208dd5514ca03c5daed59336d4e2b009b66e07d3db75f8ae45a857e7d8d82b80

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
Size 243KB
Sample261023-vs87jscy4s
SHA256 208dd5514ca03c5daed59336d4e2b009b66e07d3db75f8ae45a857e7d8d82b80
MD5 dc3ddb893bad4b27a8dcd475329ae6fa
SHA1 cf86f3199ce54a8096f4e78ae6e01d31a55880b0
SHA512 acb4a78284b845c6166c9dfd9d83cfd79038d635cd64343a68668ae38331d07faf4a980a3a7641ccb20fca9e326de232de09c427fb5547a919162b0831318ccb
SSDEEP 3072:zX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:bLhhLkQa3lLNngoqRttA7d
TLSH
T145345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1976	CP.exe
5112	gbytrljdyt.exe
1436	CP.exe
452	CP.exe
3652	i_gbytrljdyt.exe
1676	olgdywqoig.sys
4260	CP.exe
1360	ytnlgdyvqo.exe
4420	CP.exe
4912	CP.exe
4396	i_ytnlgdyvqo.exe
4428	dbvqnigays.sys
2648	CP.exe
2036	sqkidavtnl.exe
3400	CP.exe
4320	CP.exe
780	i_sqkidavtnl.exe
4020	snlfdxvpni.sys
1240	CP.exe
820	ifaxsnkfdx.exe
3488	CP.exe
5028	CP.exe
3204	i_ifaxsnkfdx.exe
1332	hfzxspkica.sys
920	CP.exe
3124	ausmkecxup.exe
4952	CP.exe
4588	CP.exe
3652	i_ausmkecxup.exe
3784	causmkecxu.sys
4564	CP.exe
4852	mkecxupnhf.exe
3128	CP.exe
4760	CP.exe
2352	i_mkecxupnhf.exe
4620	pmhfzxrpjh.sys
2876	CP.exe
724	hbzurmkecw.exe
4276	CP.exe
3852	CP.exe
4216	i_hbzurmkecw.exe
2180	eztrmjebwu.sys
2984	CP.exe
4860	uomgeywroj.exe
3044	CP.exe
640	CP.exe
1048	i_uomgeywroj.exe
3104	tolgeywqoj.sys
4956	CP.exe
1228	mgeywrojgb.exe
3476	CP.exe
2000	CP.exe
1948	i_mgeywrojgb.exe
4188	wtomgeywqo.sys
1632	CP.exe
5080	dyvqoigayt.exe
2640	CP.exe
1324	CP.exe
1924	i_dyvqoigayt.exe
3516	lidbvtnlfd.sys
1988	CP.exe
3788	dyvqnigayt.exe
4444	CP.exe
3308	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojebwuom.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4604	ipconfig.exe
4792	ipconfig.exe
4872	ipconfig.exe
3204	ipconfig.exe
2484	ipconfig.exe
4352	ipconfig.exe
364	ipconfig.exe
4448	ipconfig.exe
1664	ipconfig.exe
3484	ipconfig.exe
3768	ipconfig.exe
1332	ipconfig.exe
1352	ipconfig.exe
2744	ipconfig.exe
4888	ipconfig.exe
3616	ipconfig.exe
3452	ipconfig.exe
4880	ipconfig.exe
4896	ipconfig.exe
4672	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1255146027"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286034"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02aeaac1a63dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c300000000020000000000106600000001000020000000039fb705b7f3c42518e8a008308a83616acef71d131288dc1cbb0653d1b64564000000000e8000000002000020000000b934c774dee2000c6ff0e462d5674dea608e5d8bc6d48727482d271a81f4d03120000000b458e6686680ff235da8ae20cc54d748c30fe69103232c7e1b22099a6e858ffe40000000c5799c6ffb82cb15d673769b8b17f45fda16a82bb72ca452417555171920342fe60c98f26dd382c5310918f777ee28dca2c6d88bb71e20921143239109151d41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1252021213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499540753"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c3000000000200000000001066000000010000200000004e01a28f22506b75fbe0625fe765e83d7cdf6f17a63996d6284db165efd313ab000000000e80000000020000200000003c12c2941b6cb1268530545755e1ede4a48e4d21be91e09f31c67eb0d5df635820000000963c092b9f94e239f10b93c2f2fd8002bc8364e26a370b16f98c412dce95444c4000000025dc64c8507d02a9058ac410041c78b5d073e0eabb331138402ae98c5e86df63bb4ed02512feb3d657983b322c8ecec83e3cc156fab1554b9acae9a4950b8cc8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e056f1ac1a63dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{75D950C8-CF05-11F1-A0CA-7E1CC8EA832A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286034"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	i_gbytrljdyt.exe
Token: SeDebugPrivilege	4396	i_ytnlgdyvqo.exe
Token: SeDebugPrivilege	780	i_sqkidavtnl.exe
Token: SeDebugPrivilege	3204	i_ifaxsnkfdx.exe
Token: SeDebugPrivilege	3652	i_ausmkecxup.exe
Token: SeDebugPrivilege	2352	i_mkecxupnhf.exe
Token: SeDebugPrivilege	4216	i_hbzurmkecw.exe
Token: SeDebugPrivilege	1048	i_uomgeywroj.exe
Token: SeDebugPrivilege	1948	i_mgeywrojgb.exe
Token: SeDebugPrivilege	1924	i_dyvqoigayt.exe
Token: SeDebugPrivilege	1512	i_dyvqnigayt.exe
Token: SeDebugPrivilege	3768	i_xsqkidavsn.exe
Token: SeDebugPrivilege	3936	i_qkicausnkf.exe
Token: SeDebugPrivilege	4720	i_hfzxspkhca.exe
Token: SeDebugPrivilege	5032	i_nhfzxrpkhc.exe
Token: SeDebugPrivilege	4788	i_cwuomgezwr.exe
Token: SeDebugPrivilege	3008	i_wrojebwuom.exe
Token: SeDebugPrivilege	3864	i_jdbwtolgey.exe
Token: SeDebugPrivilege	1708	i_ljdbvtolgd.exe
Token: SeDebugPrivilege	204	i_davsnlfdxv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 996	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	85
PID 996 wrote to memory of 1244	996	iexplore.exe	86
PID 3760 wrote to memory of 1976	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	87
PID 5112 wrote to memory of 1436	5112	gbytrljdyt.exe	90
PID 3760 wrote to memory of 452	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	97
PID 3760 wrote to memory of 4260	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	104
PID 1360 wrote to memory of 4420	1360	ytnlgdyvqo.exe	106
PID 3760 wrote to memory of 4912	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	109
PID 3760 wrote to memory of 2648	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	113
PID 2036 wrote to memory of 3400	2036	sqkidavtnl.exe	115
PID 3760 wrote to memory of 4320	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	118
PID 3760 wrote to memory of 1240	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	122
PID 820 wrote to memory of 3488	820	ifaxsnkfdx.exe	124
PID 3760 wrote to memory of 5028	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	127
PID 3760 wrote to memory of 920	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	133
PID 3124 wrote to memory of 4952	3124	ausmkecxup.exe	135
PID 3760 wrote to memory of 4588	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	138
PID 3760 wrote to memory of 4564	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	142
PID 4852 wrote to memory of 3128	4852	mkecxupnhf.exe	144
PID 3760 wrote to memory of 4760	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	147
PID 3760 wrote to memory of 2876	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	151
PID 724 wrote to memory of 4276	724	hbzurmkecw.exe	153
PID 3760 wrote to memory of 3852	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	156
PID 3760 wrote to memory of 2984	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	160
PID 4860 wrote to memory of 3044	4860	uomgeywroj.exe	162
PID 3760 wrote to memory of 640	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	165
PID 3760 wrote to memory of 4956	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	169
PID 1228 wrote to memory of 3476	1228	mgeywrojgb.exe	171
PID 3760 wrote to memory of 2000	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	174
PID 3760 wrote to memory of 1632	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	178
PID 5080 wrote to memory of 2640	5080	dyvqoigayt.exe	180
PID 3760 wrote to memory of 1324	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	183
PID 3760 wrote to memory of 1988	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	187
PID 3788 wrote to memory of 4444	3788	dyvqnigayt.exe	189
PID 3760 wrote to memory of 3308	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	192
PID 3760 wrote to memory of 3492	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	196
PID 4080 wrote to memory of 1352	4080	xsqkidavsn.exe	198
PID 3760 wrote to memory of 4804	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	201
PID 3760 wrote to memory of 636	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	205
PID 1048 wrote to memory of 4916	1048	qkicausnkf.exe	207
PID 3760 wrote to memory of 1396	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	210
PID 3760 wrote to memory of 4688	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	214
PID 3152 wrote to memory of 2688	3152	hfzxspkhca.exe	216
PID 3760 wrote to memory of 2500	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	219
PID 3760 wrote to memory of 3868	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	223
PID 1676 wrote to memory of 2840	1676	nhfzxrpkhc.exe	225
PID 3760 wrote to memory of 3236	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	228
PID 3760 wrote to memory of 2972	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	232
PID 760 wrote to memory of 848	760	cwuomgezwr.exe	234
PID 3760 wrote to memory of 2576	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	237
PID 3760 wrote to memory of 3080	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	241
PID 4232 wrote to memory of 4800	4232	wrojebwuom.exe	243
PID 3760 wrote to memory of 2832	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	246
PID 3760 wrote to memory of 4300	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	250
PID 3280 wrote to memory of 4020	3280	jdbwtolgey.exe	252
PID 3760 wrote to memory of 780	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	255
PID 3760 wrote to memory of 1620	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	259
PID 3656 wrote to memory of 4488	3656	ljdbvtolgd.exe	261
PID 3760 wrote to memory of 3204	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	264
PID 3760 wrote to memory of 2212	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	268
PID 4820 wrote to memory of 4840	4820	davsnlfdxv.exe	270
PID 3760 wrote to memory of 2604	3760	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdyt.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1976
- - C:\Temp\gbytrljdyt.exe
    C:\Temp\gbytrljdyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:452
- - C:\Temp\i_gbytrljdyt.exe
    C:\Temp\i_gbytrljdyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlgdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\ytnlgdyvqo.exe
    C:\Temp\ytnlgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytnlgdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_ytnlgdyvqo.exe
    C:\Temp\i_ytnlgdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2648
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1240
- - C:\Temp\ifaxsnkfdx.exe
    C:\Temp\ifaxsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\i_ifaxsnkfdx.exe
    C:\Temp\i_ifaxsnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:920
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4564
- - C:\Temp\mkecxupnhf.exe
    C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\i_mkecxupnhf.exe
    C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Temp\hbzurmkecw.exe
    C:\Temp\hbzurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3852
- - C:\Temp\i_hbzurmkecw.exe
    C:\Temp\i_hbzurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Temp\uomgeywroj.exe
    C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:640
- - C:\Temp\i_uomgeywroj.exe
    C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\mgeywrojgb.exe
    C:\Temp\mgeywrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_mgeywrojgb.exe
    C:\Temp\i_mgeywrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1632
- - C:\Temp\dyvqoigayt.exe
    C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\i_dyvqoigayt.exe
    C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\dyvqnigayt.exe
    C:\Temp\dyvqnigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\i_dyvqnigayt.exe
    C:\Temp\i_dyvqnigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkidavsn.exe ups_run
  2⤵
  PID:3492
- - C:\Temp\xsqkidavsn.exe
    C:\Temp\xsqkidavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkidavsn.exe ups_ins
  2⤵
  PID:4804
- - C:\Temp\i_xsqkidavsn.exe
    C:\Temp\i_xsqkidavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:636
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:1396
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  PID:4688
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  PID:2500
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:3868
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
  2⤵
  PID:3236
- - C:\Temp\i_nhfzxrpkhc.exe
    C:\Temp\i_nhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomgezwr.exe ups_run
  2⤵
  PID:2972
- - C:\Temp\cwuomgezwr.exe
    C:\Temp\cwuomgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomgezwr.exe ups_ins
  2⤵
  PID:2576
- - C:\Temp\i_cwuomgezwr.exe
    C:\Temp\i_cwuomgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojebwuom.exe ups_run
  2⤵
  PID:3080
- - C:\Temp\wrojebwuom.exe
    C:\Temp\wrojebwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojebwuom.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_wrojebwuom.exe
    C:\Temp\i_wrojebwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtolgey.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\jdbwtolgey.exe
    C:\Temp\jdbwtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtolgey.exe ups_ins
  2⤵
  PID:780
- - C:\Temp\i_jdbwtolgey.exe
    C:\Temp\i_jdbwtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolgd.exe ups_run
  2⤵
  PID:1620
- - C:\Temp\ljdbvtolgd.exe
    C:\Temp\ljdbvtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolgd.exe ups_ins
  2⤵
  PID:3204
- - C:\Temp\i_ljdbvtolgd.exe
    C:\Temp\i_ljdbvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdxv.exe ups_run
  2⤵
  PID:2212
- - C:\Temp\davsnlfdxv.exe
    C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdxv.exe ups_ins
  2⤵
  PID:2604
- - C:\Temp\i_davsnlfdxv.exe
    C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:1676

C:\Temp\dbvqnigays.sys
C:\Temp\dbvqnigays.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\snlfdxvpni.sys
C:\Temp\snlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
- Executes dropped EXE
PID:1332

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
- Executes dropped EXE
PID:3784

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\eztrmjebwu.sys
C:\Temp\eztrmjebwu.sys
1⤵
- Executes dropped EXE
PID:2180

C:\Temp\tolgeywqoj.sys
C:\Temp\tolgeywqoj.sys
1⤵
- Executes dropped EXE
PID:3104

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:3516

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
PID:4924

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
PID:4816

C:\Temp\aupnhfzxsp.sys
C:\Temp\aupnhfzxsp.sys
1⤵
PID:3204

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:4676

C:\Temp\mgezwrpjhb.sys
C:\Temp\mgezwrpjhb.sys
1⤵
PID:796

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
PID:3676

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
PID:4168

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:4224

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxup.exe

Path C:\Temp\ausmkecxup.exe
Size 243KB
SHA256 31a637b5294e0cf5ba0cbfc3b118abf20f9bf888bf2690bdc9c9709d22c57170
MD5 d1aec6ccbf23366e54fef13b1cecfbee
SHA1 86edb5f9797cd6a5eb3861fc41815933994a21a5
SHA512 d1e9ed118f1cdeef06f4fa28bd78fdaa0f9a67811364975cdbf7e530d184114b789fa03b5a59e183c34596e783df87233111aea5ff53e1b656d713ea555133f1
SSDEEP 3072:EX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:iLhhLkQa3lLNngoqRttA7G
TLSH
T10E345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecxu.sys

Path C:\Temp\causmkecxu.sys
Size 141KB
SHA256 9e59d80cdd2cc34371d4738e96f5b37b709063df25e568f77867ed6d37abbfab
MD5 095d15a8171e1260ee7e56dd939303db
SHA1 df5427be9a972700da38cc95688326c1fcf299f5
SHA512 b1e64328081281bc55ed2ec433740943b8e0dc2e25528b1aaef1a0085971e7a9b6f9a29da40d6c4b1fdbc462226e0cda2fb7fe3aa3d5002d22140be22f4ffff2
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T178E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvqnigays.sys

Path C:\Temp\dbvqnigays.sys
Size 141KB
SHA256 64745d0b437da72b8ce9f1217f85ccee7ee1528fd1db5d6e6729fcd1883d463b
MD5 2e896a4de03a49817d071ce4441c9343
SHA1 8cab4590dc4b0a2224c0c1b72e06d3674f5da685
SHA512 d3c16ef4a04adc1498797894cf14fd774d5dd426aa4110ece4ace379400303c28dadf1a10d4fdcca7ff54c39e3819ef8be7953092110d61077473b1103f435f1
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eztrmjebwu.sys

Path C:\Temp\eztrmjebwu.sys
Size 141KB
SHA256 1e5e237355413721f4e3f3b623e93f411a5f711ca15b37b077e10dabe61e05e9
MD5 ee68c4e9a4ef64e5d1ba9a5a178b20ea
SHA1 71b73adffeb96cf5de1cf8d0d345c569ff76ab1f
SHA512 e4833273dcce479557154ddf345a3c028ee368ce8346db076fee4ac9ca3b45c06485501e8af29b65752030642030f9ae588830990d927635e323a0f609c23f80
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdyt.exe

Path C:\Temp\gbytrljdyt.exe
Size 243KB
SHA256 1d0e448c834966a31042fd81d32330ece3a23bfcb37787ddbfa4cdc142a5b988
MD5 3b2541d9d6101e84a42dce3287ab2672
SHA1 7d0b28829cd74d120a40ad6fb803bacb181781f8
SHA512 c54a52fcf83a3a9fd7284e55440bb6ebd9b934155ed5d9e111ae5b2f79b3cd812f0c20d443785c77e6b4facbbc10e9df2486ed1a7b5e8430ccf3b1cfcced0c9b
SSDEEP 3072:MX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:qLhhLkQa3lLNngoqRttA7C
TLSH
T1D2345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkecw.exe

Path C:\Temp\hbzurmkecw.exe
Size 243KB
SHA256 a436be98c9a301758ea94d7806866e04eed13e31fbbb774c6e44eb94db5d2ee6
MD5 abeac4d5a3febf0a221f6ad9398b38d7
SHA1 54194beaa5dad39d5dcaf009aedb1e40c1e0c3f1
SHA512 8983b9ebbe37745e289f1d03ee8902ea8d8afc0bdc60b9ac6ae14b8e0e76163dcd5453325cd34450c5c73a400ab9c33f38c105499a895bd4d8bbe5d949348daf
SSDEEP 3072:xX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:JLhhLkQa3lLNngoqRttA73
TLSH
T1C1345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkica.sys

Path C:\Temp\hfzxspkica.sys
Size 141KB
SHA256 6bd4a3c0893e6c98851ca6b7476682550a371306766b435a1360d9f20e0e2a75
MD5 eb345556354dcd213c8bd9fca385577d
SHA1 94484284f53b242097ed100dfbfce4126f26e525
SHA512 8178f664e5503f5e1dc04e623d004386873e00afecdf0f822ee64f28a0cd2b45bba1a3692b8c8a7eb47d5580c54f0d8fad7256a0123e691a4d0d9d28090f4ef0
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkecxup.exe

Path C:\Temp\i_ausmkecxup.exe
Size 243KB
SHA256 9a5a80561c0889bb8bb6771e961d46ef6f3c474e8d387d342a76fc762fb819a5
MD5 67eedebd1b35e4a3fa4606bb093b0934
SHA1 e772a9efe3710fb9a4042d7323276186c7dfd175
SHA512 7c41cbb972e10c099bfd33b34385462172aa890d9312d593015713f0f3ba54ae3a50c684ad2c79949f54817fd6700bcbd6a1d1b837e594c7714165fff53bd61a
SSDEEP 3072:8X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:6LhhLkQa3lLNngoqRttA7a
TLSH
T1DA345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdyt.exe

Path C:\Temp\i_gbytrljdyt.exe
Size 243KB
SHA256 bf001574c6873aeab5bcf6324fb32cb51f56095bb053468aef40ca520092718a
MD5 d3b05424be615e18ba72fc583d8a2fe9
SHA1 a1c690a9fd2a9ae1fed0d7eddd871ea99e6c73d2
SHA512 3b4468fbe2cc46a682d3927482e6f99e5d29af812c7eab05bc3fe25d61acfd59d6e3e863793551f516001021848812af5215a96791e3ee23870c2a393b6ffc69
SSDEEP 3072:KX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:YLhhLkQa3lLNngoqRttA7M
TLSH
T1FA345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurmkecw.exe

Path C:\Temp\i_hbzurmkecw.exe
Size 243KB
SHA256 0b74ccbd0897126758e5e15bb59faf00e0613c29072ca6e47e4c31ae8b522216
MD5 029409b9d52607db97acacbab7fff4ea
SHA1 7a23dc8e87c626b2b37894fdf8f427ab2acc0044
SHA512 9190df3a0bd3120055393e1643c579c32032a051b4391c651b172d41774073e9c9b998a71789fa04178fa7be891fbfa7a86ad9492e91225fe62ce171ee0dcec3
SSDEEP 3072:hX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:ZLhhLkQa3lLNngoqRttA7/
TLSH
T1F5345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxsnkfdx.exe

Path C:\Temp\i_ifaxsnkfdx.exe
Size 243KB
SHA256 72e33c3631beca43263bf3ebcee384118f02beefeb66eebff253887463df1bd2
MD5 0d3e1b43d14204fa5140a8f6f41f704b
SHA1 f09bd65f982bec63a1213e747e160c42db7bac14
SHA512 6fcea82f1dc26852de4b37ad45efbef1cc12a1d6345b4a004e887458107a4611a316b075d41fd3a32f4a23e77200f31ab3aa9d9213ed12bd2fb712bca967e6a3
SSDEEP 3072:TX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:7LhhLkQa3lLNngoqRttA71
TLSH
T1B6345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxupnhf.exe

Path C:\Temp\i_mkecxupnhf.exe
Size 243KB
SHA256 cef9e774f53d564adfd287d49b6354204a7fcbae9784577ad17c4a1fdc785085
MD5 46c2108b0dcf626afb7d288baffb4c57
SHA1 764f72758a1dfd298d7829e06dadd6499a26b78a
SHA512 0b8a41a3aad5ca8716934af05c3f12f26b72289a2e322d95b0a7a63636197baba468a47af3e2da00be0afd3d6aa3761600e55e30f7070b83e622fbeee0013dbf
SSDEEP 3072:rX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:zLhhLkQa3lLNngoqRttA7x
TLSH
T168345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkidavtnl.exe

Path C:\Temp\i_sqkidavtnl.exe
Size 243KB
SHA256 4a18223191855783f259f2153f8e00c218f5bafbde468170d041fb516be0bb4a
MD5 c8aa7c3a301eac34191b1b7dab963e4a
SHA1 92f86c588cf32ed4b1776d30d07d95005737c695
SHA512 2f1c2fd9459f8954238d8f6fd1301c4bc68cb2cc63d63554ff0db096f257db0c247d3e9db2d34c43411a5505750601bc16b773c4c46432991847ea3fce4f67ac
SSDEEP 3072:AX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:GLhhLkQa3lLNngoqRttA7q
TLSH
T14D345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytnlgdyvqo.exe

Path C:\Temp\i_ytnlgdyvqo.exe
Size 243KB
SHA256 be6aa8c19a192dd0eb6b538e203da5456931c46289236d8ef18a3ba0e61bbb92
MD5 595c2fbce79cf175d0436c054d8d603f
SHA1 9d9940d9175220c7327ea50b1ac1d6d3d4eff3cd
SHA512 0261266ccc5ebdd4ea866b699162840f24bfa6bc372b6af738db499224787aa8751e0c067561219d7adf0022b188cbd7701f8080d131001458d8e9b93849f797
SSDEEP 3072:+X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:kLhhLkQa3lLNngoqRttA7I
TLSH
T100345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsnkfdx.exe

Path C:\Temp\ifaxsnkfdx.exe
Size 243KB
SHA256 b6e943deb2bc9b7bfa7c71b8a1fa62b35b7015a9943f45099c41942e5ae0d559
MD5 dbf6c5224568131f89b936379676fac2
SHA1 1be89f199aaedbd955d49e16c04fad07973274a5
SHA512 eef4272193c0beed57de58ee6d8928146acb6e4f1303655170494340fcf1adde69f087bd735eb1a14db6fe842ed75b3109f5842520ce15bce90904855deced9e
SSDEEP 3072:5X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:xLhhLkQa3lLNngoqRttA7P
TLSH
T197345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupnhf.exe

Path C:\Temp\mkecxupnhf.exe
Size 243KB
SHA256 95fc690959d5766be64b0c36542c708ae2c417ae1d5b7a9eeedeb7f32d1789db
MD5 c92cfdbd269a959ab44acefe288a727c
SHA1 0f7e11387b6730da272bdf350141325de817ef9a
SHA512 e2d0b5317594ed5ad0bd897f8e02e5b21e29420632f637e00b4f77d4cb740d154a77af878ec87314ac22d7dfdb1cb4ddd6322e1d628906360d7cff5601d6aec1
SSDEEP 3072:DX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:LLhhLkQa3lLNngoqRttA79
TLSH
T1CA345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 141KB
SHA256 446f4450c56d286eabe4ab5fde8e5785dc5c419c28a9384a2fba7b06cc0ebea8
MD5 dcf1701da0dd27fe8cb2dd9beca449f2
SHA1 9d959407a664f9a0b44cd2274fe18ab56a82b82b
SHA512 62bec2af6045831f62a7aa0b32dad1f5c4a26a07dcf4764275d63cba6d8b5a2fca2e4514af7d39fba8ac1e2884a7da638263cce28894a8bd27bbf8e8b706a588
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 e7d463d547e388b4c181fee22d2b70ee8c0f965b928d28e9a2b7efbb0faed1d1
MD5 d3e8e69bb293206a20e6d36a299fff32
SHA1 4095d900c8a55021913878fa2891a72332f5358f
SHA512 e107f5698c0ae8b80052abbf3ad8e0e3ce9aba09b3856cbf9ee5211757042aee22b434fa32c3bba84d0965163a85676838c809fad2ad6ebfcbd8adc73ef4f0f1
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.sys

Path C:\Temp\snlfdxvpni.sys
Size 141KB
SHA256 b1632bcaf4c27dcc3bbc4ce16dbde856e9cece13397d2373f9177d9779698412
MD5 8df723fea1c5365b9000d89ebb23f6eb
SHA1 f73ac1101e066a88ba8501b78eb94527215eee4d
SHA512 045e035ca11591b64896fb63cfa5dcd75913b1df73c7c3c0f1f1e1eea8c712554aec12e965930c5dec8bd7a0f87d92a9650de7d16bed959f07380cfb292d9fa7
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.exe

Path C:\Temp\sqkidavtnl.exe
Size 243KB
SHA256 b41a86e15e19beca22f9e411cbb0ba7117b17201bebd49c01e485740630083cb
MD5 fc574513c316a46ae2a85ce0b02966bd
SHA1 204901f611e98c84124bf1203ac233ccb1817380
SHA512 2df1ecc8f17da39f2166d55d229975cebf299c1f71881c6c33a14978db8440af9985c4f14f61ce5ce535051ec2e2c48a8e2583bb77def3cac3af151d1021b341
SSDEEP 3072:uX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:0LhhLkQa3lLNngoqRttA7s
TLSH
T136345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywroj.exe

Path C:\Temp\uomgeywroj.exe
Size 243KB
SHA256 7b6c2e166ecef0a39a13ded1efcbf4430c41aa48bf0351b9ba579c6d31469cb2
MD5 f3d6dc1f94f0dc5523634961e256dac1
SHA1 c98de2e13bb9ce23804efb8867dcadb1601bab0c
SHA512 cefa1a7654c429de036050a777930bc0a42ee5eae1bcee71b65e5fbd2bd28e5dc1cb25f7c7fb5609658875f5141d38af8981988d69bcf92899fdb82de22a0592
SSDEEP 3072:WX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:8LhhLkQa3lLNngoqRttA7E
TLSH
T1D7345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytnlgdyvqo.exe

Path C:\Temp\ytnlgdyvqo.exe
Size 243KB
SHA256 2fd5001ef39d96cd0be29da56b7b780a2511c6560df14c302c969bbd8611722d
MD5 8098b82e6f92278aa5f0b6756fff9664
SHA1 0c7fc8de5f225450c57c2472ece60467c673ceb2
SHA512 0dbb7113c1f2c7abd2372b8d78583d486821acbbde6ea42290d6aa8d2a49459177d2dba7d36b09a2dfcf86b7813b9dbf61047b788aa9622349808e28c39135e2
SSDEEP 3072:uX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:0LhhLkQa3lLNngoqRttA7M
TLSH
T13C345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 d316d9b8b9311267599b9f39ecd945ee9804a7ae0e1e7a1cc4fb4e71a5f23e97
MD5 99cd9f308186002165ff4f3268d911c6
SHA1 e29b1eef225e91b9303c103ff9c49b08e71eb0d9
SHA512 f65eabe5a3bbbc08392c5566354cffeb812f3da3106c2278e032dfadad7b4a776e6af4c846c52d61edec99a18464aab37809f7b10b2e85834fdd4fd47ca68b1d
TLSH
T1B7F0D4E3855FEE51DC7474CC55784709786132F310604012707C15A10079BBB2F8743B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 8edab9e7aaf917d35da572a01c1b58b56dafbf18b69f390a450f173a7e9a23d2
MD5 b754cedeb0ddf05ca0dddedf50fa5a98
SHA1 23a69468ee34d39c756fa70c7e83e5c024cc0e46
SHA512 4be837ca07c9e37cfb13cd507e099611b9c1f731a2030ad1db8351a930d21178c8d61277d0ab4cef2c7993be4bbdf8161a2cd2cb9995e84598f1304b32f18d8e
TLSH
T125E0C02412FA811FF4E4E4384BC5F4228559F1331529A3B46EC45B08E702740EC03A26
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FBHLEWR\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2180-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3204-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3516-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3676-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4020-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4168-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4676-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads