766761845595e63a519f87f491aa8eea8d2acbeb77d98cab89fcc5c91c3ef256

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe
Size 243KB
Sample261014-vn28faws2m
SHA256 766761845595e63a519f87f491aa8eea8d2acbeb77d98cab89fcc5c91c3ef256
MD5 8c40ec7b568bbfaf7de46cd02896fe18
SHA1 904ecbb340d679f90d06082d1991b0c010105733
SHA512 b3c739aab21b0eee28f38317cff8818262810c5e544181f8df08da15247feedb537bf090c8e6c0ee3eae646f090428a2466d530628a29511ccfa8cefdda47243
SSDEEP 3072:vF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:t3frLQsa3lLNngoqRttA7b
TLSH
T1B8345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4000	CP.exe
220	pnifaysqkf.exe
4056	CP.exe
624	CP.exe
1496	i_pnifaysqkf.exe
2304	lfdxvpnifa.sys
1168	CP.exe
2836	nkfcxvpnfd.exe
4240	CP.exe
3616	CP.exe
4396	i_nkfcxvpnfd.exe
1268	xspkicausm.sys
948	CP.exe
3836	mkfcxupnhf.exe
4584	CP.exe
2532	CP.exe
2472	i_mkfcxupnhf.exe
4020	hfzxrpjhcz.sys
4732	CP.exe
1548	zurmkecwuo.exe
3024	CP.exe
2848	CP.exe
3796	i_zurmkecwuo.exe
3764	wuomhezwrp.sys
4960	CP.exe
4348	pjhbwuomge.exe
1392	CP.exe
2984	CP.exe
2928	i_pjhbwuomge.exe
2860	trljebwuom.sys
4356	CP.exe
4220	ebwuomgeyw.exe
812	CP.exe
3440	CP.exe
620	i_ebwuomgeyw.exe
2124	gbytrljdbv.sys
3708	CP.exe
2520	vtolgdywqo.exe
5112	CP.exe
2988	CP.exe
1816	i_vtolgdywqo.exe
3988	ytqlidbvtn.sys
4704	CP.exe
3116	nlfdyvqoig.exe
3356	CP.exe
1696	CP.exe
1240	i_nlfdyvqoig.exe
3748	nlfdyvqnig.sys
5012	CP.exe
2372	gaysqkidxv.exe
1700	CP.exe
5004	CP.exe
2000	i_gaysqkidxv.exe
912	qnifaysqki.sys
3472	CP.exe
3936	ausnkfdxvp.exe
3796	CP.exe
3052	CP.exe
1900	i_ausnkfdxvp.exe
4924	icausmkfcx.sys
68	CP.exe
3564	xupnhfzxsp.exe
5092	CP.exe
4352	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidxv.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3220	ipconfig.exe
4740	ipconfig.exe
3484	ipconfig.exe
696	ipconfig.exe
4768	ipconfig.exe
4776	ipconfig.exe
4384	ipconfig.exe
1920	ipconfig.exe
3272	ipconfig.exe
3988	ipconfig.exe
1552	ipconfig.exe
1172	ipconfig.exe
1800	ipconfig.exe
1264	ipconfig.exe
2276	ipconfig.exe
4452	ipconfig.exe
1404	ipconfig.exe
4392	ipconfig.exe
3036	ipconfig.exe
2728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284222"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3356982874"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000007d9a43d9ad5ceff9b09c71746e2c6bc8bf6cffd03325fa3d104c14274eb55980000000000e800000000200002000000038d0590acfa6016a5e638b7d5253b38f0f41041d172a7372057c8239031c1a2020000000990873f47c7007173e68c33fa0c83d3ce1596ee481cef8d8793014c0f21d9c7940000000140aa164af8af6a52668777566eb4ed0b9b280899b7400441b64b8be4d8dc1c742c1840025db5909a9b9f93d1f15331d65e1ce574b5dcca8b42eb6383147ad00	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d22c2a075cdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cd252a075cdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498762715"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3349170605"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000e55c2a63fb35d8a49c78303eccadc4fc873f8b6009fe3607a09aba219004972b000000000e80000000020000200000001a9523ad787919ac345fb330c013cb1ac0af4989f6dbfc38515b7ed006b348d42000000091cb698229bf39bb71b615b7784ab87f7fdef47065188e4e083110189ef1c5e140000000957e98dcc224df81d74b71b3b5ea3274bdedb84f5039728effde3095c813482c8fbeed513bef26fb9b9b378f79a035cb5d0ad0f10dcd2f160ea9d8eca7fdc1dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F30A90CB-C7F1-11F1-8F8C-62BF8547FD78} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284222"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	i_pnifaysqkf.exe
Token: SeDebugPrivilege	4396	i_nkfcxvpnfd.exe
Token: SeDebugPrivilege	2472	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	3796	i_zurmkecwuo.exe
Token: SeDebugPrivilege	2928	i_pjhbwuomge.exe
Token: SeDebugPrivilege	620	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	1816	i_vtolgdywqo.exe
Token: SeDebugPrivilege	1240	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	2000	i_gaysqkidxv.exe
Token: SeDebugPrivilege	1900	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	4412	i_xupnhfzxsp.exe
Token: SeDebugPrivilege	3272	i_nhfzxsmkec.exe
Token: SeDebugPrivilege	4984	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	1784	i_ezwrojhbzt.exe
Token: SeDebugPrivilege	1920	i_geywrojhbz.exe
Token: SeDebugPrivilege	3928	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	2896	i_nigaysqlid.exe
Token: SeDebugPrivilege	3152	i_icavsnkfdx.exe
Token: SeDebugPrivilege	912	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	3928	i_causmkecxr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4844	iexplore.exe
4844	iexplore.exe
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 4844	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	85
PID 4844 wrote to memory of 904	4844	iexplore.exe	86
PID 1872 wrote to memory of 4000	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	90
PID 220 wrote to memory of 4056	220	pnifaysqkf.exe	93
PID 1872 wrote to memory of 624	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	101
PID 1872 wrote to memory of 1168	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	112
PID 2836 wrote to memory of 4240	2836	nkfcxvpnfd.exe	114
PID 1872 wrote to memory of 3616	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	117
PID 1872 wrote to memory of 948	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	121
PID 3836 wrote to memory of 4584	3836	mkfcxupnhf.exe	123
PID 1872 wrote to memory of 2532	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	126
PID 1872 wrote to memory of 4732	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	130
PID 1548 wrote to memory of 3024	1548	zurmkecwuo.exe	132
PID 1872 wrote to memory of 2848	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	135
PID 1872 wrote to memory of 4960	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	141
PID 4348 wrote to memory of 1392	4348	pjhbwuomge.exe	143
PID 1872 wrote to memory of 2984	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	146
PID 1872 wrote to memory of 4356	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	151
PID 4220 wrote to memory of 812	4220	ebwuomgeyw.exe	153
PID 1872 wrote to memory of 3440	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	156
PID 1872 wrote to memory of 3708	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	160
PID 2520 wrote to memory of 5112	2520	vtolgdywqo.exe	162
PID 1872 wrote to memory of 2988	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	165
PID 1872 wrote to memory of 4704	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	169
PID 3116 wrote to memory of 3356	3116	nlfdyvqoig.exe	171
PID 1872 wrote to memory of 1696	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	174
PID 1872 wrote to memory of 5012	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	178
PID 2372 wrote to memory of 1700	2372	gaysqkidxv.exe	180
PID 1872 wrote to memory of 5004	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	183
PID 1872 wrote to memory of 3472	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	187
PID 3936 wrote to memory of 3796	3936	ausnkfdxvp.exe	189
PID 1872 wrote to memory of 3052	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	192
PID 1872 wrote to memory of 68	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	198
PID 3564 wrote to memory of 5092	3564	xupnhfzxsp.exe	200
PID 1872 wrote to memory of 4352	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	203
PID 1872 wrote to memory of 1720	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	207
PID 3824 wrote to memory of 5024	3824	nhfzxsmkec.exe	209
PID 1872 wrote to memory of 640	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	212
PID 1872 wrote to memory of 920	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	216
PID 4384 wrote to memory of 1196	4384	hezxrpjhbz.exe	218
PID 1872 wrote to memory of 3776	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	221
PID 1872 wrote to memory of 416	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	225
PID 3648 wrote to memory of 412	3648	ezwrojhbzt.exe	227
PID 1872 wrote to memory of 4620	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	230
PID 1872 wrote to memory of 1728	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	234
PID 4744 wrote to memory of 4412	4744	geywrojhbz.exe	236
PID 1872 wrote to memory of 1708	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	240
PID 1872 wrote to memory of 988	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	244
PID 4048 wrote to memory of 3184	4048	tnlgdyvqoi.exe	246
PID 1872 wrote to memory of 4928	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	249
PID 1872 wrote to memory of 3056	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	253
PID 1000 wrote to memory of 3416	1000	nigaysqlid.exe	255
PID 1872 wrote to memory of 1780	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	258
PID 1872 wrote to memory of 2920	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	262
PID 1240 wrote to memory of 2428	1240	icavsnkfdx.exe	264
PID 1872 wrote to memory of 212	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	267
PID 1872 wrote to memory of 1964	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	271
PID 3844 wrote to memory of 2784	3844	nhfaxsqkic.exe	273
PID 1872 wrote to memory of 2832	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	276
PID 1872 wrote to memory of 2560	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	280
PID 2228 wrote to memory of 5100	2228	causmkecxr.exe	282
PID 1872 wrote to memory of 2276	1872	2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe	285

C:\Users\Admin\AppData\Local\Temp\2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_8c40ec7b568bbfaf7de46cd02896fe18_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4844 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqkf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4000
- - C:\Temp\pnifaysqkf.exe
    C:\Temp\pnifaysqkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:624
- - C:\Temp\i_pnifaysqkf.exe
    C:\Temp\i_pnifaysqkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1168
- - C:\Temp\nkfcxvpnfd.exe
    C:\Temp\nkfcxvpnfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3616
- - C:\Temp\i_nkfcxvpnfd.exe
    C:\Temp\i_nkfcxvpnfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:948
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2532
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\pjhbwuomge.exe
    C:\Temp\pjhbwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Temp\i_pjhbwuomge.exe
    C:\Temp\i_pjhbwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3440
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3708
- - C:\Temp\vtolgdywqo.exe
    C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2988
- - C:\Temp\i_vtolgdywqo.exe
    C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\gaysqkidxv.exe
    C:\Temp\gaysqkidxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5004
- - C:\Temp\i_gaysqkidxv.exe
    C:\Temp\i_gaysqkidxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3052
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:68
- - C:\Temp\xupnhfzxsp.exe
    C:\Temp\xupnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_xupnhfzxsp.exe
    C:\Temp\i_xupnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxsmkec.exe ups_run
  2⤵
  PID:1720
- - C:\Temp\nhfzxsmkec.exe
    C:\Temp\nhfzxsmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxsmkec.exe ups_ins
  2⤵
  PID:640
- - C:\Temp\i_nhfzxsmkec.exe
    C:\Temp\i_nhfzxsmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run
  2⤵
  PID:920
- - C:\Temp\hezxrpjhbz.exe
    C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
  2⤵
  PID:3776
- - C:\Temp\i_hezxrpjhbz.exe
    C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrojhbzt.exe ups_run
  2⤵
  PID:416
- - C:\Temp\ezwrojhbzt.exe
    C:\Temp\ezwrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrojhbzt.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_ezwrojhbzt.exe
    C:\Temp\i_ezwrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run
  2⤵
  PID:1728
- - C:\Temp\geywrojhbz.exe
    C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins
  2⤵
  PID:1708
- - C:\Temp\i_geywrojhbz.exe
    C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  PID:988
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  PID:4928
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqlid.exe ups_run
  2⤵
  PID:3056
- - C:\Temp\nigaysqlid.exe
    C:\Temp\nigaysqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqlid.exe ups_ins
  2⤵
  PID:1780
- - C:\Temp\i_nigaysqlid.exe
    C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnkfdx.exe ups_run
  2⤵
  PID:2920
- - C:\Temp\icavsnkfdx.exe
    C:\Temp\icavsnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnkfdx.exe ups_ins
  2⤵
  PID:212
- - C:\Temp\i_icavsnkfdx.exe
    C:\Temp\i_icavsnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  PID:1964
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxr.exe ups_run
  2⤵
  PID:2560
- - C:\Temp\causmkecxr.exe
    C:\Temp\causmkecxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxr.exe ups_ins
  2⤵
  PID:2276
- - C:\Temp\i_causmkecxr.exe
    C:\Temp\i_causmkecxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:2304

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:1268

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\wuomhezwrp.sys
C:\Temp\wuomhezwrp.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:3988

C:\Temp\nlfdyvqnig.sys
C:\Temp\nlfdyvqnig.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
- Executes dropped EXE
PID:912

C:\Temp\icausmkfcx.sys
C:\Temp\icausmkfcx.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:5088

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
PID:2560

C:\Temp\uomgezwroj.sys
C:\Temp\uomgezwroj.sys
1⤵
PID:1444

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
PID:1240

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
PID:4008

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
PID:3292

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:1804

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
PID:4816

C:\Temp\nhfzxspkhc.sys
C:\Temp\nhfzxspkhc.sys
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.exe

Path C:\Temp\ebwuomgeyw.exe
Size 243KB
SHA256 c72574369e138540ee17bf05ca8621144723d4fc5de5a4da5abd7d0b40d91c45
MD5 654352acb3d05deabc4b0426556facf0
SHA1 8d1c05fc969ae794994bae74cae6756f972cee0d
SHA512 ab855dbb897c3ad8dee8ee43db7435208ae7c82be5a15f448a13964aaa0af8fc266918dcdeaee281ffa5593a2dcb508ee8a8ce2b01b68a2cf0dc5786bbf40c16
SSDEEP 3072:oF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:E3frLQsa3lLNngoqRttA78
TLSH
T140345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 57ce25921029653ede04f734d12dbcb64f8b1f3c186f562774eb29cedebf9b05
MD5 6748ad1fd7d457d237bcf56dcd51eb91
SHA1 2dea46b337ebc22dcce2c0e7ef6a6cd105a443eb
SHA512 94c72e27ada696a96d9d5bdab9637dc9181d5630ea741fca97afb99e4d7025017aba0777b9f2040c96c42974cef337ee6a60ef08a3c6fb185ff3b477da7625b4
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhcz.sys

Path C:\Temp\hfzxrpjhcz.sys
Size 141KB
SHA256 87a454a2a1ba08ef8f37226638859ab50b2e78775cdaf80dfe56cd42a16ddd37
MD5 e0d81b88a2d5fa77a9ffb066ef7778c8
SHA1 50bef8ec2c5b3f8a8799f97e0b3d609a4c7e0efe
SHA512 4188f4d3ba8bf6c9c5f22b6cb6d338c34c896fd481cb34bc91ed20191455462731dfa5512bd624e79f025005819cd3b9c111256c428af5d7ecdcf04d821b9140
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltQ:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwuomgeyw.exe

Path C:\Temp\i_ebwuomgeyw.exe
Size 243KB
SHA256 923b4e18ecc43b837973a978d6844cce84bb97a054c6670495d4b9e63569ca43
MD5 58c23adf16bac8d683d8a30b1c500e39
SHA1 f225a784ac3143eee6c172facba55deb0e5fb52c
SHA512 508512f7ca319dd63f0aa833942db693040a10401a7a624da314ec43e93afeae132e997962242dcd3497115f52d643655c3ae0f0308720e787943721bfeec1fe
SSDEEP 3072:AF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:c3frLQsa3lLNngoqRttA7Q
TLSH
T127345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxupnhf.exe

Path C:\Temp\i_mkfcxupnhf.exe
Size 243KB
SHA256 e022a760ad552cdda06026d16a0628d54f45e406385518a37a2b12c500b46bc8
MD5 fd7a934b2d64cba4b89a0ac81379ddb0
SHA1 71da53d8b56a6d59eee005ae87c7cd258c5feb90
SHA512 fc9b63b91a3df644e2cab4bc3b44265dd0058ccba2454a875792d2ff7c6c9472fabffaa987cf010cb7e4195eec4bda3b4b17849a29260c3f53b9dc3a865b7cfc
SSDEEP 3072:QF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:M3frLQsa3lLNngoqRttA7w
TLSH
T14E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxvpnfd.exe

Path C:\Temp\i_nkfcxvpnfd.exe
Size 243KB
SHA256 b2370083669590bdae2cd0a5bd9b474040e38f9b4d00b37c8bbc8f945790a2ee
MD5 c414a4eebe6ddc09ebbe96cf6fbc25f4
SHA1 d5ef3f5244757f55e43b2a7ab192d05c879f28e1
SHA512 c417ea71bcfa4b465443798db0dedd46e3c5420e603c8bb123dbc722525c19f2fe4c06fcceffe062da0f6df3f6f06da8b1c9687079c77086c0df5f982bbb1cb4
SSDEEP 3072:LF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:J3frLQsa3lLNngoqRttA7/
TLSH
T17E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbwuomge.exe

Path C:\Temp\i_pjhbwuomge.exe
Size 243KB
SHA256 bf5aad80d24d3ecf19fbf5c41c98741c09736fcd86bb157e67f60f7754dac410
MD5 07284201992734adf07f916a25cc409b
SHA1 d759cd39aabf068209145795734f6206e3c076ff
SHA512 ec7a364253bb6c5de9bb6846537b0b94df70b93c2f46745c44d100831e8e031aa5b4e2faf6b26d3fe8de6a9de2ba4fb35f1d9df594770627a2610563a333f7e0
SSDEEP 3072:pF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:L3frLQsa3lLNngoqRttA7d
TLSH
T111345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaysqkf.exe

Path C:\Temp\i_pnifaysqkf.exe
Size 243KB
SHA256 13acc4f010a72ea29af7abc4510fe53f0bf65cab9c74a9960bd452c1874c71eb
MD5 a77db7ed93d2b4f71d01df905d3dafaf
SHA1 f2023e8117d5a46b74a6b6342eeb7e5c82a9dff3
SHA512 ba981f0c5afe6ab382e4cd855258ec40b10eed2a7f8ecd5e1f830602e44994bf51f51a5f8325ea08d886ba1cff0b2ce14d06bcff663efc5f4aca44e2a53ec52d
SSDEEP 3072:zF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:x3frLQsa3lLNngoqRttA7/
TLSH
T1AA345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgdywqo.exe

Path C:\Temp\i_vtolgdywqo.exe
Size 243KB
SHA256 99642317147161665be17974e16f4d7e46d60b9b964cc7cd7240ca2eb83e56df
MD5 2606e2ac67cd98c6340cd5afbc913583
SHA1 0314d944cfb333f0426ea46fb40f234c7a751ec8
SHA512 d4c131e2bc3367be456cede4ca36a027d7a7ed31d5421ecb3ad8d74b39fafaddaafa0b5a5d6941ed26bd01c10e55ca655209a5258c2f9e597f65f317761c6855
SSDEEP 3072:hF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:j3frLQsa3lLNngoqRttA7V
TLSH
T185345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwuo.exe

Path C:\Temp\i_zurmkecwuo.exe
Size 243KB
SHA256 f05fafc3914f07893a5ce86e25b07ebf659366aa84956c5c51110541c8e8bf2d
MD5 2e410db2cbdf2dce7aef3ce1109cbe51
SHA1 b334bb68203b8ee4361b3ba14acdecba05be0c18
SHA512 41506cd0ed8c1f8c1fc5f317d90179adcfd6de65557979e54cec986c493366a8aa961301dc9c942ec9e39d98b17d4cfc469f9c87b7cfe96c4115338202d581dc
SSDEEP 3072:RF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:z3frLQsa3lLNngoqRttA71
TLSH
T108345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.sys

Path C:\Temp\lfdxvpnifa.sys
Size 141KB
SHA256 deb0c2c6d8358e82501f78797ea4588a77b6caecc0613c099c3a3a275010fe58
MD5 047b6634f96846efef8d0811bbebd349
SHA1 7bf35f24f6716c8c218fdf3bb9c520a37ea06227
SHA512 a44601eba5cf95f4a629a95a5f0b07d54b2d6e1d475cca6c2fb9229d280ac678f8c4578595bf71d9f9ba8e9c2fae2105a2e81fe21aecc4036a337ae68a44f6f5
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.exe

Path C:\Temp\mkfcxupnhf.exe
Size 243KB
SHA256 2143b4ee22625f219f140e5e1c2ad3b860179040993a298824ff3708dfef2140
MD5 c1ee41f4aaab04abc479f3a51bf0c2f8
SHA1 1e52cfb8c89ebfce249e2140f35b3eb572c0784f
SHA512 033312054347a32a8c87e1c81c4630e41072dc308fbaac968a9e654d18aafa12353036fd3b96cbe8153c19e5f83cf5fa461c6eaa55e46751d683e13e4f7133da
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:Q3frLQsa3lLNngoqRttA7o
TLSH
T1CC345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnfd.exe

Path C:\Temp\nkfcxvpnfd.exe
Size 243KB
SHA256 d169234d6f50432832195b2394df559b30b869732083063d6933d58f21d281b7
MD5 a9ef6dd8cd3b2b1770617f0116556d7b
SHA1 8c964905d5305a63a6cb3089ea385cad1e3ccda5
SHA512 a9e43a4ae13da90ee1716f133047bf7c698c772aea57abb46cf11b8d365696c9ec044ee84d5ac583dc21b9b3ccbba5381da98780e6f867e2a828cb0dcfdb5d54
SSDEEP 3072:lF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:H3frLQsa3lLNngoqRttA7B
TLSH
T142345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.exe

Path C:\Temp\nlfdyvqoig.exe
Size 243KB
SHA256 c55e3ac90862329441b4583cab21de57ab883bee3bb71fa1fe9cb0ac841c690f
MD5 a102c8f2009342f7df6c6eae45c2673b
SHA1 934df33bc2188c51f37fea4bf6b473344a47ee30
SHA512 f9b316b6cd219b0847d602761b3bccfd2f9b3e5852dc6b5845e802e63227387e1683ce3cc61fb36bcd4ca3453f1e5c0a709a9b4b4240adb3838fe7ebb440c601
SSDEEP 3072:z3F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Ltl:53frLQsa3lLNngoqRttA7LP
TLSH
T1BA345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbwuomge.exe

Path C:\Temp\pjhbwuomge.exe
Size 243KB
SHA256 741ce5d117679ce029e6547c258371508ff14585b3fdeae7d757c2dd3f8024f3
MD5 51d74c4ae252d31ac8fdff8c5665efe5
SHA1 8572a9590ad98fb90bee4859224f8ae4c8995bc1
SHA512 ac3454a6f01a6f76eec37e3a553227f18bca79a8020e3a90df9d4e6700ef4f154193127afdcc67e871e0436ddbfc02cb9b8c0b37d7b4f1b3b23a00d9eeea70bf
SSDEEP 3072:eF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:+3frLQsa3lLNngoqRttA7+
TLSH
T197345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaysqkf.exe

Path C:\Temp\pnifaysqkf.exe
Size 243KB
SHA256 cdc51c66f9c4ca67415ec7d75d42ea37c298a638c348c6c9d863cd569eefa888
MD5 99e9cb9fd607161fe3e310cf03f93c8c
SHA1 08d5ae8b894a0c6eef9b2b2b1461653d1277daf5
SHA512 d880920b624fd279495ced876f405c5f7891c01280a8f610815cdd5b62d75f1a195eb2810d4e88cfed1ea8000235ab42a6cde1148ff19e337eb7b785a1012385
SSDEEP 3072:nF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:F3frLQsa3lLNngoqRttA7P
TLSH
T18B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwuom.sys

Path C:\Temp\trljebwuom.sys
Size 141KB
SHA256 6032bdbdf8ef39f6acaa46b65d967c005720eda5d215dec4054ddb469f581061
MD5 25a63f2ebd7f07499a126484a89868ed
SHA1 c223af9899db7b2e07a9b74b628d45e1909395a9
SHA512 a381e652f6ba2fc7e1c0b9d68f70a1d7745bb7e38d4f2854b6d0f9b55e4ae315fa87c1591a58ed6d28c112f297706b1394d1679607ba089376257cb9f3a11b72
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T138E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgdywqo.exe

Path C:\Temp\vtolgdywqo.exe
Size 243KB
SHA256 46628c81ee7b077aba327359c6c2fd448ac91aa8386097fca4b6c7cdf47577c8
MD5 239329d8a8f5e4cb986e0e645b777143
SHA1 d43262e9f02b3c522faf6e19c0701ac2449b67d1
SHA512 1fbcb63b3282036e00fc38b28ffca6fcb9b454ff2ab533b223c7a27bb55539301f4bc86b0a46ccad66feeb82e1c75b348b58b45ab7f1538d815eb88c83ac776f
SSDEEP 3072:fF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:93frLQsa3lLNngoqRttA7/
TLSH
T1A0345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwrp.sys

Path C:\Temp\wuomhezwrp.sys
Size 141KB
SHA256 273ef22fd519db140fcf00aa7902d282102a3597c915b92f14a37ae9d3a856be
MD5 fb9bfcd3cfde04edcfa6e8fefc6f8183
SHA1 778a3ae2c79cdb1f8050c87f88cfd0ba7f69859d
SHA512 989d2f72443d828615cdcbeac9f68f1c18e1e61422147c018ca75e5b25518a07ecf2a5c8466791708b6b42225f7246576946e17f9cf365ecc1184f26bc7bae7f
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.sys

Path C:\Temp\xspkicausm.sys
Size 141KB
SHA256 ef0e839513e6c89896551b81ae820645fb567141dba51c67f49fd1afec0ab5d8
MD5 faab65e6afe9f1c3b26e8aa4c363eeef
SHA1 814d485beeb75ffef177677b07cec6ac7d5029ec
SHA512 fbe1cd3821942e395c48c28351c35fc9c2fb13d6e102dd6c34346f4593e49cd7a3e669c5e16e9e72e60a9874bca4c18934f90eda1741529783810acfae0a27cf
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidbvtn.sys

Path C:\Temp\ytqlidbvtn.sys
Size 141KB
SHA256 bffdb749275d8eaf45eff3205c59396ad9ed077e755853823eb37002a98dfcbb
MD5 3e818bddfdc0840270ffdc3707c2e682
SHA1 f5b15b226647325875fba311e31ae9b6529a09d3
SHA512 5ffd2dadfe995c2b1a49ed4de09366a4d6a4d40a261e90960b051ba0ddd1957fbddd1983c6a7d97c5a986cb070c789a5fa80b1e1e692663d38c5b4bc8aa03316
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.exe

Path C:\Temp\zurmkecwuo.exe
Size 243KB
SHA256 d797fc8fb078afcfef66f8a68c15c2e29b5543491880924e5a9957298cbc581b
MD5 30074caa4ce233c7d259ccedbe2c3107
SHA1 d42f12c5c4b0d577c383557672d73ed0af7ff68e
SHA512 f694ecc7342afa3110abf2d0421f267ef65e369b3fbc5c7fda0a21f2f5084d103ad7966b1f6a61310b4207809ecf0deef85b2206cd912932fb3da203e8e06e8b
SSDEEP 3072:jF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:B3frLQsa3lLNngoqRttA7j
TLSH
T1FF345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 94deecb8b3c9a16f48b404872478dc3c8c8aad2e5a5013615effcf6d732f7e8b
MD5 f232fd89dc85e8a72a0ec6ae3b4201cf
SHA1 d6bde8e11231e4cc77ccb823bd7217248a8d182a
SHA512 2ef5fe5ca0b58731631d7b0c4c47fb12a531710a8f5568dd149d42dade296c31d637d73881dc352f7fb7ee45d605bf093cb67e469635f96b8d050169d5492ffe
TLSH
T166F0D442415DF0B15E91A4EC225E6D772920F17704D8D501F37D46D444A53EB8F45428
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 1b4cc57500d62f6607959725efd6dcae1c2cc3f1fc2da382a62e0ea496f87951
MD5 452ba1899acaa6ad9bc368e7179a7978
SHA1 c33390d913535cd83262290db1236c8faa127b17
SHA512 6861faf7d3f6703f0ef31d303e29fa3fe57320a07407fe1d7834b9cddb44a474092800516dbdd9118fedfbece2808e32e44caf9aa698eef04833ba96a3bfa818
TLSH
T1CEE0C02411FA421EF1F5EC758FDDB5359859F032041992B82DD56B0CB702640AC02A2D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/912-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1240-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1268-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1444-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1496-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1804-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2560-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2860-74-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3292-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3748-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3764-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3988-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4008-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4020-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads