnhfax.exe
3380	fzxspkicau.sys
2316	CP.exe
4692	vpnhfzxspk.exe
556	CP.exe
3476	CP.exe
4292	i_vpnhfzxspk.exe
3160	upmhezxrpj.sys
1856	CP.exe
5040	mhfzxrpjhc.exe
3380	CP.exe
1100	CP.exe
1880	i_mhfzxrpjhc.exe
1972	hezxrpjhbz.sys
1196	CP.exe
2396	ztrmjezwrp.exe
564	CP.exe
4980	CP.exe
3528	i_ztrmjezwrp.exe
688	ezwrpjhbzt.sys
216	CP.exe
1176	ljebwtomge.exe
3232	CP.exe
204	CP.exe
1392	i_ljebwtomge.exe
1832	qoigbytrlj.sys
4144	CP.exe
1704	jgbztrljdb.exe
3816	CP.exe
384	CP.exe
2156	i_jgbztrljdb.exe
4880	oigbytqljd.sys
1600	CP.exe
1428	dbvtnlgdyw.exe
2068	CP.exe
2388	CP.exe
716	i_dbvtnlgdyw.exe
1832	aysqkidavs.sys
1524	CP.exe
2632	sqlidavtnl.exe
552	CP.exe
4628	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlfdy.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1376	ipconfig.exe
4396	ipconfig.exe
3680	ipconfig.exe
3080	ipconfig.exe
2064	ipconfig.exe
3792	ipconfig.exe
1360	ipconfig.exe
4540	ipconfig.exe
1232	ipconfig.exe
3564	ipconfig.exe
784	ipconfig.exe
2468	ipconfig.exe
4628	ipconfig.exe
2720	ipconfig.exe
1192	ipconfig.exe
720	ipconfig.exe
4316	ipconfig.exe
1428	ipconfig.exe
900	ipconfig.exe
1060	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000471a8d2fb303cba68bfa38bc237a63cec2a97e4ca5e44480b3335c63d8508daa000000000e8000000002000020000000df0f877188390ac13832b751092781f59cfad328732f808399627938631748a52000000000073e092646209e2a4628031f51d45bb47505a83a2ad13c2f555d783300f2cb400000002a84041367eee34e35302d43747ec78bb4b31ed7af35799cc3edfbfe6dd50784a701529ba90d4842898c65ebfce5da516be7f683471d21f15e9c2d886880f901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3970700708"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000002e24e9f7411e254c1128a75cd752c71155aea4531b64f2e68c524936f0477a2a000000000e8000000002000020000000f9784be0ed47e81c2cfe709cb83f9b9d19eff807f3978944e585b20d469d82762000000024496a51d3b4185516c82431fcec4bc07c01e66e33bfe8a9be96262d17554a1340000000f013453a11a4cc353e85de2baf317f6edeb28550c80039b529575d5766e9cead5d1be7603fc474b1543b7afa96775dc94815a42139b961aa83ef11f831d24e53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282619"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3968044444"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282619"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498074293"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503cc159c455dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f7c559c455dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{178AF57B-C1AF-11F1-895E-46FEC571B403} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	i_trljdbwqlj.exe
Token: SeDebugPrivilege	4152	i_davtnlfdyv.exe
Token: SeDebugPrivilege	520	i_qkicavsnlf.exe
Token: SeDebugPrivilege	1856	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	4292	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	1880	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	3528	i_ztrmjezwrp.exe
Token: SeDebugPrivilege	1392	i_ljebwtomge.exe
Token: SeDebugPrivilege	2156	i_jgbztrljdb.exe
Token: SeDebugPrivilege	716	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	2168	i_sqlidavtnl.exe
Token: SeDebugPrivilege	4276	i_kicavsnkfd.exe
Token: SeDebugPrivilege	3124	i_qkicausnkf.exe
Token: SeDebugPrivilege	1208	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	2868	i_ezwrpjhbzu.exe
Token: SeDebugPrivilege	1592	i_wuomgeywro.exe
Token: SeDebugPrivilege	3868	i_ztomgeywqo.exe
Token: SeDebugPrivilege	2260	i_qljdbvtolg.exe
Token: SeDebugPrivilege	4624	i_idbvtnlfdy.exe
Token: SeDebugPrivilege	2232	i_xvpnifaysq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4168	iexplore.exe
4168	iexplore.exe
4684	IEXPLORE.EXE
4684	IEXPLORE.EXE
4684	IEXPLORE.EXE
4684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4168	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	86
PID 4168 wrote to memory of 4684	4168	iexplore.exe	87
PID 3580 wrote to memory of 3200	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	92
PID 3320 wrote to memory of 2532	3320	trljdbwqlj.exe	95
PID 3580 wrote to memory of 4120	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	102
PID 3580 wrote to memory of 1888	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	109
PID 3300 wrote to memory of 1256	3300	davtnlfdyv.exe	111
PID 3580 wrote to memory of 2716	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	114
PID 3580 wrote to memory of 3880	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	118
PID 4696 wrote to memory of 3292	4696	qkicavsnlf.exe	120
PID 3580 wrote to memory of 3800	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	123
PID 3580 wrote to memory of 4968	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	127
PID 2564 wrote to memory of 3220	2564	fdxvpnhfax.exe	129
PID 3580 wrote to memory of 3332	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	132
PID 3580 wrote to memory of 2316	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	139
PID 4692 wrote to memory of 556	4692	vpnhfzxspk.exe	141
PID 3580 wrote to memory of 3476	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	149
PID 3580 wrote to memory of 1856	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	153
PID 5040 wrote to memory of 3380	5040	mhfzxrpjhc.exe	155
PID 3580 wrote to memory of 1100	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	158
PID 3580 wrote to memory of 1196	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	162
PID 2396 wrote to memory of 564	2396	ztrmjezwrp.exe	164
PID 3580 wrote to memory of 4980	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	167
PID 3580 wrote to memory of 216	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	171
PID 1176 wrote to memory of 3232	1176	ljebwtomge.exe	173
PID 3580 wrote to memory of 204	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	176
PID 3580 wrote to memory of 4144	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	180
PID 1704 wrote to memory of 3816	1704	jgbztrljdb.exe	182
PID 3580 wrote to memory of 384	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	185
PID 3580 wrote to memory of 1600	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	189
PID 1428 wrote to memory of 2068	1428	dbvtnlgdyw.exe	191
PID 3580 wrote to memory of 2388	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	196
PID 3580 wrote to memory of 1524	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	200
PID 2632 wrote to memory of 552	2632	sqlidavtnl.exe	202
PID 3580 wrote to memory of 4628	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	205
PID 3580 wrote to memory of 4876	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	209
PID 3988 wrote to memory of 2668	3988	kicavsnkfd.exe	211
PID 3580 wrote to memory of 2768	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	214
PID 3580 wrote to memory of 416	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	218
PID 2180 wrote to memory of 4328	2180	qkicausnkf.exe	220
PID 3580 wrote to memory of 1996	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	223
PID 3580 wrote to memory of 3088	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	227
PID 4344 wrote to memory of 4984	4344	hfzxrpjhcz.exe	229
PID 3580 wrote to memory of 3484	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	232
PID 3580 wrote to memory of 4496	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	237
PID 1500 wrote to memory of 1708	1500	ezwrpjhbzu.exe	239
PID 3580 wrote to memory of 1444	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	242
PID 3580 wrote to memory of 4440	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	246
PID 4064 wrote to memory of 1848	4064	wuomgeywro.exe	248
PID 3580 wrote to memory of 2756	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	251
PID 3580 wrote to memory of 4220	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	255
PID 1724 wrote to memory of 1408	1724	ztomgeywqo.exe	257
PID 3580 wrote to memory of 4712	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	260
PID 3580 wrote to memory of 2744	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	264
PID 688 wrote to memory of 4056	688	qljdbvtolg.exe	266
PID 3580 wrote to memory of 3612	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	269
PID 3580 wrote to memory of 3848	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	273
PID 1552 wrote to memory of 1752	1552	idbvtnlfdy.exe	275
PID 3580 wrote to memory of 3884	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	278
PID 3580 wrote to memory of 1732	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	282
PID 4036 wrote to memory of 5084	4036	xvpnifaysq.exe	284
PID 3580 wrote to memory of 2788	3580	2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5003098bd431eb1547084b3a625e3f3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4168 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3200
- - C:\Temp\trljdbwqlj.exe
    C:\Temp\trljdbwqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4120
- - C:\Temp\i_trljdbwqlj.exe
    C:\Temp\i_trljdbwqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1888
- - C:\Temp\davtnlfdyv.exe
    C:\Temp\davtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2716
- - C:\Temp\i_davtnlfdyv.exe
    C:\Temp\i_davtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\qkicavsnlf.exe
    C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3800
- - C:\Temp\i_qkicavsnlf.exe
    C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4968
- - C:\Temp\fdxvpnhfax.exe
    C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3332
- - C:\Temp\i_fdxvpnhfax.exe
    C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2316
- - C:\Temp\vpnhfzxspk.exe
    C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\i_vpnhfzxspk.exe
    C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1196
- - C:\Temp\ztrmjezwrp.exe
    C:\Temp\ztrmjezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4980
- - C:\Temp\i_ztrmjezwrp.exe
    C:\Temp\i_ztrmjezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:216
- - C:\Temp\ljebwtomge.exe
    C:\Temp\ljebwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\i_ljebwtomge.exe
    C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Temp\jgbztrljdb.exe
    C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:384
- - C:\Temp\i_jgbztrljdb.exe
    C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlgdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1600
- - C:\Temp\dbvtnlgdyw.exe
    C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\i_dbvtnlgdyw.exe
    C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\sqlidavtnl.exe
    C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Temp\i_sqlidavtnl.exe
    C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnkfd.exe ups_run
  2⤵
  PID:4876
- - C:\Temp\kicavsnkfd.exe
    C:\Temp\kicavsnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnkfd.exe ups_ins
  2⤵
  PID:2768
- - C:\Temp\i_kicavsnkfd.exe
    C:\Temp\i_kicavsnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:416
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:1996
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  PID:3088
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  PID:3484
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzu.exe ups_run
  2⤵
  PID:4496
- - C:\Temp\ezwrpjhbzu.exe
    C:\Temp\ezwrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins
  2⤵
  PID:1444
- - C:\Temp\i_ezwrpjhbzu.exe
    C:\Temp\i_ezwrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  PID:4440
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  PID:2756
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztomgeywqo.exe ups_run
  2⤵
  PID:4220
- - C:\Temp\ztomgeywqo.exe
    C:\Temp\ztomgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztomgeywqo.exe ups_ins
  2⤵
  PID:4712
- - C:\Temp\i_ztomgeywqo.exe
    C:\Temp\i_ztomgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtolg.exe ups_run
  2⤵
  PID:2744
- - C:\Temp\qljdbvtolg.exe
    C:\Temp\qljdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtolg.exe ups_ins
  2⤵
  PID:3612
- - C:\Temp\i_qljdbvtolg.exe
    C:\Temp\i_qljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run
  2⤵
  PID:3848
- - C:\Temp\idbvtnlfdy.exe
    C:\Temp\idbvtnlfdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins
  2⤵
  PID:3884
- - C:\Temp\i_idbvtnlfdy.exe
    C:\Temp\i_idbvtnlfdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run
  2⤵
  PID:1732
- - C:\Temp\xvpnifaysq.exe
    C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins
  2⤵
  PID:2788
- - C:\Temp\i_xvpnifaysq.exe
    C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2232

C:\Temp\nlgdyvqoig.sys
C:\Temp\nlgdyvqoig.sys
1⤵
- Executes dropped EXE
PID:4432

C:\Temp\idyvqoigay.sys
C:\Temp\idyvqoigay.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\fzxspkicau.sys
C:\Temp\fzxspkicau.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\upmhezxrpj.sys
C:\Temp\upmhezxrpj.sys
1⤵
- Executes dropped EXE
PID:3160

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:1972

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:688

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:1832

C:\Temp\oigbytqljd.sys
C:\Temp\oigbytqljd.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:1832

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
PID:1236

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:3844

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
PID:4712

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:900

C:\Temp\ojhbzurmke.sys
C:\Temp\ojhbzurmke.sys
1⤵
PID:5020

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:768

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
PID:4452

C:\Temp\ykidavtnlf.sys
C:\Temp\ykidavtnlf.sys
1⤵
PID:3384

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdyv.exe

Path C:\Temp\davtnlfdyv.exe
Size 243KB
SHA256 a6e954f9f5c03133039e258470ec1a49894f35b5dda18db55665901ca03af92d
MD5 da1b3c1f4827d56e77ab9287ed3b0932
SHA1 dafaec11fb5153e0923d4bad2d555821b4395a3a
SHA512 bec4f520ba14c5c1d5c0e5c52bfcfb09a0353dca232d4e0eb6cfff566a7af13d3068814615dbf0d0097cad96d037127526807087ff9d39aa776d4dd9ff6d46b1
SSDEEP 3072:9Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:nb3TfLAUa3lLNngoqRttA79
TLSH
T1F834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.sys

Path C:\Temp\ezwrpjhbzt.sys
Size 141KB
SHA256 3a8b83da24af48df4182a403954d3d898c038e7cc4e148696769685e2f367a71
MD5 1a2ad9f78aeb64dd5a34eda347eab9ba
SHA1 e5031627a6ac3ad4e55e34f9fb73323ca150628a
SHA512 55416cf4d4128b7a61f56621cfbbbf111e765cb84aaf9910b855257566cf48a1b462627dc3af200525a41fa786740086fcddfc2619efa194668862f2340df345
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.exe

Path C:\Temp\fdxvpnhfax.exe
Size 243KB
SHA256 fc7e521d337aea784a3b8140b4c6ea4c50b460cf930f897a6189500ebf98aed9
MD5 6ee8646f4c86025fe176e3876964171b
SHA1 6c41c99aa3fa3c212f9e746065e983fbd2a2a6cc
SHA512 680e08ab03334901b5c3b3e2e55a3256a26b657ba19bfccc955c40b04eaaa37206ba50c1884b301c1462d332269f10545b517b98dd8d699f203df424650017cb
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:ab3TfLAUa3lLNngoqRttA7y
TLSH
T1A1344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicau.sys

Path C:\Temp\fzxspkicau.sys
Size 141KB
SHA256 4f76362118ff7a19c56f3f8a8c77125b1aabc261537144d4dcbe60a97738b7b6
MD5 6571afab5e66401aa49f57670e53a521
SHA1 822779f681f8b302bfdabebcf36843d50baad0c6
SHA512 2f75751e2790963565a1c547bd8cf683e18fd090172a46008cca5de237f272376a7dbdaae2bf83b740f7aee90b0df1432a402e4c4772e1100eb5b145e54bc511
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.sys

Path C:\Temp\hezxrpjhbz.sys
Size 141KB
SHA256 b727c87b5d18a1a307e36adcab18f9ca3d8cffdd77c086ca272be4fbe5d44728
MD5 8c97b92bbc28bb91cdbb81933b918f2d
SHA1 8ad655ac9f90dd516a083bf422cc3bf4004b7c14
SHA512 44ba84ddca4703143fdb6eb50d32bd52fddf5cf00671d758b557e91367ad985d82af2b51cdd08a751515198fac060aed7d713dbb75288fd27bb30ec53ed16309
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltu:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdyv.exe

Path C:\Temp\i_davtnlfdyv.exe
Size 243KB
SHA256 ab8b033e3672a46ce09d49ed9bc39a405d1a305022b2a7669aa277f8d3d6332a
MD5 19e70d399290562153382240689d5a1e
SHA1 c2de997daa126938b0ea7d53dc85428173dc5925
SHA512 8c9a5b14c0d9e8f89bcc462407efbdc54260086d52d0a4d7116540d664f421b6c7ec60c226bc7a969f77f0f8606297359c45bded892fc94f6422555895deb572
SSDEEP 3072:FBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:Pb3TfLAUa3lLNngoqRttA75
TLSH
T12634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnhfax.exe

Path C:\Temp\i_fdxvpnhfax.exe
Size 243KB
SHA256 af4dfd00a3a0729eb79a8ec4d5c16caa6c06f95485919b0dc2693ac77061c587
MD5 cdd15e6ba8801c17f5c59680c32b007d
SHA1 0045cf869f5a1990dbebe482cc152fdb22c98d95
SHA512 de0be6ae1ebc6ffe9845af1edbb726853b938fb2e6375530b2d66ffab5b401a98e8e9ce38f65a59da097c110e9311e3f41829039beaa52c081bb1f7a1ab2e493
SSDEEP 3072:DBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:1b3TfLAUa3lLNngoqRttA7z
TLSH
T1AD344A0172818071E75A0B74045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhc.exe

Path C:\Temp\i_mhfzxrpjhc.exe
Size 243KB
SHA256 17c9e0b4b1f15e21a7d5651fbf9223b166f48d2786bb4409c5b8fb91c7b4b96a
MD5 7d9074bdecf4f4d78c6ae3dde34f6a39
SHA1 e9f6db16e007e10a72fb3f2fd9822e4c57848d05
SHA512 5f75857fbc51560e5ff9c37dcf9d0f9180aa8458cb93acc5a79e9b6f9c7940c79408eb898bd6514ebb2e96281125295ae293e873309efb73f7c987b8fb591467
SSDEEP 3072:9Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:nb3TfLAUa3lLNngoqRttA7p
TLSH
T1C334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicavsnlf.exe

Path C:\Temp\i_qkicavsnlf.exe
Size 243KB
SHA256 b6522f9b7c537b431e936a569b0c1f0c0adf27adad60ff8d4ab23ae5eeaad703
MD5 4a9f8664ef2d32d87f086db39e09614c
SHA1 dafc8e4b8e1e82bf59e198e6b74039aaa6bff4c1
SHA512 cb7757a64ea5b9642f500d12d2cfebf242255eefe27b7464b6b04a11ecd99c552d2e38411319dee52e63b90dfeee7aa58d1ff2a9b3fa0774e4ffa757c7367921
SSDEEP 3072:JBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:Lb3TfLAUa3lLNngoqRttA7J
TLSH
T19834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwqlj.exe

Path C:\Temp\i_trljdbwqlj.exe
Size 243KB
SHA256 23223ec3b24293599f3916683e3bf347c400b92214e7835b29d82ec2675e9b84
MD5 a36d90a7ab8f99897c618440692473b3
SHA1 670eddec4e75c01eef342dcb220b06a1e1d8c32a
SHA512 ce8fc9a5372cb7c1424546b1a57a597ea23413500a80260e06da74cd424f724fa6b05908aecafa94e63a59f50cfa9fe0d0829bcb3ed96858baf3051d3cf95eaf
SSDEEP 3072:4Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:Ib3TfLAUa3lLNngoqRttA7E
TLSH
T18034490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxspk.exe

Path C:\Temp\i_vpnhfzxspk.exe
Size 243KB
SHA256 773e81b041b9532b766bcd934730a2747fb40a7b33a86c5355f9792703db146a
MD5 66c085da7eadbfea391448c9e275b598
SHA1 885c9a39292d5c6a93fce573ed72a44f01a1e51c
SHA512 a645326517bc64b9b0a844222caa0db1baf9581be4a47b7ea6be54f033cd1383eb181bc0c15e1715dafa2b1849ef019cb60774b541a2efc140b002b94c3cea10
SSDEEP 3072:yBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:qb3TfLAUa3lLNngoqRttA7e
TLSH
T181344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmjezwrp.exe

Path C:\Temp\i_ztrmjezwrp.exe
Size 243KB
SHA256 50e55fd0593b7a7414bd57efedd987919453d08008ebf844740eec4f656972f2
MD5 6a7a307e9eaec33a7e7f0b56a86f31ce
SHA1 b958195eb093a90bb8de7df21311a8a8591d7f44
SHA512 feb9f9e517e3d045cda4541c729fc15c66304f3d0a132ab26f47f7e1b768e82c1c151e8210422205dfb883b69de232fe159da963f6d8fda4fb973bf3aebc0613
SSDEEP 3072:qBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:ib3TfLAUa3lLNngoqRttA7+
TLSH
T13734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idyvqoigay.sys

Path C:\Temp\idyvqoigay.sys
Size 141KB
SHA256 6fdff928dfe3607d607c558fa0b7526b57fa3a63b07771bb89e8ba1e7b4bfe89
MD5 060696efb4339d8cf73101a5a9eb84b6
SHA1 a2795b6a7019db945430703023868dd879dcc071
SHA512 4c8125c4de4021b946f7f8eca40ab13e00f7733be7419c907aaace4a186d6543fd5fa5e91bae58459a0c7f26c3ad5f33bdd8102b5b0c6395313527ce9546a769
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtomge.exe

Path C:\Temp\ljebwtomge.exe
Size 243KB
SHA256 e23b8446ff2bfe37b933e33776a1e85c5a26475abc82966b826befe27041c85e
MD5 1eb6668d9f9d711d6f5f07f344edd3b6
SHA1 44ba6568f49f4b9cadea780b182f1313b08bdb7a
SHA512 c9e5b3a9a65d223fdd30293abe1ce34883851243c4b98bd54e78a198851ff73b8b8d4d72fbecdff1ebe2478358f5f2bfe25ac036524608d2369d266d08330a6d
SSDEEP 3072:sBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:kb3TfLAUa3lLNngoqRttA7g
TLSH
T1CB34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.exe

Path C:\Temp\mhfzxrpjhc.exe
Size 243KB
SHA256 78227bbc21e5727d8f2fcc7a7dbff95dabb40c8baba02e25368dd9daad2f1edd
MD5 f8ddbef7717a96f68b70e33465b9e843
SHA1 6c816a30032da8ab762a60f38414fe546b322eda
SHA512 d317211f9b287d41957b1cc43aa38c19b1657e7e9262362850abfb511a1dde5c1867d0182bcf81e5f78d72138fe3e8bb967e55e10155d2f013c74e35d7295bf9
SSDEEP 3072:2Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:Wb3TfLAUa3lLNngoqRttA7e
TLSH
T13F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoig.sys

Path C:\Temp\nlgdyvqoig.sys
Size 141KB
SHA256 1f4f593c450e3a64da443b7291284debce00c539b4281a982dab56271b889371
MD5 77d2f73fc2539494296b7a3d3179559c
SHA1 453886348896ea72905cffb2991df3e385a6134e
SHA512 204802ef6c0bc432d9b51ee07fd79ca3c4ca0f045ce8f0339431699932fe46468e785f2a14f20d916647c2b8da593fcc93e26f1a880e337948c1713bd5661876
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 141KB
SHA256 9eae646ccdc54c03b398ab24ede4533f63246bb4bf7f33ee3011f59da71233fc
MD5 5c24b520ab31ea75fbdb2551a89aacaf
SHA1 49a881184dc9bc4204cae52734d98b0cfc50b031
SHA512 c6c17ea09ceba54d8807b177967837683a8fa5e483c1da4960913e81a699c68720d4cbc77c351176037ce85579d7d998bf4a6111f2cccd191be7fa049ed72583
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.exe

Path C:\Temp\qkicavsnlf.exe
Size 243KB
SHA256 9c96795aa486ae0b58019b9d695150287f9448c578ee628e86212fb5b52551ce
MD5 8cacfec45f423300d7742141e343a52f
SHA1 91050156db56c860785f97942914f843420a9dd5
SHA512 db4c3f7eecf14aa39a557f24221d233430a911f657eda9d3a9fe89d1775cbc35acd5206eecb36b900791ac78a9a1265ba157a4b21da207c958c8676863890d9c
SSDEEP 3072:MBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Eb3TfLAUa3lLNngoqRttA7s
TLSH
T1BE34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwqlj.exe

Path C:\Temp\trljdbwqlj.exe
Size 243KB
SHA256 162c731acfb02e18448873938257b16e0dc90235094012acb37d39b539306967
MD5 ed551f149d2ce7eb245f6c342788c499
SHA1 7cf3a1e68aac19bf3838bec797995d5e1c61d5a1
SHA512 7cca6497595cb24e318b60d770ce6e4431e8bbb96a81138d43c4c30f7333ae8d793dd2894b3adfc630abdef8ffd4dc7520f516cd3d27941df15466ad5aaf7031
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:Ub3TfLAUa3lLNngoqRttA7Y
TLSH
T10B34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxrpj.sys

Path C:\Temp\upmhezxrpj.sys
Size 141KB
SHA256 108373d55cc8738e6769806b8e57d1ea2b0cbc2d1ccacbd603502f8c997cc89f
MD5 a6f13461d0769217558530b61048f99d
SHA1 51222f7173381de0c4660c0150bb62dbbff15cf0
SHA512 bf4f76ee0a0c71222373cc8f6cfcb17b1d624472b2abb5cf9983d2c924e217bac2dfbaa83db7629c9e767b1e38c113af5c097ba6df0a7056b418d0585b79c712
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxspk.exe

Path C:\Temp\vpnhfzxspk.exe
Size 243KB
SHA256 3e6faae6e4c7ae244d48e89cc2ccc8f7cffd7efd4f45d48eed0b42eec071a94f
MD5 e2d478de4eddd83aefac33cc6d40d72c
SHA1 e3322d32763871c9111a8cf5a839f738488e75f7
SHA512 b95dae717176b66d494a981863a2b21008f66d411f440c2da67d89d96a03b67c5dc5dd3dc6369d838c11c294cd0d800fa314a4123b3d9da8bf68f4683783bf08
SSDEEP 3072:EBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:cb3TfLAUa3lLNngoqRttA7Q
TLSH
T1B434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjezwrp.exe

Path C:\Temp\ztrmjezwrp.exe
Size 243KB
SHA256 89b75653ae253df9925ac10ec8ee0615493d43708c258cfc00e61e9925c12e5c
MD5 0cac89ec5d1f62313be46c5f44494a38
SHA1 efe6c1aa073df448dfe9bcb03e9b57b34fe985f0
SHA512 8108e2e37f283b7f84e10908c8adefcd8c311327c8c61ceeb9907960b2cf2ef0f07e0416a3a5ad79df37f48f109b554e6dab339579e5d8fb60899b52cefaaadf
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:Rb3TfLAUa3lLNngoqRttA7n
TLSH
T18D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 eabe6065f5fd95f5cb608a8659f165e451168e0e8eb424bb8e1face9e8e9bc17
MD5 8b848c0616bf8c2ba6a2d2f04022047b
SHA1 e519b4e5d3f99f8d95029182097eee435b22e388
SHA512 a69b7ffe56840454bdbf8f16b159890cc671c6dfd2834b39171bf0a0314ea4d3a2af4bd2e7a98d74d63a1bbad7ef8e2d486fb695bc69b25733f6196fa301c940
TLSH
T186F0D4619529F972AFC1B8DD01345A553C20B4F76185C12214756C75055237F2E0A03C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 11eca11a423d4b07ea3117a2a99f2279894df68ccd7b041e6d147e85dfbb643e
MD5 17ec385f9e2114c724e0d7409c450dd1
SHA1 a11463eaf7360d2fe467d920a959ec2613b8f71b
SHA512 f827e636998e848d6628f8d70729d539927243bc0c46e59a6a00597366866487f5956c083c021751c0627aa9ebb3045e4cf14405479c4ffc7b0f2ff817f49815
TLSH
T178E0C03411FA411FE0E4D4348FC9752285AAF132142893B52DD4AB08B713A009C02927
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/768-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/900-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1236-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1972-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2316-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3160-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3380-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3524-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3680-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4712-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads