e8c6457ef9eb976ceb76029e58929a04f37ab4917f147070e6ec2ebf93bc1dc3

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe
Size 243KB
Sample261017-mmcmdsdx3p
SHA256 e8c6457ef9eb976ceb76029e58929a04f37ab4917f147070e6ec2ebf93bc1dc3
MD5 a14472df314cbe33965d165b1acd04a9
SHA1 88c25fbcfa43e7eb3a1200e84446e907d542e10d
SHA512 da8a0d73ef4eb70980d38eda51984644f5500ea5cafe9c087e774fdc22d12ab8961f5d060b9daf45f9e52241c18bc38c8aa1799a122c34279d6f48bfe55d08a1
SSDEEP 3072:Ahn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:4n7nLQka3lLNngoqRttA7C
TLSH
T11334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2852	CP.exe
3852	czurmkecxu.exe
3524	CP.exe
752	CP.exe
2188	i_czurmkecxu.exe
5012	wupmhfzxrp.sys
1648	CP.exe
2304	ecwuomgezw.exe
4440	CP.exe
4496	CP.exe
3376	i_ecwuomgezw.exe
3948	jhbztrmjec.sys
4084	CP.exe
3424	bwuomgeytr.exe
3212	CP.exe
3932	CP.exe
2272	i_bwuomgeytr.exe
3264	wqoigbytrl.sys
1320	CP.exe
388	ojgbztrljd.exe
4224	CP.exe
3464	CP.exe
2768	i_ojgbztrljd.exe
4816	igbytrljdb.sys
1824	CP.exe
2920	yvqoigaytq.exe
2216	CP.exe
2872	CP.exe
4432	i_yvqoigaytq.exe
3848	aysqlidbvt.sys
3124	CP.exe
2972	lidbvtnlfd.exe
1468	CP.exe
2948	CP.exe
4668	i_lidbvtnlfd.exe
4808	kicavsnlfd.sys
1836	CP.exe
5016	davtnlfdxv.exe
2260	CP.exe
3128	CP.exe
3528	i_davtnlfdxv.exe
3868	cavsnkfdxv.sys
3308	CP.exe
4904	vpnicxvpnh.exe
4816	CP.exe
2472	CP.exe
3916	i_vpnicxvpnh.exe
2380	upnhfzxrpk.sys
2008	CP.exe
2016	khczusmkec.exe
448	CP.exe
1056	CP.exe
1852	i_khczusmkec.exe
892	usmkecxupn.sys
5028	CP.exe
3408	ezxrpjecwu.exe
5056	CP.exe
3444	CP.exe
2756	i_ezxrpjecwu.exe
4356	rmkecwuomh.sys
3452	CP.exe
4996	hezwrpjhbz.exe
4724	CP.exe
4236	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbwqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnicxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnicxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbwqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3404	ipconfig.exe
2188	ipconfig.exe
4572	ipconfig.exe
1884	ipconfig.exe
3184	ipconfig.exe
3648	ipconfig.exe
3520	ipconfig.exe
3344	ipconfig.exe
3672	ipconfig.exe
4848	ipconfig.exe
4728	ipconfig.exe
4376	ipconfig.exe
3696	ipconfig.exe
4160	ipconfig.exe
1636	ipconfig.exe
1128	ipconfig.exe
4840	ipconfig.exe
4752	ipconfig.exe
3704	ipconfig.exe
4936	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284771"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cacf8e2b5edd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284771"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "746510466"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "746666361"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{57A8D039-CA16-11F1-9982-5A77EA7A180E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000036b1520f33192f74e8d6c3c7cdae6e5b89ec6e5b39d28b66851dbd04355e5761000000000e8000000002000020000000d37dcc0d879a951e281a42ab53468bbcb63aef08a3d5d5ef4617e6d5f492a047200000000bde3984e517ed33fe65d523beb30e08b329b3114171f49a834ea15525f494ce40000000de81bc16cf1d801fe5569fdf8c312963414326442c5fb69a27757516f3314aa2f0c83d01f1df3356b4a0be5bbe6a667b0d20ef3a57bca23d7697bb70a4233efe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498998248"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4067d98e2b5edd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b00000000020000000000106600000001000020000000f49b61c34d0dfbca7769ecfd2ff78fef6b241fa3c74bce3b836b8ec33a5436f7000000000e80000000020000200000007c2f9cff620eca9d77dc15a9cbec140c4ec8d27f02cdaba6a7dbc6d54435262520000000ac8a0a631dcf3134a22b8b2d66fc9887200854642f36718174d18ca51509bd1840000000e25cc2c1111111eced9dfbb82d269368aff8613ece67abcb6de6ec899267ebff51b6c11bc63f000ed2f51cb7f78e79f83791bb228d05975bfe19bc7d0eafca00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	i_czurmkecxu.exe
Token: SeDebugPrivilege	3376	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2272	i_bwuomgeytr.exe
Token: SeDebugPrivilege	2768	i_ojgbztrljd.exe
Token: SeDebugPrivilege	4432	i_yvqoigaytq.exe
Token: SeDebugPrivilege	4668	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	3528	i_davtnlfdxv.exe
Token: SeDebugPrivilege	3916	i_vpnicxvpnh.exe
Token: SeDebugPrivilege	1852	i_khczusmkec.exe
Token: SeDebugPrivilege	2756	i_ezxrpjecwu.exe
Token: SeDebugPrivilege	2020	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	4804	i_bwtomgeywq.exe
Token: SeDebugPrivilege	5024	i_tqljdbwqoi.exe
Token: SeDebugPrivilege	1536	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	2832	i_qkidavtnlf.exe
Token: SeDebugPrivilege	4528	i_fcxvpnhfax.exe
Token: SeDebugPrivilege	4588	i_zusmkecxup.exe
Token: SeDebugPrivilege	868	i_rpjhczusmk.exe
Token: SeDebugPrivilege	1220	i_wupmhezxrp.exe
Token: SeDebugPrivilege	3880	i_uomgezwrpj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
4024	IEXPLORE.EXE
4024	IEXPLORE.EXE
4024	IEXPLORE.EXE
4024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2568	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	85
PID 2568 wrote to memory of 4024	2568	iexplore.exe	86
PID 2692 wrote to memory of 2852	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	90
PID 3852 wrote to memory of 3524	3852	czurmkecxu.exe	95
PID 2692 wrote to memory of 752	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	100
PID 2692 wrote to memory of 1648	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	108
PID 2304 wrote to memory of 4440	2304	ecwuomgezw.exe	110
PID 2692 wrote to memory of 4496	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	113
PID 2692 wrote to memory of 4084	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	117
PID 3424 wrote to memory of 3212	3424	bwuomgeytr.exe	119
PID 2692 wrote to memory of 3932	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	122
PID 2692 wrote to memory of 1320	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	126
PID 2692 wrote to memory of 3464	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	131
PID 2692 wrote to memory of 1824	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	138
PID 2920 wrote to memory of 2216	2920	yvqoigaytq.exe	140
PID 2692 wrote to memory of 2872	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	143
PID 2692 wrote to memory of 3124	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	147
PID 2972 wrote to memory of 1468	2972	lidbvtnlfd.exe	149
PID 2692 wrote to memory of 2948	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	152
PID 2692 wrote to memory of 1836	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	156
PID 5016 wrote to memory of 2260	5016	davtnlfdxv.exe	158
PID 2692 wrote to memory of 3128	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	161
PID 2692 wrote to memory of 3308	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	165
PID 4904 wrote to memory of 4816	4904	vpnicxvpnh.exe	167
PID 2692 wrote to memory of 2472	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	170
PID 2692 wrote to memory of 2008	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	175
PID 2016 wrote to memory of 448	2016	khczusmkec.exe	177
PID 2692 wrote to memory of 1056	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	180
PID 2692 wrote to memory of 5028	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	184
PID 3408 wrote to memory of 5056	3408	ezxrpjecwu.exe	186
PID 2692 wrote to memory of 3444	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	189
PID 2692 wrote to memory of 3452	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	193
PID 4996 wrote to memory of 4724	4996	hezwrpjhbz.exe	195
PID 2692 wrote to memory of 4236	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	198
PID 2692 wrote to memory of 4424	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	202
PID 3788 wrote to memory of 3056	3788	bwtomgeywq.exe	204
PID 2692 wrote to memory of 4368	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	207
PID 2692 wrote to memory of 1448	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	211
PID 1744 wrote to memory of 3252	1744	tqljdbwqoi.exe	213
PID 2692 wrote to memory of 2420	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	216
PID 2692 wrote to memory of 516	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	220
PID 2068 wrote to memory of 2228	2068	nlfdxvqnig.exe	222
PID 2692 wrote to memory of 892	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	225
PID 2692 wrote to memory of 4752	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	229
PID 4196 wrote to memory of 3964	4196	qkidavtnlf.exe	231
PID 2692 wrote to memory of 4680	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	234
PID 2692 wrote to memory of 3232	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	238
PID 3676 wrote to memory of 1684	3676	fcxvpnhfax.exe	240
PID 2692 wrote to memory of 3528	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	243
PID 2692 wrote to memory of 4056	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	247
PID 4548 wrote to memory of 3536	4548	zusmkecxup.exe	249
PID 2692 wrote to memory of 4804	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	252
PID 2692 wrote to memory of 1328	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	256
PID 3476 wrote to memory of 1700	3476	rpjhczusmk.exe	258
PID 2692 wrote to memory of 2236	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	261
PID 2692 wrote to memory of 2140	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	265
PID 3948 wrote to memory of 1760	3948	wupmhezxrp.exe	267
PID 2692 wrote to memory of 3404	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	270
PID 2692 wrote to memory of 1620	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	274
PID 4376 wrote to memory of 3560	4376	uomgezwrpj.exe	276
PID 2692 wrote to memory of 3060	2692	2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe	279

C:\Users\Admin\AppData\Local\Temp\2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_a14472df314cbe33965d165b1acd04a9_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- - C:\Temp\czurmkecxu.exe
    C:\Temp\czurmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:752
- - C:\Temp\i_czurmkecxu.exe
    C:\Temp\i_czurmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1648
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4084
- - C:\Temp\bwuomgeytr.exe
    C:\Temp\bwuomgeytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3932
- - C:\Temp\i_bwuomgeytr.exe
    C:\Temp\i_bwuomgeytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3464
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\yvqoigaytq.exe
    C:\Temp\yvqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2872
- - C:\Temp\i_yvqoigaytq.exe
    C:\Temp\i_yvqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3124
- - C:\Temp\lidbvtnlfd.exe
    C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2948
- - C:\Temp\i_lidbvtnlfd.exe
    C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1836
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3128
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnicxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\vpnicxvpnh.exe
    C:\Temp\vpnicxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnicxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_vpnicxvpnh.exe
    C:\Temp\i_vpnicxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2008
- - C:\Temp\khczusmkec.exe
    C:\Temp\khczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1056
- - C:\Temp\i_khczusmkec.exe
    C:\Temp\i_khczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\ezxrpjecwu.exe
    C:\Temp\ezxrpjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\i_ezxrpjecwu.exe
    C:\Temp\i_ezxrpjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\hezwrpjhbz.exe
    C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Temp\i_hezwrpjhbz.exe
    C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:4424
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:4368
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbwqoi.exe ups_run
  2⤵
  PID:1448
- - C:\Temp\tqljdbwqoi.exe
    C:\Temp\tqljdbwqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbwqoi.exe ups_ins
  2⤵
  PID:2420
- - C:\Temp\i_tqljdbwqoi.exe
    C:\Temp\i_tqljdbwqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run
  2⤵
  PID:516
- - C:\Temp\nlfdxvqnig.exe
    C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
  2⤵
  PID:892
- - C:\Temp\i_nlfdxvqnig.exe
    C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run
  2⤵
  PID:4752
- - C:\Temp\qkidavtnlf.exe
    C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_qkidavtnlf.exe
    C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfax.exe ups_run
  2⤵
  PID:3232
- - C:\Temp\fcxvpnhfax.exe
    C:\Temp\fcxvpnhfax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfax.exe ups_ins
  2⤵
  PID:3528
- - C:\Temp\i_fcxvpnhfax.exe
    C:\Temp\i_fcxvpnhfax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run
  2⤵
  PID:4056
- - C:\Temp\zusmkecxup.exe
    C:\Temp\zusmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins
  2⤵
  PID:4804
- - C:\Temp\i_zusmkecxup.exe
    C:\Temp\i_zusmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run
  2⤵
  PID:1328
- - C:\Temp\rpjhczusmk.exe
    C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins
  2⤵
  PID:2236
- - C:\Temp\i_rpjhczusmk.exe
    C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhezxrp.exe ups_run
  2⤵
  PID:2140
- - C:\Temp\wupmhezxrp.exe
    C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhezxrp.exe ups_ins
  2⤵
  PID:3404
- - C:\Temp\i_wupmhezxrp.exe
    C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run
  2⤵
  PID:1620
- - C:\Temp\uomgezwrpj.exe
    C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins
  2⤵
  PID:3060
- - C:\Temp\i_uomgezwrpj.exe
    C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3880

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\jhbztrmjec.sys
C:\Temp\jhbztrmjec.sys
1⤵
- Executes dropped EXE
PID:3948

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
- Executes dropped EXE
PID:3264

C:\Temp\igbytrljdb.sys
C:\Temp\igbytrljdb.sys
1⤵
- Executes dropped EXE
PID:4816

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:3848

C:\Temp\kicavsnlfd.sys
C:\Temp\kicavsnlfd.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
- Executes dropped EXE
PID:3868

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:2380

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
- Executes dropped EXE
PID:892

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
- Executes dropped EXE
PID:4356

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
PID:3492

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:808

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:2344

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
PID:4232

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
PID:4620

C:\Temp\kfcxvpnhfa.sys
C:\Temp\kfcxvpnhfa.sys
1⤵
PID:2988

C:\Temp\kfcxupnhfz.sys
C:\Temp\kfcxupnhfz.sys
1⤵
PID:4080

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
PID:1940

C:\Temp\bwuomgeywr.sys
C:\Temp\bwuomgeywr.sys
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvt.sys

Path C:\Temp\aysqlidbvt.sys
Size 141KB
SHA256 0ca1902ddb313e35ea84681eb9cbb56bfa953f175f23753fb4ed67ef57d86a20
MD5 de4c26490dbbf13052d197fd2de415b5
SHA1 6e5373a5c545075bf43f27aec832b6bda34a2395
SHA512 aaeb8332e5d8f17b91d067479819026128d88d2a274ddc1d34593c63619b20cd016a709a9b19e64a76684f43d065446e6bceb36ede476ff694939933d26e6b68
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T127E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeytr.exe

Path C:\Temp\bwuomgeytr.exe
Size 243KB
SHA256 de413eab26ed3cfd05f73d6985c3cb5adf876e0628e394a2bb5a9c9df7cd9e07
MD5 373103e69afe6993679924c1e62287ba
SHA1 d0c957a8f20d8c880dc0c2fa4d9677b7404cae7a
SHA512 4d3e82d8b24f6b1e3bd2641389215ddf203996eb4b5826a4214f1b2970c4f23e039dda6b0eb411484362c2915750584a20900ac94cfc65c8c6295fb83cdf4c87
SSDEEP 3072:Vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:Ln7nLQka3lLNngoqRttA7f
TLSH
T11E34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnkfdxv.sys

Path C:\Temp\cavsnkfdxv.sys
Size 141KB
SHA256 df0aa68bab0006a1d89546f2ce0ab1496c34237d9642c7c5bd0ce254caf692c0
MD5 e4621b897645fcaa5841512486e35c90
SHA1 7bd1a659c5c399cf02c3c0fc6ed7298a42880984
SHA512 6ecd628439fab28e54d0ada66513aabaa7e407fe71a44869146d1666feaccae0d3d5390fd72212c9bdb3850d03014c595fcbeaaf26edc3c56f2277b96b5a0635
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T120E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecxu.exe

Path C:\Temp\czurmkecxu.exe
Size 243KB
SHA256 0ff9915af1a35c82bf68e830fade8b4583c8842e4397718d847e99a02d8270ef
MD5 82798ea317ef0f6f483690c9fa627715
SHA1 e839b060e04dd939324db29df2578ae34dce774c
SHA512 f4b672a3fc1921df34ff2e57bc1608c1e8023dce2b481da8eccedaa09006aa783e5d71e21084bbeb177c1850b1696b10fd6209d95926c6c2b78dce1766f894e1
SSDEEP 3072:vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:Zn7nLQka3lLNngoqRttA7N
TLSH
T1F134590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdxv.exe

Path C:\Temp\davtnlfdxv.exe
Size 243KB
SHA256 2c357c7bdd5e98837b2d27fdd286eab67a2ed29340737009d2a1afe75f65c7c0
MD5 0703141db652a1c497a00b90cadb227a
SHA1 5fe343d98f24233a71f5b6030bbc2af414e54bae
SHA512 37598f83cdd5cd3388790e02a25effdc8fc245420f482bc0609a6b410ac2a3d07e6be8bdfea25c5bf4be83b245a2ac7672fbbfbbbac390837fee98b80a07ceb9
SSDEEP 3072:jhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:1n7nLQka3lLNngoqRttA7d
TLSH
T1C334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.exe

Path C:\Temp\ecwuomgezw.exe
Size 243KB
SHA256 c916567db6f721a4a12a6e505a8e2f57954c5a9f0e3510197b6e427cd7b70247
MD5 1a4d7da5398c686c580282299155cc99
SHA1 85c852f88a8a64da24addfcb5c89ad80a1b1978a
SHA512 e6708aa74ead6b50c799892a903c400babf695a285a2c4b685e873b71f0a84ef3a1b01df9b81ba4c3d480eeef878e3023d5a531d09e6a3ec56bf39bfd5500241
SSDEEP 3072:vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:Zn7nLQka3lLNngoqRttA7h
TLSH
T15034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomgeytr.exe

Path C:\Temp\i_bwuomgeytr.exe
Size 243KB
SHA256 1093115c92b99b636ac02578dbc8a3b8911accd029b892b075a6b9af9b271f30
MD5 689548a99357eaa6a902e904766fcdd4
SHA1 e2c5929168ce1b3b3e70381da6cab3e1ae5c489f
SHA512 3edf4b580bb83b3eb722f6281a65f353e4759181aa158979c075028775cbd188b9da19332224e2600581f93778876f54c36347572ac39de1d20762c15acaf9e5
SSDEEP 3072:mhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:6n7nLQka3lLNngoqRttA7Y
TLSH
T1D034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmkecxu.exe

Path C:\Temp\i_czurmkecxu.exe
Size 243KB
SHA256 39d1c77cc85f9e1c36892c792c030df40414ba6eb7fbaaf53da559a73c42283d
MD5 7e53731ac88dfd60e226e167c4288ba9
SHA1 33824706e1f46b4c8ff57f32a579febe2265169c
SHA512 d31edb0583da2d637b32afc369d3f2b04ec0f366e2f2839c8df107801ffe02e83c94e1110a2414a36228b07185d62b67a9c84e3863f5cf072a710d75715d29af
SSDEEP 3072:Hhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:Bn7nLQka3lLNngoqRttA7B
TLSH
T1E334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdxv.exe

Path C:\Temp\i_davtnlfdxv.exe
Size 243KB
SHA256 b8e910051ea2c07face9715f5f2a4f8205d3ddf0855acd153879984071608b36
MD5 bd08376c0a693d29c5b49968d97095d8
SHA1 9a0d998becce254bc58eeb5607c0b3b693ef26d3
SHA512 65a1c6c43f5bbaf6df03577ee66b5a32e81f569b7257e8074c726042e777f3372fffcfb4bd3a9b77f1e89acd97b0eda8b4ff56e0377d656d522c683766f01382
SSDEEP 3072:yhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:un7nLQka3lLNngoqRttA7g
TLSH
T1FD34490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgezw.exe

Path C:\Temp\i_ecwuomgezw.exe
Size 243KB
SHA256 4b7e6e938fa0cbe0b932511b26c86cfd226f7924a71b5d8233c164af4e9f0d3f
MD5 7cdb49bc9970abdafe5ab34de02334c9
SHA1 0ad4f050ebf9227cfb444be2578e9b78f2552523
SHA512 2eb6608178f1b314e27c53b240f4a7d7a5cc78b0b62cd793c9128ec6b0e5f5e485fe71506400851f8ee1c4feabcc985dbfe996a30cc40f5ddfccef0e25fc2c8e
SSDEEP 3072:+hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:in7nLQka3lLNngoqRttA7k
TLSH
T18D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnlfd.exe

Path C:\Temp\i_lidbvtnlfd.exe
Size 243KB
SHA256 09602a03c09d72084748f819c31195901f25bbe0f795a6b05d488dc55dbd9538
MD5 b1c606f5cafc0e900b6af8d0c30d4e66
SHA1 fd20bc53571784e5470575c1e1bccc018dea9830
SHA512 c29f38eb1113404a8aaa40316ebb074f0d08c781f6fcf1d32e5a278931a1091db70b5bd8711aa8ba768687af5780c7c7e21bc6b43112547d1391b4bb60d8c922
SSDEEP 3072:khn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:0n7nLQka3lLNngoqRttA7e
TLSH
T1EA34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbztrljd.exe

Path C:\Temp\i_ojgbztrljd.exe
Size 243KB
SHA256 886fb4192a76c46d8ba48983717b8745360d3368e0e3c654168561e9a530fe92
MD5 906384b89edb3237a4e382d934d25e7f
SHA1 3225039ca7705b6971ed18c1dd9550f1fa8c5c80
SHA512 82250c762f73db2b9e183089b4d3399a8eede9b1defea02541db85f33283dec8e0c846fb330084d3f4aa6861e6ff28b0a7cfe8f26d48a733cf84cb0b25a5737d
SSDEEP 3072:Phn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:5n7nLQka3lLNngoqRttA7J
TLSH
T14B34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnicxvpnh.exe

Path C:\Temp\i_vpnicxvpnh.exe
Size 243KB
SHA256 e1788d7eb3392ea44c6c92686e22ebe4f2205a387dbacabe02aebf2ae2e95422
MD5 14fadf31e5abf909e97e4a05b141a46f
SHA1 4088a5cde7987b4d2f074e730ea92b3ea3fb4a85
SHA512 6cf86081aa4075bcb83e441b2025bd08b12a6c0ce8abef9e89ce6de1b8ca9d398980f86dba45c8d4c961a1517aa07c44c24280b58f510db72342b3b6d9d27f95
SSDEEP 3072:Jhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:Hn7nLQka3lLNngoqRttA7r
TLSH
T1FA34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaytq.exe

Path C:\Temp\i_yvqoigaytq.exe
Size 243KB
SHA256 1c1f69a3733a270d3ae4ff3c08d4f824b205ad13eb7db45a0a50196710eeabb8
MD5 2c2cabc385524dfdd81a5a9191342df5
SHA1 4e4602577736e0d097b7e71f07008d2d69fbf5f0
SHA512 39ce954c047c29167cfd874c6b7979e86c645e9de2bc4ac6bbaa5ff95a78d0d8e463964f8d1648c8afbc0e25dc3d18cfa6eb5ef15b5930a72de788733eb62ec5
SSDEEP 3072:5hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:3n7nLQka3lLNngoqRttA7H
TLSH
T15234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytrljdb.sys

Path C:\Temp\igbytrljdb.sys
Size 141KB
SHA256 909f8f55fef825cef209179570a7d9bbb1ba9de0a2c2c1c0e03913d32c81c5e1
MD5 b7b0d78da85a814bba83784e2b5794b4
SHA1 e3bd7dd4c3aa0936a33a389882191d42bc53bef7
SHA512 1c6129f41f76624c2c5abb3e1dcf919c37a21a0d0b5e8b47abb33282a52db0091c41b9f54b1e35678e660915ab291715221dde9b6539232c99f18201cd538fcd
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjec.sys

Path C:\Temp\jhbztrmjec.sys
Size 141KB
SHA256 4120832a92141741b9a8e681e9c722145333a6564690e83af34082095745005c
MD5 20aecc363e7b930a390dfaa907ce9147
SHA1 26308f336474960598a87103020edda8ab8d540e
SHA512 a07c2a4261d676d3529cb7d7c5d02e1586b861a07a7251dc3f64332b34d9ab6c69d21fdb056334b4397ca7770bd7c545d2a887aa978dd901cc194e453c5bfec4
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfd.sys

Path C:\Temp\kicavsnlfd.sys
Size 141KB
SHA256 14ead312be5422c3cd54e3994225904f17fcaa4f3b400784e94cea07ab2e54c6
MD5 f7516f81a098e9a3d6cd9adc40da70c9
SHA1 fde2e5e9fd54860f547d760765d5017447c12614
SHA512 8450378e4ef145c418314b2b6dfc3d5e98c002003c424337bf0745f69ccb63eb32c957174e4eb73b23e838e73b0ccdde6755f0b850271392ee83f598b4725128
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.exe

Path C:\Temp\lidbvtnlfd.exe
Size 243KB
SHA256 13809aad413016059b2501778870048bcfc7e206848fcc797a0500cb45b3fc2b
MD5 48d9bda8b01acd0ccbfc4e67144461ed
SHA1 629491de2357eadd9c93372d91a1e3a477a9d909
SHA512 c4db7f8acdd26c01432bd5fd681466e31854b5ec29ea4b35ab49e2a35a0ed6ce7d81c04bcf30c0b96092b76dd93b638fe68031c8efc3a72d6b8fa922407293e6
SSDEEP 3072:phn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:nn7nLQka3lLNngoqRttA7/
TLSH
T17334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.exe

Path C:\Temp\ojgbztrljd.exe
Size 243KB
SHA256 7d3f57f96dbe46e17992d659992d6be87f1225b8b80e5e02c6f459d6fdd1b041
MD5 c44d1fdcd34cb5a37b9d51199d26f101
SHA1 6f1d4fe987346824b9dbf6b81128977c31fac9f1
SHA512 b61312c627d7352e7f6ccc431694a19c792fc951d47049ed04c600a9bbe80f4484f41fdd5b66f2b6d255cbd77ce451b3e38b4591cdee3b852af0b0ee482e3ded
SSDEEP 3072:thn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:zn7nLQka3lLNngoqRttA7j
TLSH
T1D734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnicxvpnh.exe

Path C:\Temp\vpnicxvpnh.exe
Size 243KB
SHA256 a45de521d04fac56c0c8b936531c06bcb946ea3bc727ed95f6d28a1045813f60
MD5 3068afc91e228cc8dfd9b6be2f3a55c0
SHA1 23ff4f261eb1a6454b28da7aec902960f5574a02
SHA512 c7ada75f8f77635cbbeb00a4825fbe51582d1deda8e066c66d9a082e94af05c9789f691e120e174674628825edb3e3d2a31f39b6799085f8b4d9a4f1cb5d3c78
SSDEEP 3072:Ghn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:an7nLQka3lLNngoqRttA7I
TLSH
T17734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytrl.sys

Path C:\Temp\wqoigbytrl.sys
Size 141KB
SHA256 e69a52b88a256d55703f3a55bc9f34742f0e8701acc537fa27f3514a9fcc44bf
MD5 872679c386f318cc79170fc12f7c42b0
SHA1 03ab5003e5b6021620b4432d1a228ad58e1e1eaf
SHA512 b954d12ad7c33aac151cc52b6a40c23b8849de7e71caa491411e530d49bd8a7041c2a91ed29bdeadfa4a4dec72448343c770ebd3bbd4177ecebd3457cf755f32
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 141KB
SHA256 66a873c3fb47612dd81c446b5292c769cd0ed455118153154de7ee61107a88b2
MD5 c6156a68c934a64ae3e7c8a8eb53ff0f
SHA1 94b0b0c846ccb07c5c1abca8ae6d8cd66284272e
SHA512 933ab98ec60c92bcccc03ef2d71e4df039117ba326c9be6e9e9dce997c6caebed94e6d15df2c490f2a36092e1bd3b168d14ca9a3323bdce7b8300dc0c0100f87
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaytq.exe

Path C:\Temp\yvqoigaytq.exe
Size 243KB
SHA256 7ceb7e043ad73f2a0decedd11570fd0589ec0d3b20c5fd06080b7c9409272f2f
MD5 ffd83b3599032fb2314abc4681318c38
SHA1 0957ec14eaf479e6bbed64747bcec9a01ab898dd
SHA512 cccd68bfd950a08dbdbb290a3093269dd696631de4ffeb33df5cb9e9afce311893f1704bf99a55a19731bc4ffed0bb0adbd63d913098aadf3eeb761ecf6ac23f
SSDEEP 3072:jhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:1n7nLQka3lLNngoqRttA7J
TLSH
T18F34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 5ceb8021c1cbf290165ab01c3d9bedfca1c6a914f4b9ee921b471836f056bfde
MD5 b52dea6c890dc3d28d6e677af38e17b4
SHA1 ed7dcf52509b3ca3be045f42b607a3d34ef1f0ce
SHA512 9c3c22f351a46fc69633ba440a2d734cd06aab595f5b30932c675e850829125a5758a308e852cf6e72aca4a321c7aecbf25ba32c13d68e9d443fbd74837a12bc
TLSH
T14EF0DC8ED07EFCB14E42D9EC285C172C2E20E47508A42863213449E2873C3FB6DA9029
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 742daa20ee68eafb41f26a1e6944681cd045966a0870112efb93c0c68b378a13
MD5 9612a5add999420d132d9e3f4bf1e401
SHA1 843bc05336d9e894179680bd099bd5855fd37ce8
SHA512 e85a9f7341536813f0d4aaa7f9330bd716bc268d8598295c59d0e4bcb145756be22119e05e3d2effe981b728dad49de211fa2b3aa3b99485e283cf044769f1ae
TLSH
T1EFE0C03821FA411FE4E4D03C47C5742798BAF023152893B43DD48B04FB066009C03A39
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG9UOCZZ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/892-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1940-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2344-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2380-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3264-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3848-68-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-92-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3948-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4080-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4356-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4808-80-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-54-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads