285e44f2d22a99de655ef959b185090dd1b0e2925ad5c999038046e8bab2fd4a

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
Size 243KB
Sample261024-sr5fvsaw7y
SHA256 285e44f2d22a99de655ef959b185090dd1b0e2925ad5c999038046e8bab2fd4a
MD5 4127ff7d3633d6cfdb25870c156320da
SHA1 4be1843c8307789357500faa85978163f8e93b3b
SHA512 4d6f9756d9226005b511fdab2628de9c4ee16cf1654bc9dde8c91950e930c8f2683d0a0a216123e1105b29f3fbe9b324e16297523ac9f1f60fcf6323c0717d8d
SSDEEP 3072:MjF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7ux:MB3frLQsa3lLNngoqRttA7ux
TLSH
T1F3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4132	CP.exe
3780	sqkicavsnk.exe
688	CP.exe
3256	CP.exe
4584	i_sqkicavsnk.exe
4892	causnkfdxv.sys
1132	CP.exe
1256	nhfaxspkic.exe
4832	CP.exe
3948	CP.exe
2024	i_nhfaxspkic.exe
4936	usnkfcxvpn.sys
4948	CP.exe
5012	nhfzxspkic.exe
2920	CP.exe
2000	CP.exe
988	i_nhfzxspkic.exe
1776	hfzxrpjhcz.sys
2632	CP.exe
4808	zurmkecwup.exe
2136	CP.exe
1984	CP.exe
4296	i_zurmkecwup.exe
4252	cwrpjhbzur.sys
3220	CP.exe
636	rmjecwuomg.exe
1800	CP.exe
2508	CP.exe
4540	i_rmjecwuomg.exe
3380	wuomgezwrp.sys
1268	CP.exe
1784	gbztrljebw.exe
4428	CP.exe
1564	CP.exe
620	i_gbztrljebw.exe
2192	ojgbztrljd.sys
3416	CP.exe
2240	dbvtolgeyw.exe
1744	CP.exe
2972	CP.exe
5040	i_dbvtolgeyw.exe
1776	dbvtnlgdyv.sys
3544	CP.exe
4212	vqoigaysql.exe
3744	CP.exe
4128	CP.exe
432	i_vqoigaysql.exe
3088	ysqkidavtn.sys
1168	CP.exe
2552	nlfdxvqnif.exe
4276	CP.exe
2844	CP.exe
3620	i_nlfdxvqnif.exe
4540	aysqkidavs.sys
4032	CP.exe
4000	kfdxvpnhfa.exe
4356	CP.exe
4316	CP.exe
3272	i_kfdxvpnhfa.exe
3836	CP.exe
3080	nhfzxspkhc.exe
4484	CP.exe
1180	CP.exe
1240	i_nhfzxspkhc.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmkecw.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1716	ipconfig.exe
3084	ipconfig.exe
180	ipconfig.exe
4540	ipconfig.exe
4388	ipconfig.exe
4344	ipconfig.exe
3252	ipconfig.exe
1556	ipconfig.exe
4136	ipconfig.exe
2820	ipconfig.exe
1668	ipconfig.exe
3440	ipconfig.exe
4300	ipconfig.exe
5088	ipconfig.exe
3988	ipconfig.exe
2852	ipconfig.exe
3620	ipconfig.exe
2292	ipconfig.exe
2628	ipconfig.exe
2736	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000522707a2d8b4d6af9a60f6c4cd2d6266909b8d97e9130133392cd129a1fbee29000000000e800000000200002000000067742652dc222bcd5787c958c53a9a4b117dc8e929ac9dd116440944a42e481420000000d8af8df018e7bfd01ed8d044111129125913f3908a5b0aaa3731f2eda8d4d61c40000000bb6480bae3bd1ca0af7c0371d6f326b8397560ab07719e8799f0b3f993053a1903fc9cd0163388b9912028a8b45e5798ccdf6479e5fb748673ac76a7a14f8d9f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fc81f1d363dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286219"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2406726509"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2399070390"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000cb5a8e63a971cdac4b503c14b003765eb2d290da25e314122f0d159cc2e3565d000000000e80000000020000200000009cd24bbcc9de254d34535482f9ebd9c715dfd4e5fc1f4496741a71fd6fac630a2000000002a0b5026ddf3256cf43d3a14f860932b7a82a09b617e63b4c1c8419a343dc714000000069e2dcdbe8c0e8054d35cb591e911b9648620d6f3c5a5f72b332e492a92f6379c8d53dec6fcad1e53dc235acc730fad6ba2f789317bead0a13020e7f3b45e176	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286219"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA693BEC-CFBE-11F1-8F8C-62BF8547FD78} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499620325"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70417df1d363dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	i_sqkicavsnk.exe
Token: SeDebugPrivilege	2024	i_nhfaxspkic.exe
Token: SeDebugPrivilege	988	i_nhfzxspkic.exe
Token: SeDebugPrivilege	4296	i_zurmkecwup.exe
Token: SeDebugPrivilege	4540	i_rmjecwuomg.exe
Token: SeDebugPrivilege	620	i_gbztrljebw.exe
Token: SeDebugPrivilege	5040	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	432	i_vqoigaysql.exe
Token: SeDebugPrivilege	3620	i_nlfdxvqnif.exe
Token: SeDebugPrivilege	3272	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	1240	i_nhfzxspkhc.exe
Token: SeDebugPrivilege	1680	i_kecwupmhfz.exe
Token: SeDebugPrivilege	2984	i_hbzurmkecw.exe
Token: SeDebugPrivilege	2304	i_hezwjhbztr.exe
Token: SeDebugPrivilege	532	i_bztrljebwt.exe
Token: SeDebugPrivilege	404	i_ywqoigbytr.exe
Token: SeDebugPrivilege	5008	i_qoigaysqli.exe
Token: SeDebugPrivilege	4384	i_pnifaysqda.exe
Token: SeDebugPrivilege	3184	i_nifaysqkic.exe
Token: SeDebugPrivilege	1968	i_fzxspkicau.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
4620	IEXPLORE.EXE
4620	IEXPLORE.EXE
4620	IEXPLORE.EXE
4620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 2968	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	84
PID 2968 wrote to memory of 4620	2968	iexplore.exe	85
PID 3388 wrote to memory of 4132	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	86
PID 3780 wrote to memory of 688	3780	sqkicavsnk.exe	91
PID 3388 wrote to memory of 3256	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	96
PID 3388 wrote to memory of 1132	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	103
PID 1256 wrote to memory of 4832	1256	nhfaxspkic.exe	105
PID 3388 wrote to memory of 3948	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	108
PID 3388 wrote to memory of 4948	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	112
PID 5012 wrote to memory of 2920	5012	nhfzxspkic.exe	114
PID 3388 wrote to memory of 2000	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	117
PID 3388 wrote to memory of 2632	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	121
PID 4808 wrote to memory of 2136	4808	zurmkecwup.exe	123
PID 3388 wrote to memory of 1984	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	126
PID 3388 wrote to memory of 3220	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	132
PID 636 wrote to memory of 1800	636	rmjecwuomg.exe	134
PID 3388 wrote to memory of 2508	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	137
PID 3388 wrote to memory of 1268	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	141
PID 1784 wrote to memory of 4428	1784	gbztrljebw.exe	143
PID 3388 wrote to memory of 1564	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	146
PID 3388 wrote to memory of 3416	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	150
PID 2240 wrote to memory of 1744	2240	dbvtolgeyw.exe	152
PID 3388 wrote to memory of 2972	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	155
PID 3388 wrote to memory of 3544	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	159
PID 4212 wrote to memory of 3744	4212	vqoigaysql.exe	161
PID 3388 wrote to memory of 4128	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	164
PID 3388 wrote to memory of 1168	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	168
PID 2552 wrote to memory of 4276	2552	nlfdxvqnif.exe	170
PID 3388 wrote to memory of 2844	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	173
PID 3388 wrote to memory of 4032	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	177
PID 4000 wrote to memory of 4356	4000	kfdxvpnhfa.exe	179
PID 3388 wrote to memory of 4316	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	182
PID 3388 wrote to memory of 3836	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	184
PID 3080 wrote to memory of 4484	3080	nhfzxspkhc.exe	186
PID 3388 wrote to memory of 1180	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	189
PID 3388 wrote to memory of 4936	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	193
PID 4412 wrote to memory of 3096	4412	kecwupmhfz.exe	195
PID 3388 wrote to memory of 4876	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	198
PID 3388 wrote to memory of 2848	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	202
PID 2272 wrote to memory of 3560	2272	hbzurmkecw.exe	204
PID 3388 wrote to memory of 5076	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	207
PID 3388 wrote to memory of 1100	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	211
PID 956 wrote to memory of 3816	956	hezwjhbztr.exe	213
PID 3388 wrote to memory of 920	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	216
PID 3388 wrote to memory of 1660	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	220
PID 880 wrote to memory of 4772	880	bztrljebwt.exe	222
PID 3388 wrote to memory of 1408	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	225
PID 3388 wrote to memory of 3308	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	229
PID 2496 wrote to memory of 1760	2496	ywqoigbytr.exe	231
PID 3388 wrote to memory of 4476	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	234
PID 3388 wrote to memory of 5020	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	238
PID 3564 wrote to memory of 3432	3564	qoigaysqli.exe	240
PID 3388 wrote to memory of 3956	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	243
PID 3388 wrote to memory of 4508	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	247
PID 4220 wrote to memory of 952	4220	pnifaysqda.exe	249
PID 3388 wrote to memory of 2124	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	252
PID 3388 wrote to memory of 1712	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	256
PID 2784 wrote to memory of 4592	2784	nifaysqkic.exe	258
PID 3388 wrote to memory of 1348	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	261
PID 3388 wrote to memory of 3240	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	265
PID 3088 wrote to memory of 628	3088	fzxspkicau.exe	267
PID 3388 wrote to memory of 2988	3388	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	270

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4132
- - C:\Temp\sqkicavsnk.exe
    C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3256
- - C:\Temp\i_sqkicavsnk.exe
    C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Temp\nhfaxspkic.exe
    C:\Temp\nhfaxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\i_nhfaxspkic.exe
    C:\Temp\i_nhfaxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2632
- - C:\Temp\zurmkecwup.exe
    C:\Temp\zurmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1984
- - C:\Temp\i_zurmkecwup.exe
    C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1268
- - C:\Temp\gbztrljebw.exe
    C:\Temp\gbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1564
- - C:\Temp\i_gbztrljebw.exe
    C:\Temp\i_gbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3416
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3544
- - C:\Temp\vqoigaysql.exe
    C:\Temp\vqoigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\i_vqoigaysql.exe
    C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1168
- - C:\Temp\nlfdxvqnif.exe
    C:\Temp\nlfdxvqnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2844
- - C:\Temp\i_nlfdxvqnif.exe
    C:\Temp\i_nlfdxvqnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4032
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4316
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Temp\nhfzxspkhc.exe
    C:\Temp\nhfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1180
- - C:\Temp\i_nhfzxspkhc.exe
    C:\Temp\i_nhfzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run
  2⤵
  PID:4936
- - C:\Temp\kecwupmhfz.exe
    C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_kecwupmhfz.exe
    C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run
  2⤵
  PID:2848
- - C:\Temp\hbzurmkecw.exe
    C:\Temp\hbzurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins
  2⤵
  PID:5076
- - C:\Temp\i_hbzurmkecw.exe
    C:\Temp\i_hbzurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwjhbztr.exe ups_run
  2⤵
  PID:1100
- - C:\Temp\hezwjhbztr.exe
    C:\Temp\hezwjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwjhbztr.exe ups_ins
  2⤵
  PID:920
- - C:\Temp\i_hezwjhbztr.exe
    C:\Temp\i_hezwjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run
  2⤵
  PID:1660
- - C:\Temp\bztrljebwt.exe
    C:\Temp\bztrljebwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins
  2⤵
  PID:1408
- - C:\Temp\i_bztrljebwt.exe
    C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run
  2⤵
  PID:3308
- - C:\Temp\ywqoigbytr.exe
    C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins
  2⤵
  PID:4476
- - C:\Temp\i_ywqoigbytr.exe
    C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:5020
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqda.exe ups_run
  2⤵
  PID:4508
- - C:\Temp\pnifaysqda.exe
    C:\Temp\pnifaysqda.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqda.exe ups_ins
  2⤵
  PID:2124
- - C:\Temp\i_pnifaysqda.exe
    C:\Temp\i_pnifaysqda.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  PID:1712
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  PID:1348
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  PID:3240
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  PID:2988
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
- Executes dropped EXE
PID:4892

C:\Temp\usnkfcxvpn.sys
C:\Temp\usnkfcxvpn.sys
1⤵
- Executes dropped EXE
PID:4936

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\cwrpjhbzur.sys
C:\Temp\cwrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:2192

C:\Temp\dbvtnlgdyv.sys
C:\Temp\dbvtnlgdyv.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
PID:2560

C:\Temp\xupmhfrpjh.sys
C:\Temp\xupmhfrpjh.sys
1⤵
PID:3604

C:\Temp\omgezwrojh.sys
C:\Temp\omgezwrojh.sys
1⤵
PID:5112

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
PID:2864

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:2896

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:3116

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
PID:1992

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:4932

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causnkfdxv.sys

Path C:\Temp\causnkfdxv.sys
Size 141KB
SHA256 7bb28b4637ac65b653ef6fdc34497e4738de06f656be8b352bea8cbfd86bb1a6
MD5 4daf61f9ce2e15f0a755a83fd377a05e
SHA1 3ec1fc4527b28f96c2873f297cfaa2699bf56d10
SHA512 9da82c1ef555aefd519a6cf508981bd5ae5afc8d85cef1426ac5c94f17126a4ea1e5ea3e0bd7b0aa8d2f0ebb4c07c59d1c599fa0e17678560b474ef9d3128f1d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwrpjhbzur.sys

Path C:\Temp\cwrpjhbzur.sys
Size 141KB
SHA256 b4ad67c77329ba2659cf7384c6d0ccad1d8d2a3dc3b577990f7eeda7b10ae3e1
MD5 6099c25543e58ed8ccfaa9d25794513a
SHA1 55fa584df41c8866c53a162cd654eba0d98f0233
SHA512 e0899cd2ef12b08fac642d4a4c9a4b95faaa9eceec7d3684b4f47819b47142e9fd79b0d1666553855d821ddd0f72375739d0e53895aa62abae5355c7e76f3f84
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyv.sys

Path C:\Temp\dbvtnlgdyv.sys
Size 141KB
SHA256 23ce7c63c660e0798b69fb140dca873f652e0433202c60e02619d279e35b57ab
MD5 e98f1df20c833c6d7bdf95fdd5833167
SHA1 4d932d21d08844d2568570392e56fd911034611a
SHA512 478be21a1922e865f01c30d9a77f9d26c8d8f1ca32ea4b3bc50106d9dcb72d78dee42db755698effd5df4833857bfe15c0467bd921ab16e66b25c4fdb3d3706f
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T152E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.exe

Path C:\Temp\dbvtolgeyw.exe
Size 243KB
SHA256 4c03b31058116577ba1ffb42a45d077e5a64b8e7c9347df465d57ed952292173
MD5 5bf7b7af9041105eecf0ab187f6c1d7e
SHA1 c18f658978cb7f5a97ed00aad6800acb073691d6
SHA512 c7c05ae66da9055659359dfd253a1b9848bdbda2141a73be1fc52f0ee10df12a4bf77e4fc9d69d64cbcc089c6dd9fa3ba135d0dad409d906feb3d2d6c22ac986
SSDEEP 3072:cF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:I3frLQsa3lLNngoqRttA7E
TLSH
T18B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljebw.exe

Path C:\Temp\gbztrljebw.exe
Size 243KB
SHA256 86ffdee09572ec7c1611fda0650658b15a29d84bf899f165c555138950aa41f0
MD5 01ba0de0e893b62de8af6ebb8c1556bf
SHA1 60ba19330d20ef16bd12fdc7462f30f198669a0e
SHA512 2d83c4e0f66a40e8d9db021934300c8ded0cfebc3a3799dbfcd47eead86aed3da169cba07c40b0f964b0ec8a56ea6059231909999f741c09b55023bc2c2ddc0e
SSDEEP 3072:CF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:S3frLQsa3lLNngoqRttA7K
TLSH
T104345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhcz.sys

Path C:\Temp\hfzxrpjhcz.sys
Size 141KB
SHA256 e8a7f3a744230a4cf175b26f18305bb9b0eadc764fad16e762366c7421fa7b06
MD5 f97530602774ee26944ceea9268ceec6
SHA1 c794ae135308c36f20fface8c7ddfda5ec3873cc
SHA512 9f7a222384c1cb8a4cbe5959502b6a16be1c1cc21e4ae2a71ecc48e8473600714a40c3fd3c2e84c2952accabce23a8dd1dade3c3af7973b850980291e09a1c92
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtolgeyw.exe

Path C:\Temp\i_dbvtolgeyw.exe
Size 243KB
SHA256 9a22bf49ac00ddbd24e80e3b46288055319ddb2d155ea04463ae6b1c0533e2c3
MD5 0e8fc156619962f005e583c32810a644
SHA1 1b12cb5d55664dc8a99615274adabbcec84c14fe
SHA512 7b7747c7b775c8ce7e9f5fbb8ddd0c4c814afdad90bf84397314015b2b8ec75f974f2ccb5e1e4f6d25e44a871e696b8eb403328b1208a433974ad24b1d0bd414
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:g3frLQsa3lLNngoqRttA7Q
TLSH
T190345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljebw.exe

Path C:\Temp\i_gbztrljebw.exe
Size 243KB
SHA256 3bf9ce08723617f16e28f48f4c2d8744a6d637546ec767130a7a610428c3c8bb
MD5 cc772d8770f7b199155c2ff317b6c4f7
SHA1 456ca7ec66a093ca98bb1c282c02aa713e36d10e
SHA512 151f4d1b6f54985e6631c1db28070d7b29c6f37d31002a81e86eae1c792b716a3061b9586f3f2f795d9df8a2f7cbefe2c74fedb46c188807147ac2b681271e87
SSDEEP 3072:kF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:w3frLQsa3lLNngoqRttA7c
TLSH
T14B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxspkic.exe

Path C:\Temp\i_nhfaxspkic.exe
Size 243KB
SHA256 a01f0a110498f8f7a0a477fdae5cd58b322a0d67934940044f0c806e6362455a
MD5 82f2c543c43246d14cc4409c1953eb6e
SHA1 9cc8e492ace0fb59d1ae6d618e0f28588bbabc78
SHA512 cbe6b4e7b1f1a1172d640c16f18ec9cfcc2abb9379aacafa75aaffd6e219708d9767f30030a145093183f3fcdaf2e688e7c05f8e0338dd453b141e6239b47a17
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:03frLQsa3lLNngoqRttA7E
TLSH
T189345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 243KB
SHA256 0457d9906e18f587a2ddac4a1a3964929d1295fdb0969c3aee49aad75b9b1dfb
MD5 0a67418d137f8eed0f12b3d588379c59
SHA1 83c9d9d3293ec6312a5e07f4366ff75e499db038
SHA512 c864e01de8569dbc9108cdc8565392177ca631d5d9135756b72bf8d627cc48e8e54602a9949c647e3623a90d16472f6adec79a59f010301aee307ed6ced0cdf8
SSDEEP 3072:SF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:C3frLQsa3lLNngoqRttA7S
TLSH
T18D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjecwuomg.exe

Path C:\Temp\i_rmjecwuomg.exe
Size 243KB
SHA256 179f81a06d31aa84ddbe1c70b3cb4c49539816987575f4eed5c356c686e45dd0
MD5 bc9ca0bc84920263749d15dea5649a99
SHA1 dab6eae637ecc06317f4801417a18918cc5145c1
SHA512 bf443b971e414eeeddf441a25687d7b760bccd3e0bac909b9f66b5ee7986e115747d023fb5d4d9a8bfa7e833784033127ce51ef6766258c74b5f7e9098eff666
SSDEEP 3072:sF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:43frLQsa3lLNngoqRttA7o
TLSH
T101345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnk.exe

Path C:\Temp\i_sqkicavsnk.exe
Size 243KB
SHA256 96f7dba7f301e547825f4205a736a6f90262ab3b06ae4a6f2b07c1171b93ac46
MD5 9401f057b7d5f719831b48752eedae43
SHA1 402274808406b81062998b67138055ba879069ca
SHA512 b800eb7b6b3c480a302512df41301e5e116cd0268135a76d1f2cdee0fbce9d9e5306916e921f98b37575b5f7d2446dd65e34ae09b133ac19c0d8914e7ea73590
SSDEEP 3072:QF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:M3frLQsa3lLNngoqRttA7A
TLSH
T19E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwup.exe

Path C:\Temp\i_zurmkecwup.exe
Size 243KB
SHA256 89c151c1742640b20506680f3274df922c9a120402cd5b004f6f7fc3a1fb1aa2
MD5 aea7b16efed10aa5e00086d3428eed46
SHA1 f2c604cb5c090871e0e95043f1443c27edc4b412
SHA512 4ad174a6b2d343c7e3e1d092aabb6fa673a845a22e68e0bf98abf488e0136f514d5374b08accc0658d4e6282856e82815b5899dcc149722ace29b536e57f08be
SSDEEP 3072:PF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:N3frLQsa3lLNngoqRttA7b
TLSH
T1AC345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.exe

Path C:\Temp\nhfaxspkic.exe
Size 243KB
SHA256 fec0b272e6548bdba6ae8603aca2665cc24a63a06880096cfb6038ed2fed356f
MD5 a1b635e4f835c9c80767df5ec095ebdd
SHA1 0efd0b4b6fb309179a32daa984ed2d78e40d02f6
SHA512 e79ea748418a054e528406cb3a614f160f4bb4bec9f2fb88cd9c3ffb44f604dcecbd432bdd1a0dd6c11712338f03530c8f4798e4ee8501a64a9bc9736f42b1fd
SSDEEP 3072:vF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:t3frLQsa3lLNngoqRttA7j
TLSH
T18C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 db621b1641dd1269ff7c14e8c0a8c98c42590030b0745c07ad34910aaa346da6
MD5 15db47d1250a77fdf678867e18454722
SHA1 abe105d2496aa2fd8e1d805b3d15e56d2ec57b07
SHA512 d31da050f5abe37bbb504fc70c359718f0e977f126c8b8bfabc5111555e99d0a95c8d99f07555ea80862d628fe4a7c21ade734772f14865e976ff87b5f87749f
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:g3frLQsa3lLNngoqRttA7o
TLSH
T1F2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.sys

Path C:\Temp\ojgbztrljd.sys
Size 141KB
SHA256 4f727f6c9e1882998b5b9999389d7f2520df4fc94f780d24466d9626c6e040dd
MD5 092970529d90258710c9cb66bccec13d
SHA1 a1e2ab711f5b88f487eb02324d88c70914131c7e
SHA512 e00c5699700149a8ad814af3afcad0d23b6d80203eaa37c41a496d371efa78e867c2901ac35439146f1c760ad4a27093caab322a294c83a3c42a5c842fa30d2d
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.exe

Path C:\Temp\rmjecwuomg.exe
Size 243KB
SHA256 016d2d0204cba9d4cd5dcc7f6d74d3e0ae4529292d738cdc16a87082f2e63cd8
MD5 7de534853ed895127b9b47a12efbc05e
SHA1 0133373a044df1f6b0d1228fafdaabb600b47b96
SHA512 6c2b68420e28ff013dc6d9d23352700b7c1d78e522d0eb35e446e665b55ae8ede1ebe9622a62d96864e96a3881e8ccd7c74122c350bdfbe8e362c128bf85cf5d
SSDEEP 3072:BF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:D3frLQsa3lLNngoqRttA7h
TLSH
T1A4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.exe

Path C:\Temp\sqkicavsnk.exe
Size 243KB
SHA256 fab853b3557726957891312c4907cbe4db3c9518bea623bbac6f3c917283f45d
MD5 f215f3b5472c03d010ca15743b38b80e
SHA1 522fc32a474c0725a95503c2f953d9cb054a5fe7
SHA512 76ba666d54269743084b1bbc64829dc74e3c0d7ca45d6ac6ceaf35efc247495476a16bc0ecfb8146a2a9905f83de47ddae7d514c426346f9e12bf94d87b6de8b
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:03frLQsa3lLNngoqRttA7E
TLSH
T1E5345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcxvpn.sys

Path C:\Temp\usnkfcxvpn.sys
Size 141KB
SHA256 1ec0f922928cf7e9c28d0d8d9a6ec657304c2cc7d74f629f961173d9906a0a71
MD5 1c7f3ce56f9a240edfca7aa7d71b7e01
SHA1 8ce256d3f7ffe68369bab9d6b0efd88f4cfa7b66
SHA512 6fd8c806d147f73f28e929ef7085dd69209802bed260b0950531d06c999fb9bc0416f637006beb97f1ba64611c225b1d43bb7cdbf5ad0a9d373b8eeb9e304b7f
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.exe

Path C:\Temp\vqoigaysql.exe
Size 243KB
SHA256 675bfdeabd72a7196110d27ed33beb4ce6e69a73eae96c1c5f11f1fa37e251db
MD5 fbfbc28f6c1cdf5441d6f512000a5647
SHA1 e9f4d183a71cf85248a82e2defe378a12ae44a89
SHA512 26bf27d9d468509c219365f7ce9ce26b1b390cf82a1a7157543c18bad5f6773f187027fcf78f67a0f3341f487cb89236fd13a40959ad05dc58057d3c7ba155c8
SSDEEP 3072:wF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:s3frLQsa3lLNngoqRttA7M
TLSH
T110345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.sys

Path C:\Temp\wuomgezwrp.sys
Size 141KB
SHA256 0bf1a69982b925856586c939791b92beb983ce3d73f884fe45c965ce96753e05
MD5 acee772ea2c24a4379a01f3976d27e8c
SHA1 17cef1db4f3472567c1ec22651ddf2d7c602b8cc
SHA512 547aa2fcdcf21f211637771c59368d0eb6429d0ed2ff05c0a5360e2895f3ddcf2bf13d0c928931f76744ff5b5cc0c13008dec28360b961c9e297098abf2e9a5a
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17EE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwup.exe

Path C:\Temp\zurmkecwup.exe
Size 243KB
SHA256 c0e0f24b687513162dbce1bce5a3a29bb9d3e61a44b46ad74a0cf799f93d2979
MD5 30a241e7cde0c1df44219a300192dce2
SHA1 42596ddcc4672ac88b74e2b366b3ae4c3e73094b
SHA512 17ae512bc8e2cf9da0886f71fffab0c4418c646b01e5a2ce7f39ef430dae89bef27974fd4347993bed28aa80cd897138dfbc14fad8049ce5438ca7ef1c90d8d9
SSDEEP 3072:wF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:s3frLQsa3lLNngoqRttA7g
TLSH
T10E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 63860c6866ccdc8ca3947367f5666fafe8f90df7697bc84c560f96e9b87d39c7
MD5 0f22e37dc2aff46d7ef1b16e7c2cd680
SHA1 32a82a6ba010dd92542b742ff6b77be2f9453de8
SHA512 fcb3ea575ccec8c20bf872befeb0ecccdac0c3916264b1ae7ef7f4dee3d3ac49526eb683eaf72e6b141f4c58e3f3ec8afaf327d7de76447cb8c16f5e9168c1bb
TLSH
T179F09772E13DE8626CD585FC16A403FA3662B97B14048003A0BC489A448DB762F9D434
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 404d7368c8928ce47ec8fb45e3c716c38225fa61cc85b601affc872b610a193c
MD5 579ed604faa042a48a20bc7f8d75e454
SHA1 9438548ca5d5c31dcfb38b8d1727a9d2dbbcd82b
SHA512 d42a23c6041c8deb30603518694a85f8f0c42b8024c684642464f2d48b37c91565d1c4d9cfdb23e5b74795351fc20b8ce3b359c642bb346d3dc786680d4732d6
TLSH
T12EE0C03511F6811EF0F9D0B44BD87436856EF1271418A2B82EC46B04F306680EC03A26
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-39-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1776-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1992-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2192-82-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2560-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2864-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3380-70-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3604-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4252-56-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-27-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5112-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads