3fd00fe5136780af06e0b6d531364baef046028fb68e9af2f985bbdd192451e4

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
Size 243KB
Sample261024-1qdkrafh44
SHA256 3fd00fe5136780af06e0b6d531364baef046028fb68e9af2f985bbdd192451e4
MD5 0e1b981db347614d5a140d1ab4bb91f6
SHA1 62729aa9b483d8e4f78de898aed5bffcd673a444
SHA512 087a31a3e74bbcf815a2d131635653f2b205d6fd0a2423607b8d9ab6b637cbcaa0d06ec6bc1d46b1fae973f886dd0dcd7eacf012930ec01d6edd966b00fdf372
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:GvMsLaOa3lLNngoqRttA7A
TLSH
T1FC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1672	CP.exe
4632	qlidavlfav.exe
1660	CP.exe
4668	CP.exe
224	i_qlidavlfav.exe
1512	fdxvpnifay.sys
4292	CP.exe
5088	xsnkfdxvpn.exe
3440	CP.exe
1796	CP.exe
1188	i_xsnkfdxvpn.exe
1080	usnkfdxvpn.sys
4684	CP.exe
4328	nhfzxspkic.exe
1924	CP.exe
2752	CP.exe
1028	i_nhfzxspkic.exe
4500	kecxupnhfz.sys
4348	CP.exe
3088	zxrpjhczus.exe
3568	CP.exe
368	CP.exe
1324	i_zxrpjhczus.exe
2096	hbzurmkecw.sys
4420	CP.exe
4772	omgezwrojh.exe
3028	CP.exe
1204	CP.exe
4492	i_omgezwrojh.exe
2740	rmjebwuomg.sys
3100	CP.exe
3960	gezwrpjhbz.exe
4580	CP.exe
2000	CP.exe
1616	i_gezwrpjhbz.exe
1344	geywrojgbz.sys
4448	CP.exe
1892	ztrljdbwto.exe
1448	CP.exe
3068	CP.exe
1032	i_ztrljdbwto.exe
3384	vqoigaytql.sys
4088	CP.exe
1732	oigbytqlgd.exe
3428	CP.exe
2936	CP.exe
3824	i_oigbytqlgd.exe
2556	ytqlidbvtn.sys
2108	CP.exe
820	fdxvqnigay.exe
1920	CP.exe
2852	CP.exe
2500	i_fdxvqnigay.exe
1836	pnifaysqki.sys
5072	CP.exe
4948	igaysqkida.exe
3264	CP.exe
1400	CP.exe
912	i_igaysqkida.exe
2680	kicausnkfd.sys
1188	CP.exe
3860	cxvpnhfzxs.exe
3248	CP.exe
1504	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhcwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavlfav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavlfav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhcwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5040	ipconfig.exe
2028	ipconfig.exe
2200	ipconfig.exe
3824	ipconfig.exe
4284	ipconfig.exe
2496	ipconfig.exe
1172	ipconfig.exe
4956	ipconfig.exe
3036	ipconfig.exe
4472	ipconfig.exe
4588	ipconfig.exe
2236	ipconfig.exe
3504	ipconfig.exe
4240	ipconfig.exe
4052	ipconfig.exe
4768	ipconfig.exe
2352	ipconfig.exe
3720	ipconfig.exe
4140	ipconfig.exe
692	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286273"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FD49FA7D-CFF4-11F1-8007-E629188E6DFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f946340a64dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000007181d59b74d291be0d12cd12af3fb78f631fd2e9c2b949b17df6fd4fae4e99ac000000000e8000000002000020000000b15ac08d69383bfd88923d7ecece8662815b31c0642f53b2de1fade80caf4019200000000a0a0b819ab479448a2c0571d2212eb9b329fb482a60f67ec3446aaee10d394b40000000900794dbc11f9f05f2c69f7e3e2a5abd0190b79966043c8b9c8521425a40a9471f5d7069e9e0a302ccfe63b08c12896fb8fdcc959b8816694ec5a29b55df07f8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b44b340a64dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286273"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3524743918"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499643630"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000b7e25a63a4edd81dd67ddd4c6b080215cae60ffec73d09185afb928a87565522000000000e800000000200002000000077b9f5712ff369456af07f7366d77aceacdf4290d9a3fd2db4dd8980fb3d672820000000295ade02c5030da565d1572ed4805df995d40343219c354a13d51f9dd09bdffc40000000738a367c4409eacb5efa99903cb8c39da6577e8a8c01dba6be5ffa7e304b5312b5c44f26d9b3b5c0cec27e7c1bc237e384f8d323037a91fb98bb8402e1b316ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3524743918"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	i_qlidavlfav.exe
Token: SeDebugPrivilege	1188	i_xsnkfdxvpn.exe
Token: SeDebugPrivilege	1028	i_nhfzxspkic.exe
Token: SeDebugPrivilege	1324	i_zxrpjhczus.exe
Token: SeDebugPrivilege	4492	i_omgezwrojh.exe
Token: SeDebugPrivilege	1616	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	1032	i_ztrljdbwto.exe
Token: SeDebugPrivilege	3824	i_oigbytqlgd.exe
Token: SeDebugPrivilege	2500	i_fdxvqnigay.exe
Token: SeDebugPrivilege	912	i_igaysqkida.exe
Token: SeDebugPrivilege	4996	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	2348	i_ausmkecxup.exe
Token: SeDebugPrivilege	896	i_rmkecwuomh.exe
Token: SeDebugPrivilege	4868	i_rpjhcwuomh.exe
Token: SeDebugPrivilege	1092	i_ojhbztrlje.exe
Token: SeDebugPrivilege	4012	i_ytrljdbvto.exe
Token: SeDebugPrivilege	2892	i_vqoigaytql.exe
Token: SeDebugPrivilege	4336	i_xvqnifaysq.exe
Token: SeDebugPrivilege	4924	i_vpnifaysqk.exe
Token: SeDebugPrivilege	944	i_pkicausmkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3792	iexplore.exe
3792	iexplore.exe
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3792	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	86
PID 3792 wrote to memory of 748	3792	iexplore.exe	87
PID 2856 wrote to memory of 1672	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	90
PID 4632 wrote to memory of 1660	4632	qlidavlfav.exe	93
PID 2856 wrote to memory of 4668	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	98
PID 2856 wrote to memory of 4292	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	105
PID 5088 wrote to memory of 3440	5088	xsnkfdxvpn.exe	107
PID 2856 wrote to memory of 1796	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	110
PID 2856 wrote to memory of 4684	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	114
PID 4328 wrote to memory of 1924	4328	nhfzxspkic.exe	116
PID 2856 wrote to memory of 2752	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	119
PID 2856 wrote to memory of 4348	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	123
PID 3088 wrote to memory of 3568	3088	zxrpjhczus.exe	125
PID 2856 wrote to memory of 368	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	128
PID 2856 wrote to memory of 4420	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	133
PID 4772 wrote to memory of 3028	4772	omgezwrojh.exe	135
PID 2856 wrote to memory of 1204	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	139
PID 2856 wrote to memory of 3100	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	143
PID 3960 wrote to memory of 4580	3960	gezwrpjhbz.exe	145
PID 2856 wrote to memory of 2000	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	148
PID 2856 wrote to memory of 4448	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	152
PID 1892 wrote to memory of 1448	1892	ztrljdbwto.exe	154
PID 2856 wrote to memory of 3068	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	157
PID 2856 wrote to memory of 4088	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	161
PID 1732 wrote to memory of 3428	1732	oigbytqlgd.exe	163
PID 2856 wrote to memory of 2936	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	166
PID 2856 wrote to memory of 2108	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	170
PID 820 wrote to memory of 1920	820	fdxvqnigay.exe	172
PID 2856 wrote to memory of 2852	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	175
PID 2856 wrote to memory of 5072	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	179
PID 4948 wrote to memory of 3264	4948	igaysqkida.exe	181
PID 2856 wrote to memory of 1400	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	184
PID 2856 wrote to memory of 1188	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	188
PID 3860 wrote to memory of 3248	3860	cxvpnhfzxs.exe	190
PID 2856 wrote to memory of 1504	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	193
PID 2856 wrote to memory of 3508	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	197
PID 3964 wrote to memory of 2988	3964	ausmkecxup.exe	199
PID 2856 wrote to memory of 4628	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	202
PID 2856 wrote to memory of 4056	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	206
PID 4852 wrote to memory of 4212	4852	rmkecwuomh.exe	208
PID 2856 wrote to memory of 4220	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	211
PID 2856 wrote to memory of 1172	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	215
PID 3544 wrote to memory of 3924	3544	rpjhcwuomh.exe	217
PID 2856 wrote to memory of 3920	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	220
PID 2856 wrote to memory of 1124	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	224
PID 2236 wrote to memory of 1328	2236	ojhbztrlje.exe	226
PID 2856 wrote to memory of 1048	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	229
PID 2856 wrote to memory of 4380	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	233
PID 1120 wrote to memory of 1616	1120	ytrljdbvto.exe	235
PID 2856 wrote to memory of 3888	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	238
PID 2856 wrote to memory of 1032	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	242
PID 176 wrote to memory of 4596	176	vqoigaytql.exe	244
PID 2856 wrote to memory of 4500	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	247
PID 2856 wrote to memory of 5032	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	251
PID 5100 wrote to memory of 3420	5100	xvqnifaysq.exe	253
PID 2856 wrote to memory of 3656	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	256
PID 2856 wrote to memory of 824	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	260
PID 3504 wrote to memory of 4676	3504	vpnifaysqk.exe	262
PID 2856 wrote to memory of 4472	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	265
PID 2856 wrote to memory of 1904	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	269
PID 2568 wrote to memory of 3408	2568	pkicausmkf.exe	271
PID 2856 wrote to memory of 996	2856	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3792 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidavlfav.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1672
- - C:\Temp\qlidavlfav.exe
    C:\Temp\qlidavlfav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidavlfav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\i_qlidavlfav.exe
    C:\Temp\i_qlidavlfav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsnkfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4292
- - C:\Temp\xsnkfdxvpn.exe
    C:\Temp\xsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsnkfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1796
- - C:\Temp\i_xsnkfdxvpn.exe
    C:\Temp\i_xsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2752
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:368
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\omgezwrojh.exe
    C:\Temp\omgezwrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1204
- - C:\Temp\i_omgezwrojh.exe
    C:\Temp\i_omgezwrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\gezwrpjhbz.exe
    C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_gezwrpjhbz.exe
    C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytqlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4088
- - C:\Temp\oigbytqlgd.exe
    C:\Temp\oigbytqlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytqlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\i_oigbytqlgd.exe
    C:\Temp\i_oigbytqlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\cxvpnhfzxs.exe
    C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Temp\i_cxvpnhfzxs.exe
    C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:3508
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:4628
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run
  2⤵
  PID:4056
- - C:\Temp\rmkecwuomh.exe
    C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins
  2⤵
  PID:4220
- - C:\Temp\i_rmkecwuomh.exe
    C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhcwuomh.exe ups_run
  2⤵
  PID:1172
- - C:\Temp\rpjhcwuomh.exe
    C:\Temp\rpjhcwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhcwuomh.exe ups_ins
  2⤵
  PID:3920
- - C:\Temp\i_rpjhcwuomh.exe
    C:\Temp\i_rpjhcwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:1124
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:1048
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run
  2⤵
  PID:4380
- - C:\Temp\ytrljdbvto.exe
    C:\Temp\ytrljdbvto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins
  2⤵
  PID:3888
- - C:\Temp\i_ytrljdbvto.exe
    C:\Temp\i_ytrljdbvto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run
  2⤵
  PID:1032
- - C:\Temp\vqoigaytql.exe
    C:\Temp\vqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins
  2⤵
  PID:4500
- - C:\Temp\i_vqoigaytql.exe
    C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnifaysq.exe ups_run
  2⤵
  PID:5032
- - C:\Temp\xvqnifaysq.exe
    C:\Temp\xvqnifaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnifaysq.exe ups_ins
  2⤵
  PID:3656
- - C:\Temp\i_xvqnifaysq.exe
    C:\Temp\i_xvqnifaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaysqk.exe ups_run
  2⤵
  PID:824
- - C:\Temp\vpnifaysqk.exe
    C:\Temp\vpnifaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaysqk.exe ups_ins
  2⤵
  PID:4472
- - C:\Temp\i_vpnifaysqk.exe
    C:\Temp\i_vpnifaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  PID:1904
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  PID:996
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
- Executes dropped EXE
PID:1512

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:1080

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
- Executes dropped EXE
PID:2096

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
- Executes dropped EXE
PID:2740

C:\Temp\geywrojgbz.sys
C:\Temp\geywrojgbz.sys
1⤵
- Executes dropped EXE
PID:1344

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\pnifaysqki.sys
C:\Temp\pnifaysqki.sys
1⤵
- Executes dropped EXE
PID:1836

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\pfzxspkhca.sys
C:\Temp\pfzxspkhca.sys
1⤵
PID:3820

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
PID:5032

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:536

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
PID:3748

C:\Temp\ywrojytrlj.sys
C:\Temp\ywrojytrlj.sys
1⤵
PID:2056

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
PID:3008

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
PID:4976

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
PID:3144

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.sys

Path C:\Temp\fdxvpnifay.sys
Size 141KB
SHA256 489a55583422481ccc5db6ba75e243929db733a78593dc16d0683d9f82a67a5a
MD5 400c21476e6b6a17805dd0009bc60868
SHA1 0d16b5747f36b15534a7ea81a1a02d80cd34cef8
SHA512 02d6545fa12695322081b0945872f0a65971232cd5a6dd0f7470b93f7ab075f4b39e96d866a8d8f9c752a76fa933fbc91cc2dd101bd275f9fbc7abdf7d5dd940
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojgbz.sys

Path C:\Temp\geywrojgbz.sys
Size 141KB
SHA256 b56dfc69684445b6c820a6711f02ae00777b0c28f99d6c9a67744a62f58d2d34
MD5 a7a2e769d15634698408ef0081f2b561
SHA1 41b09a0613342dbd5b82b20fe3395b24e794a55e
SHA512 eb1df7f02f69a2dd8b1af9f63850036d30ab8536ba05c7a1549528e0c3fc1301a678db625af89b482a73bd98695e05dfe446f8a618df189f85c63d8c746e39ba
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbz.exe

Path C:\Temp\gezwrpjhbz.exe
Size 243KB
SHA256 c87a5d9cfdfa975f5116b95353ec33819bc7967716383bd5cb209e1bf47cb27f
MD5 6dfe70dca86863f87d6e054b6b235367
SHA1 e8aabe93348cc7ecb90530cd7722d6241f98db24
SHA512 f4613a3466de1fe40a0b97bfac4e0446fd79b965f93aa8d30ccefd038708e576dbc963bd0a7e893a89804ef1590e97f56c6deb3155309d837f1fbf10debfea24
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:1vMsLaOa3lLNngoqRttA7R
TLSH
T18B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkecw.sys

Path C:\Temp\hbzurmkecw.sys
Size 141KB
SHA256 18c3aa2acebcfefb4dc01c7c9b0ae19b72d449977b84feaad663764461d93efc
MD5 259444138ee68f80e047aa6d64d40cd1
SHA1 73a3ff3c4ba05193bb0229d6e2c38a12e8c3a05f
SHA512 cf77fe5caa18b0c8eac81fe4847ce69c293c796658327da946400c3856ff3f80aaa50b12f8142a10985e8e2151504f2483ef6cd679125112cebf9acfb643bc4e
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T119E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwrpjhbz.exe

Path C:\Temp\i_gezwrpjhbz.exe
Size 243KB
SHA256 85185d05e9391cc1a2fa47379daaccbd64ba5940de9e033daabc96902d80e0b8
MD5 6bf17db07227ffe6c2c8274174c02ec2
SHA1 6482c2dfb1569a6704ef4c644d5806525b94acf8
SHA512 bc4f9ea95f98c141ed5719ae623d79c4620dcd01cc773a2c534f7d0c4a5e5ec290ac5560849a3954befd86d677208cd377c73972ae6fd8e82fdea8086d22b948
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:cvMsLaOa3lLNngoqRttA7y
TLSH
T122345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 243KB
SHA256 94a6a98e9bb91fca6a7be4ce65af8432d7068728102301de199102ba6a3d785c
MD5 45dc764d46474f32a2c8effb67db74c9
SHA1 daf2fd8f5ed82753739f74a2705f30f47535b43f
SHA512 f9c27bf1f4d8c6feb63beb97b37d85ccd0f4038dcfbebe694e693b5420c25f5a3b10c0b2c6733fa66f865f5611b2162e1950f98ae6f297c3b7acfb04d295678a
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:3vMsLaOa3lLNngoqRttA7n
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrojh.exe

Path C:\Temp\i_omgezwrojh.exe
Size 243KB
SHA256 7be664518743b8e24c42e40021cca4fd0f81151512e03b13cec98266d366ab3c
MD5 a10f451d9a494d0e7531c0283e1d1c21
SHA1 348d22a3694b84d3475a52f96544c647c6c81b5d
SHA512 8b1b04eab2fe50e73642855e307cb1a217adecd21e17807f05d3d8d9060101e79ce5810823b3063cc4117ea8d6aff26728687aa3f37fa10633c4b0bfbe0794b2
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:SvMsLaOa3lLNngoqRttA7A
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidavlfav.exe

Path C:\Temp\i_qlidavlfav.exe
Size 243KB
SHA256 b5d2d881ad04b72577eae4db761711edc6dc6369f858ff35574cb5458a7ec4ef
MD5 9973f3e8aea47fec01079d02f5feeef9
SHA1 ddd4c1531d976fb485912f742510c87fb8de920a
SHA512 28825408834595a7fc22dfa5e8288db01381925d06f21384de3b3d91cd55fec1e9415c6a31fac253bd595c570159a50210f36e5abc2c57f1124fbb78633a92b2
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:dvMsLaOa3lLNngoqRttA7J
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsnkfdxvpn.exe

Path C:\Temp\i_xsnkfdxvpn.exe
Size 243KB
SHA256 db21bc891ad8b42d70f37ce7023743c6ef1eeccd286ecad25a54b1702ef3c05e
MD5 85e30a434183be127e4eb13c8145f55d
SHA1 1590cace6c6d362f3e58f05925b291ada13eb182
SHA512 b8d7a95518768ff7f85444a4e9b4d9734ab38c38894117ef4cdf54d3603c57c63d81704a7baa39a0012849c63bff243a65c656479e84329715389ab6e92bb6fc
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:+vMsLaOa3lLNngoqRttA78
TLSH
T181345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljdbwto.exe

Path C:\Temp\i_ztrljdbwto.exe
Size 243KB
SHA256 daedef679bd4752ccbbc8a7235f541be3eef277b3b25dacec003b0b586be27bd
MD5 6f552f4382a2372919fc4bc44894bf89
SHA1 871b5e077ef046e160dd290d32747f0f3d5b64ad
SHA512 dbd5bf6b8cd0fddcd11f895df0681ee65f6b3b0daeb3943306e5835620bcd5dfe97fc51f2b815f4e9c51515891a19ae4e274193da0b2acf703342b4a325cf5d4
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:GvMsLaOa3lLNngoqRttA7k
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczus.exe

Path C:\Temp\i_zxrpjhczus.exe
Size 243KB
SHA256 c3e4e81d44c3abdd980ec09b346e533bf44c5b5fccd08fcf241356dd5bdf8e52
MD5 f49972551e6f11caf0522c1a59ec8a00
SHA1 e52a1bfab37ac41b95abee3ca198c726c9f314ed
SHA512 b53c9091a564d9305fbf99386b32e3d5c01b22862bac98fa25c1fa73376104fc187c0208b474a2540ecac40e071469a683216c9017748cbca0b138d66ed72563
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:BvMsLaOa3lLNngoqRttA7p
TLSH
T1F7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfz.sys

Path C:\Temp\kecxupnhfz.sys
Size 141KB
SHA256 b6f923785811d4b49a6673a284da4d3d10b64170de2f2780321f5ff43bfdf4b8
MD5 587ca495356b51d7c5f377e164f847d6
SHA1 68cd07f10a45bd60e0a00390655fa477e8b46cfb
SHA512 47f391aa71dd0f535a21567abdb33935e0cfb25aa0224c318896d23fba47c153b0f5b92472f7858038d6655a58475020141179b42be937c8dfad4595e81a174c
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 1cead78e1cfee2ab5744abd8762829a218c2c71861c6cba324c1ff5aa257245b
MD5 2df704ac55cc82e528170aa556f1e8fb
SHA1 db766b0956d98723753085c14af494acb41d19cc
SHA512 0e69acd5bfffa0ff3ec1507d79b278925003619ad6c104ff05bcf3b02020670367579209eb61309112eac730648b96fa5ba82f92f3d4e14ae96dcbbf2bce844a
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:1vMsLaOa3lLNngoqRttA7Z
TLSH
T1E4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytqlgd.exe

Path C:\Temp\oigbytqlgd.exe
Size 243KB
SHA256 c6bfbb97e8906583d0e57bdbd58c2b47882889d397e9a7adcc86b5906f829707
MD5 07914f4e653785e6894bfb7218005078
SHA1 6b49395d312604316d489174fb89a6db02c8a8c5
SHA512 49659f928868dd02de4c575f2634a6777207c1ccb52e30842a463564d03f81766b2bdb54c354b3178f7f3c474c490591f54cff011c6c7ad25535a72cb6880042
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:hvMsLaOa3lLNngoqRttA7h
TLSH
T184345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrojh.exe

Path C:\Temp\omgezwrojh.exe
Size 243KB
SHA256 cc2b5dd45beedca7fae4e19623c8a9f29cd672937d8495c05b01004831709359
MD5 ba20806a2aeb6a26cfde263b9dfc132f
SHA1 00f945d55ee214c7ece136368977ffd96cae96c3
SHA512 553a38d28e45b4657902cb80a0764d6fe4ed17bc976ecd821e2cef37ad6ab7bed31509df7bb691e60c98d9d546f35a665c8c11346ae179c080cc79ea227e84ca
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:TvMsLaOa3lLNngoqRttA7/
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidavlfav.exe

Path C:\Temp\qlidavlfav.exe
Size 243KB
SHA256 53e226ec9f58f08224ba25fe6a24e94893ffea466264b4196c090f19b151fdb3
MD5 390c3c470997e161467c7d0fe63b0b22
SHA1 30d989fd023344a25f66e2a55ab6a0ef4366f132
SHA512 aab4d787ecbe5d385c8daa770b058c2fffaaada2d3ef4bc2d10d19d5ebbdce746583bd0620ba89b3e9c1eb74c119993567196097f9b2b7a6268dd92c4430c3e6
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:2vMsLaOa3lLNngoqRttA7g
TLSH
T18E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebwuomg.sys

Path C:\Temp\rmjebwuomg.sys
Size 141KB
SHA256 a18d451c0a2561a93ae9f7a2a896f4c0b087d348842af96d3c48324d8a9d5fa6
MD5 36860ac5177a290996e4658b2c4186af
SHA1 59bedff029a20e8233711e42c3d8c26cbfaea1e1
SHA512 744eb46a9f08c5dc5f9a7e0ab8e412987d4578aa77f9f3c14da18cec24891deb96ca304a7d450e060b75ba0d1c5364c421db79741a1d35ae8a8f05e68db6a0b0
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfdxvpn.sys

Path C:\Temp\usnkfdxvpn.sys
Size 141KB
SHA256 c9f3dbc386021bdfe80e8edfd13c1d63f6cc601333c397c8bb985c5a6ff3fb3a
MD5 c9794aa225d260ad2abca63c520864f0
SHA1 237fa64e5a15d708363693f04f7db434d4f04eda
SHA512 07371964c42d080161f784d0c286d4d24c0b9a72e89f3149a0cbac344a92c6322074b7f85becd71a860da17de93213947b166ec1833b419353a2233d9c6e2a26
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytql.sys

Path C:\Temp\vqoigaytql.sys
Size 141KB
SHA256 356a77723b11f4c9a59cac25b61b97a91ee0542ff7d8a30f944f75e969f5b754
MD5 61136d483048d686bc609ac912c4e08a
SHA1 6d89ef371bd8241d967aa0ef06268bd978fa614d
SHA512 1bcb9000c9fe1c9183443ca206a6c0d8d2e2527dbffd11bc936d0982c16e805b5cf4dce10dfbc84139ee46f8409f8d926ae9f2ec5e528219c53c8c54fe799d66
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsnkfdxvpn.exe

Path C:\Temp\xsnkfdxvpn.exe
Size 243KB
SHA256 3877351254d0e6bae4a59d9d18b0ec2b7b7e7612ee20cbe793111fc50dc3fba1
MD5 bdaeb19f2ae84920538a0fc6694e0629
SHA1 a1100e5679fc8574801032651c5273c6067f9b83
SHA512 3489c1e7411b1b80c284c08d214825896228714dde129de303f742b1aacf01c068b3a7c3a0654d119d53a2977495a24dc5735a4067da744aa7c9d05ffbff449f
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:DvMsLaOa3lLNngoqRttA7H
TLSH
T1AC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.exe

Path C:\Temp\ztrljdbwto.exe
Size 243KB
SHA256 f0a908f389251a3e86424fc06b1bbd4451e8cd1f24c09eab0a1869ec56c65d20
MD5 00d2503d0245242ee542affd2545b4af
SHA1 6d872fd29fcf44005624b0e12d23493ef7c964b3
SHA512 7d562aa6a3241b0483a5070dd0adec931a1d4c445630745964f72e42dd41637aa2dd101a74b49cdcf44378c18b2fe4270572a4cfd1112f4bad594e65f73191dd
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:3vMsLaOa3lLNngoqRttA77
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczus.exe

Path C:\Temp\zxrpjhczus.exe
Size 243KB
SHA256 bc075690fa02406edc030adbea2d33d9688cd8194bdec621dd700e57c6713fda
MD5 8e5092a6f855150f91c8e2e509dbe0a7
SHA1 977d75acabc0d7b7c313ebf5a05d63181bab274a
SHA512 9c33012f09c279ba682de9f553f1c148b0daf112ddcc87000de9ccffaaa67a206e3558e854443a1a57b124cad6631a44d2c1703061d20d81c44dfad130ba02df
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:NvMsLaOa3lLNngoqRttA7R
TLSH
T11B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a0c8eabb811f397a4ec0c268f14ca958ee51a5805d8ac5d32cf6faebcb84af8e
MD5 1510d0872d9eb002ce814a01fdb5b46d
SHA1 0648e076c9a94cbbe6740b79363e1408c9be7ea5
SHA512 c83591089acae1cbebf54df2958108525a270b510bd68f5a5fe2d1a3f33276e30008edd1667703a4f2d361399ea92b345e040253d1bfa5f9b70d4bcb7ce69006
TLSH
T1ADF054AA80DCF8B29CC888E80BE98359786CF9F91402910D907C18F5004332D7FBC431
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c6f368bb86b78ab03b04caae2a779db1569e6f66f7c9559a4a751b36704c600c
MD5 dee13fc95bb7a5218d26938ea96f1fdc
SHA1 c6468e9b05b6e29b28a519672fc32a6f06564a98
SHA512 fa1a7a36bf057311b0c482521d2c238c599aa0c456447d9fd73054a083d0bce8da41ed906a9ec36b618360f66a3daebeb0ab628658da75ee86c465cd35620fb2
TLSH
T136E0C03411F6425EE4F4E4344BC9742DA5DEF026142D93B42AC49F08E702A00ED13969
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8FXVQJ29\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1080-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1344-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1512-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1836-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2056-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2096-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2740-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3748-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3820-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4976-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5032-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads