3d7d273168c259d28db717ea8ec4ae289d5e4ef56ee75e83f6d90829a30b7868

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe
Size 243KB
Sample261017-2bl41set5z
SHA256 3d7d273168c259d28db717ea8ec4ae289d5e4ef56ee75e83f6d90829a30b7868
MD5 1d064b76a2008dd50fbcb8e24e3eb72c
SHA1 708f8bc1c56f116b721dba946d3af88dea646ce0
SHA512 b77fc038a0aa9b7c42765e462184c72e0db6aa27d8cf76afda33a20a56bc1cd896e5ea2ec87ce3e803831c5dffa4040db2d457e28ac39a44a0ca6efd9634c36b
SSDEEP 3072:uBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:Ob3TfLAUa3lLNngoqRttA7K
TLSH
T10F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3420	CP.exe
4116	avsnkfdxsq.exe
2492	CP.exe
3768	CP.exe
2496	i_avsnkfdxsq.exe
3404	avpnhfzxsp.sys
4748	CP.exe
2236	pkicausnkf.exe
3540	CP.exe
5668	CP.exe
5576	i_pkicausnkf.exe
5156	usmkfcxupn.sys
5368	CP.exe
5840	fzxrpjhczu.exe
5072	CP.exe
224	CP.exe
376	i_fzxrpjhczu.exe
3068	jhczusmkec.sys
2696	CP.exe
1664	cwupmhbwuo.exe
1436	CP.exe
3096	CP.exe
4832	i_cwupmhbwuo.exe
5556	cwuomgezwr.sys
3488	CP.exe
3152	rojhbztrmj.exe
1812	CP.exe
1728	CP.exe
784	i_rojhbztrmj.exe
548	lgeywqojgb.sys
3040	CP.exe
4512	bvtolgezto.exe
408	CP.exe
3292	CP.exe
4436	i_bvtolgezto.exe
4696	gbytrljdbv.sys
4540	CP.exe
3640	nlgdyvqoig.exe
3848	CP.exe
5704	CP.exe
2760	i_nlgdyvqoig.exe
5844	wqoigaytql.sys
6124	CP.exe
2308	lfdyvqniga.exe
5008	CP.exe
5936	CP.exe
5168	i_lfdyvqniga.exe
2896	kidavsnlfd.sys
1364	CP.exe
6104	dxvqnigays.exe
4700	CP.exe
464	CP.exe
6088	i_dxvqnigays.exe
1980	icausnkfdx.sys
5240	CP.exe
5820	xvpnhfaxsq.exe
3836	CP.exe
5964	CP.exe
3224	i_xvpnhfaxsq.exe
5360	hfaxspkica.sys
3060	CP.exe
5268	smkecxupjh.exe
3252	CP.exe
6012	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgezto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgezto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2376	ipconfig.exe
1304	ipconfig.exe
964	ipconfig.exe
3920	ipconfig.exe
2264	ipconfig.exe
4416	ipconfig.exe
3692	ipconfig.exe
1508	ipconfig.exe
4844	ipconfig.exe
1168	ipconfig.exe
1420	ipconfig.exe
6040	ipconfig.exe
1972	ipconfig.exe
3484	ipconfig.exe
4204	ipconfig.exe
3744	ipconfig.exe
5068	ipconfig.exe
1156	ipconfig.exe
2788	ipconfig.exe
5296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499040848"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1543376569"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284870"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1548220453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000ef787844acafe87f82e65cf1f17511ec811a8907dbba2689f3256264f090338b000000000e8000000002000020000000a92d406558185db9a33d778e102112cf39ef412f6d92714b0ccdb358177c9b5220000000fd8458af9d96e847601889e1f03bf6ed144d7505cc119a576c02c8edc8f6b79540000000c117f4943c9513c664de08b59bde159a3c8411e53aaccb2e68cf7ad9a2bdf077794a6ec2b4b5476c5097984b007108ea33f1d10ea1f9f598a345a36956483478	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0da47be8e5edd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{873889FC-CA79-11F1-8FDF-E2EB83378A00} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ae40be8e5edd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000097e10f6b3ff37351a572c3373ed6484951e4d477147e24952f914111f730b5bd000000000e80000000020000200000004f7011246ed7bd95a7815753ef9688f302cd6a9d7a8769209e939e9d1976d7b1200000004672df29ebd9a4db4d6e2daba416cd3f360c6db239ec2ab7f3bcd57f820d150d40000000fa2bcd677def3b48f9cbdc414dbac62850a64dd5a004c764ea5bb2c9bc235b8a6a531d3121cee9150e76cd0e83ba714a2b8b8de4c5a7b7920237630d379b6652	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	i_avsnkfdxsq.exe
Token: SeDebugPrivilege	5576	i_pkicausnkf.exe
Token: SeDebugPrivilege	376	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	4832	i_cwupmhbwuo.exe
Token: SeDebugPrivilege	784	i_rojhbztrmj.exe
Token: SeDebugPrivilege	4436	i_bvtolgezto.exe
Token: SeDebugPrivilege	2760	i_nlgdyvqoig.exe
Token: SeDebugPrivilege	5168	i_lfdyvqniga.exe
Token: SeDebugPrivilege	6088	i_dxvqnigays.exe
Token: SeDebugPrivilege	3224	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	4580	i_smkecxupjh.exe
Token: SeDebugPrivilege	3948	i_usmkecwupm.exe
Token: SeDebugPrivilege	864	i_omhezxrpjh.exe
Token: SeDebugPrivilege	4196	i_jebwtomgey.exe
Token: SeDebugPrivilege	1008	i_tqljdbvtol.exe
Token: SeDebugPrivilege	2548	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	5168	i_qkidavtnlf.exe
Token: SeDebugPrivilege	2248	i_kicausnkfd.exe
Token: SeDebugPrivilege	216	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	1924	i_fzxrmkecxu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4552	iexplore.exe
4552	iexplore.exe
4688	IEXPLORE.EXE
4688	IEXPLORE.EXE
4688	IEXPLORE.EXE
4688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4552	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	85
PID 4552 wrote to memory of 4688	4552	iexplore.exe	86
PID 4660 wrote to memory of 3420	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	92
PID 4116 wrote to memory of 2492	4116	avsnkfdxsq.exe	95
PID 4660 wrote to memory of 3768	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	101
PID 4660 wrote to memory of 4748	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	109
PID 2236 wrote to memory of 3540	2236	pkicausnkf.exe	111
PID 4660 wrote to memory of 5668	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	114
PID 4660 wrote to memory of 5368	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	118
PID 5840 wrote to memory of 5072	5840	fzxrpjhczu.exe	120
PID 4660 wrote to memory of 224	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	123
PID 4660 wrote to memory of 2696	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	127
PID 1664 wrote to memory of 1436	1664	cwupmhbwuo.exe	129
PID 4660 wrote to memory of 3096	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	132
PID 4660 wrote to memory of 3488	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	139
PID 3152 wrote to memory of 1812	3152	rojhbztrmj.exe	141
PID 4660 wrote to memory of 1728	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	144
PID 4660 wrote to memory of 3040	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	148
PID 4512 wrote to memory of 408	4512	bvtolgezto.exe	150
PID 4660 wrote to memory of 3292	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	153
PID 4660 wrote to memory of 4540	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	157
PID 3640 wrote to memory of 3848	3640	nlgdyvqoig.exe	159
PID 4660 wrote to memory of 5704	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	162
PID 4660 wrote to memory of 6124	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	166
PID 2308 wrote to memory of 5008	2308	lfdyvqniga.exe	168
PID 4660 wrote to memory of 5936	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	171
PID 4660 wrote to memory of 1364	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	175
PID 6104 wrote to memory of 4700	6104	dxvqnigays.exe	177
PID 4660 wrote to memory of 464	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	180
PID 4660 wrote to memory of 5240	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	184
PID 5820 wrote to memory of 3836	5820	xvpnhfaxsq.exe	186
PID 4660 wrote to memory of 5964	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	189
PID 4660 wrote to memory of 3060	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	193
PID 5268 wrote to memory of 3252	5268	smkecxupjh.exe	195
PID 4660 wrote to memory of 6012	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	198
PID 4660 wrote to memory of 5336	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	202
PID 3380 wrote to memory of 1648	3380	usmkecwupm.exe	204
PID 4660 wrote to memory of 3996	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	207
PID 4660 wrote to memory of 3172	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	211
PID 1480 wrote to memory of 5472	1480	omhezxrpjh.exe	213
PID 4660 wrote to memory of 5264	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	216
PID 4660 wrote to memory of 1700	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	220
PID 620 wrote to memory of 4584	620	jebwtomgey.exe	222
PID 4660 wrote to memory of 4348	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	225
PID 4660 wrote to memory of 8	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	229
PID 2468 wrote to memory of 4696	2468	tqljdbvtol.exe	231
PID 4660 wrote to memory of 2972	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	234
PID 4660 wrote to memory of 768	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	238
PID 2996 wrote to memory of 5512	2996	vtnlfdyvqo.exe	240
PID 4660 wrote to memory of 1872	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	243
PID 4660 wrote to memory of 4816	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	247
PID 5584 wrote to memory of 5524	5584	qkidavtnlf.exe	249
PID 4660 wrote to memory of 1096	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	252
PID 4660 wrote to memory of 4044	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	256
PID 6048 wrote to memory of 1848	6048	kicausnkfd.exe	258
PID 4660 wrote to memory of 1616	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	261
PID 4660 wrote to memory of 5064	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	265
PID 3056 wrote to memory of 3448	3056	fcxvpnhfzx.exe	267
PID 4660 wrote to memory of 4856	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	270
PID 4660 wrote to memory of 208	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	274
PID 1236 wrote to memory of 6116	1236	fzxrmkecxu.exe	276
PID 4660 wrote to memory of 2388	4660	2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe	279

C:\Users\Admin\AppData\Local\Temp\2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_1d064b76a2008dd50fbcb8e24e3eb72c_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4552 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkfdxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3420
- - C:\Temp\avsnkfdxsq.exe
    C:\Temp\avsnkfdxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkfdxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\i_avsnkfdxsq.exe
    C:\Temp\i_avsnkfdxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5668
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Temp\fzxrpjhczu.exe
    C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:224
- - C:\Temp\i_fzxrpjhczu.exe
    C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhbwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Temp\cwupmhbwuo.exe
    C:\Temp\cwupmhbwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhbwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3096
- - C:\Temp\i_cwupmhbwuo.exe
    C:\Temp\i_cwupmhbwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3488
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1728
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgezto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3040
- - C:\Temp\bvtolgezto.exe
    C:\Temp\bvtolgezto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgezto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3292
- - C:\Temp\i_bvtolgezto.exe
    C:\Temp\i_bvtolgezto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\nlgdyvqoig.exe
    C:\Temp\nlgdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Temp\i_nlgdyvqoig.exe
    C:\Temp\i_nlgdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\lfdyvqniga.exe
    C:\Temp\lfdyvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5936
- - C:\Temp\i_lfdyvqniga.exe
    C:\Temp\i_lfdyvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\dxvqnigays.exe
    C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\i_dxvqnigays.exe
    C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5240
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3060
- - C:\Temp\smkecxupjh.exe
    C:\Temp\smkecxupjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\i_smkecxupjh.exe
    C:\Temp\i_smkecxupjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:5336
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:3996
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  PID:3172
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  PID:5264
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtomgey.exe ups_run
  2⤵
  PID:1700
- - C:\Temp\jebwtomgey.exe
    C:\Temp\jebwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtomgey.exe ups_ins
  2⤵
  PID:4348
- - C:\Temp\i_jebwtomgey.exe
    C:\Temp\i_jebwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run
  2⤵
  PID:8
- - C:\Temp\tqljdbvtol.exe
    C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins
  2⤵
  PID:2972
- - C:\Temp\i_tqljdbvtol.exe
    C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:768
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run
  2⤵
  PID:4816
- - C:\Temp\qkidavtnlf.exe
    C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins
  2⤵
  PID:1096
- - C:\Temp\i_qkidavtnlf.exe
    C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  PID:4044
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins
  2⤵
  PID:1616
- - C:\Temp\i_kicausnkfd.exe
    C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  PID:5064
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  PID:4856
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrmkecxu.exe ups_run
  2⤵
  PID:208
- - C:\Temp\fzxrmkecxu.exe
    C:\Temp\fzxrmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrmkecxu.exe ups_ins
  2⤵
  PID:2388
- - C:\Temp\i_fzxrmkecxu.exe
    C:\Temp\i_fzxrmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924

C:\Temp\avpnhfzxsp.sys
C:\Temp\avpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
- Executes dropped EXE
PID:5156

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:3068

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:5556

C:\Temp\lgeywqojgb.sys
C:\Temp\lgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:548

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:4696

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\hfaxspkica.sys
C:\Temp\hfaxspkica.sys
1⤵
- Executes dropped EXE
PID:5360

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
PID:4832

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:4740

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:5672

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
PID:3568

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:3480

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
PID:5320

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
PID:3004

C:\Temp\usmkfcxvpn.sys
C:\Temp\usmkfcxvpn.sys
1⤵
PID:2212

C:\Temp\mkfcxvpnhf.sys
C:\Temp\mkfcxvpnhf.sys
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avpnhfzxsp.sys

Path C:\Temp\avpnhfzxsp.sys
Size 141KB
SHA256 99f983899423faded2cff32926d5e83a6d376c6c4eff8190ec686b4a9a1cdf2a
MD5 dc4c327f080312d489196dcb87d3cf4c
SHA1 2a5ef683ed3f1e1de0c74cb4ed03334bf69bd26f
SHA512 80bc48a94252199ed287f81de474726308cb57d471bac015489c86a9c9129b478c16a82f0034a5b9d612cb4169923058e604fa8ee8336265d68d18f4aa911815
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnkfdxsq.exe

Path C:\Temp\avsnkfdxsq.exe
Size 243KB
SHA256 831494fec6f80577898498a89e59af730874941e0da3d02f39a5ff7af77fa4b8
MD5 8404099bbc9f5fb7d1658dc06ff84b87
SHA1 e7de2b1fbc80a578ac5a87200bf68c22680138f5
SHA512 aaa0203243273927bac61c5324e9ec226018e2eb04c6caecf2eb8780692742bc6d9d57a291d16a5f49bad8a77166722c7bf429b69eaf8b12849dddbf04b3dfa4
SSDEEP 3072:zBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:Fb3TfLAUa3lLNngoqRttA73
TLSH
T133344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgezto.exe

Path C:\Temp\bvtolgezto.exe
Size 243KB
SHA256 40c7ab84752ef0be73484862f67719a93df7ae7db07ead8b7cb25ddd5a9f7570
MD5 d2912b07b1899d4b342ecdec8919770e
SHA1 6f6b43ec12df038a4f40b616ed166fb0b81048c8
SHA512 03b562dfc41417ac6955d7eb6bcdf114b5fbd5937acc42330aa1a950ad1cdcb6c3283e9ce9c510850402aafdc2927f4e96b7f0d557e0b86ed1f46d6e2873638d
SSDEEP 3072:ZBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:7b3TfLAUa3lLNngoqRttA79
TLSH
T16334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwr.sys

Path C:\Temp\cwuomgezwr.sys
Size 141KB
SHA256 634d9ce32ab7fee157ca702a44d40f0bfd6f3f8f7c35e966095fcccb8835bf8e
MD5 39cfd43a43cce2361dd0293b561f93b8
SHA1 71c3e7bd87672c1628822ecfed948faca872c4a1
SHA512 74a6ad1b6f8221a2aee6a1a9e3a563146bff3648bd579b3764a3bbbc48375a4fa6b2923eb8fff7240a3bce3dd9c3545551d3a12ee0c16bd561fceeb7d002156c
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhbwuo.exe

Path C:\Temp\cwupmhbwuo.exe
Size 243KB
SHA256 4d5eca682d47fbdd495071a06f54361b82801831f355e4eaffbd7c2daf72ef02
MD5 619f84669537ab120e4e12c15d1e2501
SHA1 9c4d55323d6e2931480a46f132253cd4216a9f27
SHA512 f02949e6b14ed63af8393944aace3b528e39c251990ef401cb2daa514ceece2bbb7d5fdf4db3a3242a3ae666f16cddc6ba563991a7d9e3070e74376311e4103b
SSDEEP 3072:QBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:Ab3TfLAUa3lLNngoqRttA7g
TLSH
T184344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhczu.exe

Path C:\Temp\fzxrpjhczu.exe
Size 243KB
SHA256 97391a30c8e05ceb8d094d0845eba5707a0ed0569b777741df3ee98b5bb8f855
MD5 91b5fce1668988826348ed3d27d0542b
SHA1 80b2d1e3eaa0c6659f3833a4e728ccdfa7439f2a
SHA512 7e9fbf2697175e518be0b8410ee206edee752ef6f64d4424f42f46f716acd4364fd46ceb4a3aa490170de4a8900bc108fa13fc42ec6ae966521c82e2caa6d4e3
SSDEEP 3072:LBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:9b3TfLAUa3lLNngoqRttA7T
TLSH
T15134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 db7ead24356297d7836dc1f407d46d90b2e524b81b1b634cc00c7e04429b155a
MD5 df48de573cd0cd308f00d67a9cc34f7c
SHA1 d32b5fcd85e2346e31c5dc106fd0ddb2fe5a81a0
SHA512 70823d7ff95fdad3ab7013561a1d965e6dc3838e3217d2d749050f86d433141e64219acb7371294b6095e69244eba5833a28128928bb56670d5075307d6dbdfd
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnkfdxsq.exe

Path C:\Temp\i_avsnkfdxsq.exe
Size 243KB
SHA256 fd2fa6f5b122ecb85f619dff14939ef65c687449e2cc0c4c2a0d9994c3d9196b
MD5 f84ff0cdede84b44fc067b4a7900f53a
SHA1 a1b6e21d5f07647a3595aa30c8ccd61ecac39d3b
SHA512 a68a17045d012d60798188abc7957eab087eceacf53160a83478840115c4d9319c7d0e6dd006cad75495346ebd3109dd53c35c60979d3002b6550c6d9aa01811
SSDEEP 3072:hBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:Db3TfLAUa3lLNngoqRttA7R
TLSH
T1A334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgezto.exe

Path C:\Temp\i_bvtolgezto.exe
Size 243KB
SHA256 1c53d22446a91f5da580387d16eb80b9cf6363b40f2037c1a149b7400dcde1d3
MD5 7378a6ff98f1ce48cf073353209ab779
SHA1 90e7cdfc6a9ef7561018190b28044af248bc6eed
SHA512 9eb26b1cf7938e42eb23b0007e93ab71eb571d5bab9a3c1e999759a67bb04afa029988f9268dc325a24275c867ed16fe8dfe59cd58556af50027ea28f5adf459
SSDEEP 3072:jBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:Vb3TfLAUa3lLNngoqRttA7X
TLSH
T19834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmhbwuo.exe

Path C:\Temp\i_cwupmhbwuo.exe
Size 243KB
SHA256 8ee511062e03d98970fd577669d2a90feb747a99aba22aa202fd9e1d23a8b874
MD5 715cbce7c792eb232c12c04cf6053e6b
SHA1 7825c6feb8473dc70ff93fb1e33634bab113a5a7
SHA512 28fb5152d0c0c25d1a9099b50b5a8dd34312f828e6c28ed35e084323b4d96f65804ddc6055e51bb5b04748b602bafca87e0104bcddfdcfe0a732e4ba8eb44fa9
SSDEEP 3072:1Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:fb3TfLAUa3lLNngoqRttA7R
TLSH
T1BB34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpjhczu.exe

Path C:\Temp\i_fzxrpjhczu.exe
Size 243KB
SHA256 ed2b87a4691745120688fc8c57e5c296bf6c67638666756c801d0caf22599243
MD5 c985c8833579cd4bb45790a217f04bdf
SHA1 8743cd835ad75aa03cac976cdfabe6a873dbca93
SHA512 80f235d644f888a47612a1b934f16f7e75890471163006ece5755dd72fb0e57a7b02e2728b882294e33143f3ee6cc95a23a6c2d09b6316f1fc24b36f8111310e
SSDEEP 3072:qBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:ib3TfLAUa3lLNngoqRttA7W
TLSH
T1CE34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdyvqoig.exe

Path C:\Temp\i_nlgdyvqoig.exe
Size 243KB
SHA256 994af62f9f9dcaad4c9778a47ec3e17d53ad72fd758b36dc18c678a8cc1bd241
MD5 b019992e76522254e6828cec8465aaa6
SHA1 1cbd5a4c00b4917e89216080f31f074c2170eb70
SHA512 579bf5adc218f82bd1e02e3daa0bd4fd35dc66b9e44b304b7cd0de3f71fb6df6d1ee79d137972b9882e56ae7585b2a7c16bd10809b5de3d6271bd9383b011b90
SSDEEP 3072:sBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:kb3TfLAUa3lLNngoqRttA7E
TLSH
T1AC34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausnkf.exe

Path C:\Temp\i_pkicausnkf.exe
Size 243KB
SHA256 614d7302c24a3fcade8ff892caaa8680c6296a3c07087e170461fec194ad6581
MD5 b5857bbc64465c78eaf1b311e108d676
SHA1 b59f4c882d7b9aa7a38e2630cf68e0e4872f1cd2
SHA512 59a27e8c42a13a25be682aea055127917d4fef66ecd9e0a4f934fbfa7f59cb399d3aaf365fadcf256f4bf8326a652b72f1d6da8ddd723e31bf89637f525852c4
SSDEEP 3072:VBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:/b3TfLAUa3lLNngoqRttA71
TLSH
T183344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrmj.exe

Path C:\Temp\i_rojhbztrmj.exe
Size 243KB
SHA256 77aa1522716780ecfc338213fd3797bf4116c3fddd4d4a2865f7f498dea4c0ff
MD5 0dcf845648c9f1953220b96606635e1f
SHA1 9a7f7bac9e2ca497edd91e521623ba9744f86dd8
SHA512 700f54578f060189b263781d5ccb81f81d439c6b97389c3056b78f6bd23c9ac6e14eb230d1fc27e3e643fe4926256548527b5e0def8e9ff9e2b47f8942dc3ece
SSDEEP 3072:sBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:kb3TfLAUa3lLNngoqRttA7c
TLSH
T1E134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.sys

Path C:\Temp\jhczusmkec.sys
Size 141KB
SHA256 9d77438d2eeffce7cf7d49c1c9e6c3e2a0875680dc76ccdf84e731e3eac36b13
MD5 ecb096c38f6f60da59a8208c2ee4bc36
SHA1 e49d633eed59c86a6727927e3b01443a6bcaba74
SHA512 6798b4d37fdf1a77d71091d839ef11fd6cd012ef03b2c939a0378ea21b0d2c67ee26b66694248cb6c08df8d2279bdbaee6d1c720cfad4f29f37b3e5aaf7857dc
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqniga.exe

Path C:\Temp\lfdyvqniga.exe
Size 243KB
SHA256 e95db33a0829b474914627851e9711c8309603640044810ab17b1760b8955403
MD5 6d82cd692ba1d2cdc598763da7121b2d
SHA1 00a8abf2e366e7e52a39a9630dc651331f34b64c
SHA512 ca5c1e0e76219309d896395b118dbc3b76cd4d64ce0ee3d817df0a86f2dbc66cbe196a8f9ca647ba2930432c1ed94c45cff9fcdc08220550d6988059b3205044
SSDEEP 3072:IBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:4b3TfLAUa3lLNngoqRttA7A
TLSH
T14834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqojgb.sys

Path C:\Temp\lgeywqojgb.sys
Size 141KB
SHA256 b003f46392bf62617c0fd0d13ab6ba2d9a2d00c2dab1c3d3e6613a39d44ae545
MD5 c0aed204dd38234d41397d88df20b226
SHA1 59a8a43454b778ef79903f00b0633930a4117889
SHA512 9ab616b0c4d47f473d05e5fc4181e097e8a263d9c20a1a05d3316d6e8f930f1e65998f10339ef247e0054e2427bf63a7772c129e4c483197244904bf62bcf18f
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18AE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoig.exe

Path C:\Temp\nlgdyvqoig.exe
Size 243KB
SHA256 f446b8a082d5baf635aacc0d099b76e0dd9f4a4c88d49a42bb3bacf891ffa377
MD5 1634d24e4e140a999b9129061518caac
SHA1 bea211b7168a23cf5fc0b2e7b5db395ffa09e515
SHA512 62caf7c1a2fd40d5111590f51f90b4defcf90f0d060ba0b5f9e6771d7e5d5420f369a9f0e3b14689d473452707d31c5356af477474f00385b3c65ddb57c13075
SSDEEP 3072:yBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:qb3TfLAUa3lLNngoqRttA7q
TLSH
T19434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.exe

Path C:\Temp\pkicausnkf.exe
Size 243KB
SHA256 fcf58ee44eadba86a8b9a087a851c5016b4b776f0a1c87a405de2e46f3c6f2fd
MD5 cc19962b7f1776cec5c48dc299d4be19
SHA1 c3f92dab5474b5965bdffb64d912646952923231
SHA512 9fc23830dfeea526500a87782442803d28ede216d1edcc351842d06b683e426070599cf28523bcea20b755a34abea452939f4d5f96a3a1dc376dd0e8844ff080
SSDEEP 3072:KBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:Cb3TfLAUa3lLNngoqRttA7u
TLSH
T14134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmj.exe

Path C:\Temp\rojhbztrmj.exe
Size 243KB
SHA256 2277f91835357efb3b082124f9d60be685c08a0f1d9c0cda21e190deef541986
MD5 0d8125c81883522a256220a7f0a7d5c3
SHA1 e37c0d3e0e94545f5d42cefd7657ab96e282ceb1
SHA512 9e6d467ff3f0360de42f7084969476cf582a1c70b350bb50b2925ccfe00aba855e4fc3f65e8448128957e2a2e396d94bc01833be32dffe491744992a8622837c
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:Rb3TfLAUa3lLNngoqRttA7f
TLSH
T151344A0172818071E75A0B78045AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupn.sys

Path C:\Temp\usmkfcxupn.sys
Size 141KB
SHA256 dc26d15e1a4ef4c8f76c8d97031fa40c4b5f90fbefd4630a458587e50964135a
MD5 c7c5d7f57bb9c02b2cbe64f502291abb
SHA1 96b263c02c3efeb0bb2cac561dda3f3797d2fa44
SHA512 11507ce3e06211b15b924964cda0e0bf53108e16263c06f4a8726139d44630a845df3875e3a72c4fb3f3b43087846cae51cfbe25250abf7df2ddfefcbddf954d
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytql.sys

Path C:\Temp\wqoigaytql.sys
Size 141KB
SHA256 def91a0a5ed949c0969038b84425be7604115a03822f967463490e8ade738536
MD5 0eaa2abc1abad414207dbb602e618ab3
SHA1 b25ea14da08d047213f1c1fa76663d7e9b0ae774
SHA512 272e9a9293d72f1396b38b0ad6e8e005bb15d35383571beb278b5b4bbf7dd1e33fc78a74a28fa3e2d1d12a48dd44a5ee1cec353b562117f3ea1cd7e5a9fc754b
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 164e7b32334543fc65809184aa72aa6d2bac69d5f01f62c301233ff1a6b39bf8
MD5 3417f1f7cc2e4e62a48c3b4e47d786d0
SHA1 fdbd0552d99366dd9a7e2017318495d497a5fb58
SHA512 042eec3588d398124e22ca97ade51b16a3cb2428dc188366b6b6f8c0a309bcfe8a939b23c2809d213a4ac7cc74e4a1c35c6b4b8f0a25f9b4739007fc18bea01f
TLSH
T1CEF0D460915DFCD15F65ECCC3E10468C34A8F4BF165CC176517C05E750A6F616D5A460
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 a833726aea324768e9bea143a93c090aa218e84b4a7863874b72ddb97d23acf5
MD5 bf5468c36d1aff482504e17425fedffd
SHA1 8bd440bbf3c271a0e86b067d17ee81e182a435c4
SHA512 5d5180ab0dfdfaf97aebab7e37d002ae556f6e3f71adbaff010729d467afec7a55afcfc847575b34de5796101ec041dde55e94e3802c9b5c5509f3ea763eb6cc
TLSH
T17EE07D2413FA421FE1F5E4394BD9752694AEF1321429A3B429D89B04B702A009C03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-72-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1980-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2212-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3480-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3568-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4696-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4972-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5156-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5320-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5360-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5360-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5556-58-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5844-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads