e761b8f3b36457ef8714f105c2cff83c0be1fe6a4a5c9b1c3c815e51c6953db7

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe
Size 243KB
Sample261029-15wpwace95
SHA256 e761b8f3b36457ef8714f105c2cff83c0be1fe6a4a5c9b1c3c815e51c6953db7
MD5 a0f9110bd081a0ce4b99098a86c83e0f
SHA1 08dcb6250b746e8c96805d826ef14e6980d47f61
SHA512 69c37ce8d50302851f781b5560ae53fc522e8ec34ffd02d6281ede1305d75569f149a52b5f2056c927392a53eed18da0b711d7ccdfdacc0a4ab63c4ae63ddceb
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:Rb3TfLAUa3lLNngoqRttA7L
TLSH
T1CD34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2428	CP.exe
1848	jdbvtnlgdq.exe
3012	CP.exe
4888	CP.exe
1636	i_jdbvtnlgdq.exe
3172	yvqoigaysq.sys
740	CP.exe
4760	qlfdyvqoig.exe
3716	CP.exe
3296	CP.exe
4004	i_qlfdyvqoig.exe
1920	idavtnlfdx.sys
776	CP.exe
4756	xsqkicavsn.exe
1640	CP.exe
3196	CP.exe
5064	i_xsqkicavsn.exe
4332	usnkfdxvpn.sys
4124	CP.exe
3632	kicausmkfc.exe
3792	CP.exe
2120	CP.exe
3124	i_kicausmkfc.exe
3980	kfcxvpnhfz.sys
564	CP.exe
1956	rmkecwupmh.exe
3800	CP.exe
4472	CP.exe
3136	i_rmkecwupmh.exe
5112	xrpjhczusm.sys
3284	CP.exe
3276	mhezxrpjhb.exe
3592	CP.exe
4660	CP.exe
1436	i_mhezxrpjhb.exe
3624	geywrojhbz.sys
924	CP.exe
4720	ztrmjecwuo.exe
3436	CP.exe
5044	CP.exe
4272	i_ztrmjecwuo.exe
2316	wqojgbytrl.sys
876	CP.exe
3952	ljdbwtomge.exe
2944	CP.exe
4224	CP.exe
2920	i_ljdbwtomge.exe
4632	rljdbwtolg.sys
2328	CP.exe
1668	ywqoigaytq.exe
1216	CP.exe
1636	CP.exe
1756	i_ywqoigaytq.exe
964	gaysqlidbv.sys
3824	CP.exe
4908	ytqlgdyvqo.exe
3240	CP.exe
3280	CP.exe
4248	i_ytqlgdyvqo.exe
4400	avtnlfdxvq.sys
1776	CP.exe
3048	qnifaysqki.exe
4956	CP.exe
3376	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkeztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkeztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3156	ipconfig.exe
2876	ipconfig.exe
3284	ipconfig.exe
1636	ipconfig.exe
2032	ipconfig.exe
4080	ipconfig.exe
4920	ipconfig.exe
804	ipconfig.exe
836	ipconfig.exe
2112	ipconfig.exe
1492	ipconfig.exe
912	ipconfig.exe
2856	ipconfig.exe
4996	ipconfig.exe
2292	ipconfig.exe
2388	ipconfig.exe
4488	ipconfig.exe
2952	ipconfig.exe
2268	ipconfig.exe
1996	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b00000000020000000000106600000001000020000000a1c8ab5804b19432829862371944a86dfc816feaad06fb594750d21c7a4cc571000000000e800000000200002000000016aa795e14f8449a673397dd147c4c61b1b62c52c541f79a013b6f6b0d4421d9200000005789e918032097e420a97bfb142ab277aa437a8395dbd7adefbd631c36bad4ad40000000dbd00a0f7c3f0377e17a16600ca20ac3e6bc16d6e4622f012a3ab29f845b164898970cfba9d91ff304cfca0c70a633c1e0f9fbd96e44c1d4b7e7de0e9b789f0c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40faa0f4f267dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4094037853"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1F324CD6-D3E6-11F1-9982-5E640711BF8A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000009c0be956e72ed7ee555be02a65440f6736570e7adbb8b09e60ed6ba2bf12615000000000e80000000020000200000009924d31870b96f1f9da0401482f6f93c807ceaec3cd957279b8beec0ffc39eef20000000ec24d79414a34da5f8940cf3c2be38bb635af8a8b430ef8da0dfa8ddca3560024000000071083c0a5dc1a753705e583fe89b361ec4f8b3c6657dcc81ec2ad90059f17d645b45d4498f3d748952ebab98c969c6621d2261b59bc26a1c6c6957b26aeb9763	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b5a5f4f267dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4089350087"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500077049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287282"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	i_jdbvtnlgdq.exe
Token: SeDebugPrivilege	4004	i_qlfdyvqoig.exe
Token: SeDebugPrivilege	5064	i_xsqkicavsn.exe
Token: SeDebugPrivilege	3124	i_kicausmkfc.exe
Token: SeDebugPrivilege	3136	i_rmkecwupmh.exe
Token: SeDebugPrivilege	1436	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	4272	i_ztrmjecwuo.exe
Token: SeDebugPrivilege	2920	i_ljdbwtomge.exe
Token: SeDebugPrivilege	1756	i_ywqoigaytq.exe
Token: SeDebugPrivilege	4248	i_ytqlgdyvqo.exe
Token: SeDebugPrivilege	4272	i_qnifaysqki.exe
Token: SeDebugPrivilege	2296	i_kicavsnkfa.exe
Token: SeDebugPrivilege	712	i_czusmkecwu.exe
Token: SeDebugPrivilege	1728	i_czurmkecwu.exe
Token: SeDebugPrivilege	3308	i_urmkeztrmj.exe
Token: SeDebugPrivilege	2096	i_mgbztrljeb.exe
Token: SeDebugPrivilege	4796	i_bvtnlgdytr.exe
Token: SeDebugPrivilege	4572	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	4788	i_nlfdxvqnif.exe
Token: SeDebugPrivilege	2340	i_ifaysqkica.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3236	iexplore.exe
3236	iexplore.exe
372	IEXPLORE.EXE
372	IEXPLORE.EXE
372	IEXPLORE.EXE
372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3236	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	85
PID 3236 wrote to memory of 372	3236	iexplore.exe	86
PID 1544 wrote to memory of 2428	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	87
PID 1848 wrote to memory of 3012	1848	jdbvtnlgdq.exe	90
PID 1544 wrote to memory of 4888	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	97
PID 1544 wrote to memory of 740	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	105
PID 4760 wrote to memory of 3716	4760	qlfdyvqoig.exe	107
PID 1544 wrote to memory of 3296	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	110
PID 1544 wrote to memory of 776	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	114
PID 4756 wrote to memory of 1640	4756	xsqkicavsn.exe	116
PID 1544 wrote to memory of 3196	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	119
PID 1544 wrote to memory of 4124	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	123
PID 3632 wrote to memory of 3792	3632	kicausmkfc.exe	125
PID 1544 wrote to memory of 2120	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	128
PID 1544 wrote to memory of 564	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	135
PID 1956 wrote to memory of 3800	1956	rmkecwupmh.exe	137
PID 1544 wrote to memory of 4472	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	140
PID 1544 wrote to memory of 3284	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	144
PID 3276 wrote to memory of 3592	3276	mhezxrpjhb.exe	146
PID 1544 wrote to memory of 4660	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	149
PID 1544 wrote to memory of 924	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	153
PID 4720 wrote to memory of 3436	4720	ztrmjecwuo.exe	155
PID 1544 wrote to memory of 5044	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	158
PID 1544 wrote to memory of 876	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	162
PID 3952 wrote to memory of 2944	3952	ljdbwtomge.exe	164
PID 1544 wrote to memory of 4224	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	167
PID 1544 wrote to memory of 2328	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	172
PID 1668 wrote to memory of 1216	1668	ywqoigaytq.exe	174
PID 1544 wrote to memory of 1636	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	177
PID 1544 wrote to memory of 3824	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	181
PID 4908 wrote to memory of 3240	4908	ytqlgdyvqo.exe	183
PID 1544 wrote to memory of 3280	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	186
PID 1544 wrote to memory of 1776	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	190
PID 3048 wrote to memory of 4956	3048	qnifaysqki.exe	192
PID 1544 wrote to memory of 3376	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	195
PID 1544 wrote to memory of 4628	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	199
PID 4860 wrote to memory of 4256	4860	kicavsnkfa.exe	201
PID 1544 wrote to memory of 408	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	204
PID 1544 wrote to memory of 4168	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	208
PID 3360 wrote to memory of 5048	3360	czusmkecwu.exe	210
PID 1544 wrote to memory of 3108	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	213
PID 1544 wrote to memory of 2164	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	217
PID 1256 wrote to memory of 456	1256	czurmkecwu.exe	219
PID 1544 wrote to memory of 3384	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	222
PID 1544 wrote to memory of 2052	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	226
PID 3564 wrote to memory of 1388	3564	urmkeztrmj.exe	228
PID 1544 wrote to memory of 2412	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	231
PID 1544 wrote to memory of 3900	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	235
PID 3796 wrote to memory of 4004	3796	mgbztrljeb.exe	237
PID 1544 wrote to memory of 4948	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	240
PID 1544 wrote to memory of 2324	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	244
PID 4732 wrote to memory of 3520	4732	bvtnlgdytr.exe	246
PID 1544 wrote to memory of 1332	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	249
PID 1544 wrote to memory of 3124	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	253
PID 5080 wrote to memory of 4416	5080	bvtnlgdyvq.exe	255
PID 1544 wrote to memory of 4220	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	258
PID 1544 wrote to memory of 2612	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	262
PID 3768 wrote to memory of 2080	3768	nlfdxvqnif.exe	264
PID 1544 wrote to memory of 440	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	267
PID 1544 wrote to memory of 2024	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	271
PID 4652 wrote to memory of 1308	4652	ifaysqkica.exe	273
PID 1544 wrote to memory of 1724	1544	2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe	276

C:\Users\Admin\AppData\Local\Temp\2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a0f9110bd081a0ce4b99098a86c83e0f_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3236 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlgdq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2428
- - C:\Temp\jdbvtnlgdq.exe
    C:\Temp\jdbvtnlgdq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlgdq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4888
- - C:\Temp\i_jdbvtnlgdq.exe
    C:\Temp\i_jdbvtnlgdq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:740
- - C:\Temp\qlfdyvqoig.exe
    C:\Temp\qlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Temp\i_qlfdyvqoig.exe
    C:\Temp\i_qlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:776
- - C:\Temp\xsqkicavsn.exe
    C:\Temp\xsqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_xsqkicavsn.exe
    C:\Temp\i_xsqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4124
- - C:\Temp\kicausmkfc.exe
    C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2120
- - C:\Temp\i_kicausmkfc.exe
    C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:564
- - C:\Temp\rmkecwupmh.exe
    C:\Temp\rmkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4472
- - C:\Temp\i_rmkecwupmh.exe
    C:\Temp\i_rmkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3284
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:924
- - C:\Temp\ztrmjecwuo.exe
    C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\i_ztrmjecwuo.exe
    C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:876
- - C:\Temp\ljdbwtomge.exe
    C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\i_ljdbwtomge.exe
    C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqlgdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3824
- - C:\Temp\ytqlgdyvqo.exe
    C:\Temp\ytqlgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqlgdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\i_ytqlgdyvqo.exe
    C:\Temp\i_ytqlgdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1776
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnkfa.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\kicavsnkfa.exe
    C:\Temp\kicavsnkfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnkfa.exe ups_ins
  2⤵
  PID:408
- - C:\Temp\i_kicavsnkfa.exe
    C:\Temp\i_kicavsnkfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  PID:4168
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  PID:3108
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecwu.exe ups_run
  2⤵
  PID:2164
- - C:\Temp\czurmkecwu.exe
    C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecwu.exe ups_ins
  2⤵
  PID:3384
- - C:\Temp\i_czurmkecwu.exe
    C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkeztrmj.exe ups_run
  2⤵
  PID:2052
- - C:\Temp\urmkeztrmj.exe
    C:\Temp\urmkeztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkeztrmj.exe ups_ins
  2⤵
  PID:2412
- - C:\Temp\i_urmkeztrmj.exe
    C:\Temp\i_urmkeztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgbztrljeb.exe ups_run
  2⤵
  PID:3900
- - C:\Temp\mgbztrljeb.exe
    C:\Temp\mgbztrljeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgbztrljeb.exe ups_ins
  2⤵
  PID:4948
- - C:\Temp\i_mgbztrljeb.exe
    C:\Temp\i_mgbztrljeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdytr.exe ups_run
  2⤵
  PID:2324
- - C:\Temp\bvtnlgdytr.exe
    C:\Temp\bvtnlgdytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdytr.exe ups_ins
  2⤵
  PID:1332
- - C:\Temp\i_bvtnlgdytr.exe
    C:\Temp\i_bvtnlgdytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdyvq.exe ups_run
  2⤵
  PID:3124
- - C:\Temp\bvtnlgdyvq.exe
    C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
  2⤵
  PID:4220
- - C:\Temp\i_bvtnlgdyvq.exe
    C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnif.exe ups_run
  2⤵
  PID:2612
- - C:\Temp\nlfdxvqnif.exe
    C:\Temp\nlfdxvqnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnif.exe ups_ins
  2⤵
  PID:440
- - C:\Temp\i_nlfdxvqnif.exe
    C:\Temp\i_nlfdxvqnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run
  2⤵
  PID:2024
- - C:\Temp\ifaysqkica.exe
    C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins
  2⤵
  PID:1724
- - C:\Temp\i_ifaysqkica.exe
    C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2340

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
- Executes dropped EXE
PID:3172

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:1920

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:3980

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:5112

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3624

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\rljdbwtolg.sys
C:\Temp\rljdbwtolg.sys
1⤵
- Executes dropped EXE
PID:4632

C:\Temp\gaysqlidbv.sys
C:\Temp\gaysqlidbv.sys
1⤵
- Executes dropped EXE
PID:964

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\spkicausnk.sys
C:\Temp\spkicausnk.sys
1⤵
PID:4536

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
PID:3124

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
PID:3768

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
PID:3756

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
PID:1940

C:\Temp\qojgbztrlj.sys
C:\Temp\qojgbztrlj.sys
1⤵
PID:4536

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:4484

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
PID:5000

C:\Temp\snlfdxvqni.sys
C:\Temp\snlfdxvqni.sys
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.sys

Path C:\Temp\geywrojhbz.sys
Size 141KB
SHA256 d84d528d7bda2c111102e68e49b70c2d4107ba5f3655c56d491e42b576ac638c
MD5 f44aa7c4cbe96be6d00a611290391268
SHA1 3bb60fe020e745c07b8cec587aa6cfc6d433666d
SHA512 0f54a5c0f136487cd48ae75a43847bdce6c5cd8e840987408c0fd2411084c7c7f2e854f108936436337a51d993170103cc81595ae4eee23b2e6d229cb168b58e
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnlgdq.exe

Path C:\Temp\i_jdbvtnlgdq.exe
Size 243KB
SHA256 58ab193caa1b339e07c8f5fe270101c049a095ddba0a7cb9f73977a6196cf7ef
MD5 263fcd88fb5a5e49f7ee5ee6b310f202
SHA1 676c11659b2610181bb3ad89a95fcaf3f29d87ae
SHA512 2d8a162bd31910f731c224052cdf43875ff7733d09a33ec0321ae95dd5efcdfc00f2ed13bc5cbd69f54b14808923611d60af4f3a0eb78e1bb9655867eef0bfd3
SSDEEP 3072:uBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:Ob3TfLAUa3lLNngoqRttA7y
TLSH
T12134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausmkfc.exe

Path C:\Temp\i_kicausmkfc.exe
Size 243KB
SHA256 8c643c9e6d1fe79e2567515aafe29fb8f2cbe44a5b214de514cda5c47e232785
MD5 77366567c4755e91e64a94b303ecf0d1
SHA1 b2c6499f6c37c43c4cf7ceaf53e56bc7db45b6ef
SHA512 719988ee84a848f4ff8d2fe115dfd323ce5e50036de7ff2f31f99f023946e495dcdf0b5486b69bf7e8a0219a6e83ea081e723beb7ff04d8812140f86201b8f3a
SSDEEP 3072:4Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Ib3TfLAUa3lLNngoqRttA7s
TLSH
T150344A0172818071E75A0B78046AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpjhb.exe

Path C:\Temp\i_mhezxrpjhb.exe
Size 243KB
SHA256 54ba7ac84b331b925f9c2eeb2d1baaf64ac6fde7fe04a98de6cd2829bc4a9c3a
MD5 55981ca591bb79769c19ad8746d2c6e0
SHA1 8609211bf5552ea2f08ce94750f8f20ca3140d23
SHA512 e3a75db7c360f91bd446016d4e2476da24009fcc9355a1bcb782a9de80dba157dc1510fe437a402b462d0cf5db64d40c9e1c23cdee78572ea26eb0f75f12e644
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:ab3TfLAUa3lLNngoqRttA7K
TLSH
T15034490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlfdyvqoig.exe

Path C:\Temp\i_qlfdyvqoig.exe
Size 243KB
SHA256 d4966918770a6dca779765b054f1c5edfa874ed9dc845588710b05eca4b7d6b8
MD5 8d348fdceaba92dc2a00dc9048233e32
SHA1 ca2d0126e2ae4b419a6c1228f23e53844dacac21
SHA512 3f6abf31ab71eb5f2b09a805bbe7511f6f44bb41b1761a63268c7c0dfe8b1de89d73abacf6e6d3b090d97964f412fbbbc28283ca5d10a542cfef9e3b5d5a81c2
SSDEEP 3072:SBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:Kb3TfLAUa3lLNngoqRttA7e
TLSH
T19134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmkecwupmh.exe

Path C:\Temp\i_rmkecwupmh.exe
Size 243KB
SHA256 f0eba9ee175a9aa710436305a73b334ea549e9631021b1ae33e7f30f6c3b4328
MD5 0db3b57dc87e6cd6ae790a4cb282e703
SHA1 ac4eeb55bf9840cd665c16f8f5c9aae98fe73add
SHA512 40c943e5c5bd6a14a6464d30aa5e9ad0f0176e9aa1b67e38e3601523c650118afabfe4e9a151e651fa975e340e39baf61a1492cf2b05f8b5795ce434fa1399c0
SSDEEP 3072:cBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:0b3TfLAUa3lLNngoqRttA7U
TLSH
T1A934490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsqkicavsn.exe

Path C:\Temp\i_xsqkicavsn.exe
Size 243KB
SHA256 d803f2a5a209519331e00e0bb096b3922cce1f683e1e4858ad7e110d03a12bfb
MD5 1b5e996631e868f3a8d9bffc524eff54
SHA1 53011ca3c4b6d5c3dcccd898ef99bf7b21557f6f
SHA512 3c7909b0fda2699b42f5c9266392b957501382d03ad830901c9ce7028b75681333b91c63e657348ee89363a3513690046a2fe1394dd29e45362f9e64561abd19
SSDEEP 3072:XBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:Rb3TfLAUa3lLNngoqRttA7j
TLSH
T10F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmjecwuo.exe

Path C:\Temp\i_ztrmjecwuo.exe
Size 243KB
SHA256 8378361ddeb128b8f8a72d3fd505a95bb2f39e3c8b24ff60fa5647644a20582a
MD5 51826def2671612fab16d0e042a789f8
SHA1 04d3507cbf9c0ebc8a4bb5e0ef04bc5d457803cf
SHA512 09ce06ed79c0de467de932d447bf750641a9760924a2ab0d4298cde74816bbbc06dc8ecda46ac4d90677a6405826b6a117b65789c3891264f6daa619e7caea66
SSDEEP 3072:gBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:wb3TfLAUa3lLNngoqRttA7E
TLSH
T105344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdx.sys

Path C:\Temp\idavtnlfdx.sys
Size 141KB
SHA256 bbbbe1ba153bc809c16dbbc3f31887a72362bb2a76fd805c0a0dd146706fecec
MD5 c0f591e031e3cd18ddffa5889186eae9
SHA1 83fe5cfb504a8b54d611b7844b70c3bf3a0f7074
SHA512 df4f70f5a07edd039e5e8bbb61d95e62d12d6aad80d7c86b18adb6f7bfc57356dc39093500c3274014d21708872e4f4a0849560ef3e01a1f549a67e14fc3a078
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdq.exe

Path C:\Temp\jdbvtnlgdq.exe
Size 243KB
SHA256 75c43b77ec296001c02c7dbd922f5cf4a0f42bf36f773f080a8fa125873b2047
MD5 1290816b237aab91633f40fd7d8794f3
SHA1 5592657e5d759466707a6c0786a369445595248d
SHA512 0ea9c21d1152e562197e616f66b894d6a8e03fe7e0763d983ee3150ad98d468926c4c3afb31d6981b20ca3746f7673ffdf2c4dd82b05272c5edfd557bb16f0d7
SSDEEP 3072:ABb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:Qb3TfLAUa3lLNngoqRttA70
TLSH
T18534490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 141KB
SHA256 fcd216d359ce7f3966860886975349b5ad47edfbeae529d171a673358877d37c
MD5 8fa19004b8578c1beb9d964bb636e219
SHA1 eda75c175a39cfa221a1b227a5063b57314033ed
SHA512 95abab0caf47ebea7808470440d04c2c4dbef6ae35f2b3c2c7fb30c05c8f8b686865d0ec4db07724958ded51de889edf165d281e8dababd93da91890778bbde2
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.exe

Path C:\Temp\kicausmkfc.exe
Size 243KB
SHA256 19f03e3ba68b7a859e45772b0b5a653564690d2838a9748392a7edb66fd8bcad
MD5 64bddeed3b65a662cfb898241cd39fc8
SHA1 b427f21c26c135f77be9d05e3d7d501383a19dc3
SHA512 7a5656bebd14061ead5f5e53a82968eb6d2bb3b0ed06ff3f5b7c6a486f9f912860100ba213514d8f8ae5e3a425cc1c1088dc80969c97214ae582d184339c5dab
SSDEEP 3072:ABb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:Qb3TfLAUa3lLNngoqRttA7k
TLSH
T1F8344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomge.exe

Path C:\Temp\ljdbwtomge.exe
Size 243KB
SHA256 d96de95390a845c564940f2347f5111fc3d549c324ad28a127210056927200d2
MD5 961da6b09a3962fb016d4bce8db88749
SHA1 5127d6fb8f3c70f1964aff53a9d94d07fa584ab0
SHA512 bab773bee406051d5c5009b40d081c8a184c0007d042e73fdb9cd5db76755931488ef6207f96540916611b3cd1a9347467cd1137d7460abd1f8c75694982561d
SSDEEP 3072:4Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:Ib3TfLAUa3lLNngoqRttA7k
TLSH
T17234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.exe

Path C:\Temp\mhezxrpjhb.exe
Size 243KB
SHA256 58b21968033190a8cd80e7462669923d199b9df831a621946a677863a0e7c435
MD5 a3e567dc96175fe3b503a26d73fbd80e
SHA1 22c47777294b71ef6e4536ade18fd77a8837e9bb
SHA512 a69cc15e718578442e59194169ab89d20f84757675a6019eca85c6739fce9ac624a9d79493dc76ca382b9bc5e8b9652d43212926cd050e8f1bd66a03b61d2583
SSDEEP 3072:+Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:+b3TfLAUa3lLNngoqRttA7a
TLSH
T1A9344A0172818071E75A0B78045AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlfdyvqoig.exe

Path C:\Temp\qlfdyvqoig.exe
Size 243KB
SHA256 38448f7b79e19276186c5dc47091e1bf9bb3517e004018a3ad34dd1a27c73ab1
MD5 268ed2cc000db6407ee989a875f7b663
SHA1 41648b9b07c13334528f16317603e1543a9468ba
SHA512 539ee07ef4e29cffe4ab085b2bfa96d04534fb52cfed3a762b55ffeff390fe8283230072a33c004dc26ce805469c61e7ef2e8e8d725615f972f0e77c61c3f646
SSDEEP 3072:/Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:Zb3TfLAUa3lLNngoqRttA7H
TLSH
T18F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwupmh.exe

Path C:\Temp\rmkecwupmh.exe
Size 243KB
SHA256 6319653b8117c2f63558cb058931045a5a48e016931b9e1bd322b5a72f78e06e
MD5 79fd6cc8e8a47665215b630e4bbabfa1
SHA1 f8d009c69102d0e3ce4c35b1b4ec8e8990176a7a
SHA512 71518feaa687762f4fd974756bc51ada33d59ce48e196b0f5d605e1ca65d66bac4bfd424763a4ae5f43fe0ced5c843229b4af55d0b291f7a5d509641e854b8a3
SSDEEP 3072:iBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:6b3TfLAUa3lLNngoqRttA7G
TLSH
T165344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfdxvpn.sys

Path C:\Temp\usnkfdxvpn.sys
Size 141KB
SHA256 95edc0bd07bd0e42f5511703bf5f477c3500a0cd14cc394db1f99828b7523e6f
MD5 c209a7ca66da475ca040273b2170cee7
SHA1 822a52a1ee2fbe5f68cb987f5ea5ab4582754631
SHA512 75303f13ae2923c963da5801f5c80a37d17b738f77baf1722042cc8433878da48329d3dfaeb0fcf83829c78146ba1b3953cfe543e08cc805bcc706eda71b8412
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbytrl.sys

Path C:\Temp\wqojgbytrl.sys
Size 141KB
SHA256 36a165891a60f76ae86fefd2cdbcb3cc9d6fecd496ea08f9fd94a456ef2cbbd0
MD5 73b81ae96140e8ccf02baf554ba72b7d
SHA1 51bde66d4adf083a25b5f538ca0e64eb971130a1
SHA512 f26bfc2c646d37751f592f20c162d202cf8d83150a3be97f277f181d16ce83eb3387ccf1d4f2bec59eeb3daa2e34c1289f25d82885ca4c64f6238fcbe57b4d6d
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczusm.sys

Path C:\Temp\xrpjhczusm.sys
Size 141KB
SHA256 0f8036762a63e072c416e1654f2e5427344ad58b7a085431b2f371bcf8540a13
MD5 38efa3391eb8363aeb5bbd733addcaf4
SHA1 0e46b78f43301b183e449d3bbed4a3aa66b4af16
SHA512 74227793c3070704e98c30174aedbc6e5f662dac4cd2826c09e63caf1d5e9e0ee53a373c2e99a7ecdd6d0fd2bdc0e600b6af1482694490dba77c452272cadfa4
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkicavsn.exe

Path C:\Temp\xsqkicavsn.exe
Size 243KB
SHA256 400b6a43c1b62a362aaa5829a239a9bf016af78ca6fedd561e06325dcfdc19c2
MD5 80ecb20b078181d7d5d0c87d8b2d7547
SHA1 60312a7cc4113a123b4b3f3b494564138ed55b57
SHA512 c2e50bb199902706ca2db133d490dec4323a20cbd365ca06eda870d3ad1d347e4cc36dc6fa1c47a00c3117485e082bbf34d61c094a15d21f4034cafec1e3f0cb
SSDEEP 3072:VBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:/b3TfLAUa3lLNngoqRttA71
TLSH
T13A34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.sys

Path C:\Temp\yvqoigaysq.sys
Size 141KB
SHA256 24553c2ab9a8b659700057c8261f797bfbb2e92aaa08ddc9efe0270223f9e81e
MD5 fffc2e8c544dbd74faaee043468c3f06
SHA1 45d67c18f73e8eb9664d79fe434f27c7e55c4320
SHA512 74113d5c0699d5cd22b0de160ba02882b32423450072973a2eec2a807b253dab5e68fd788bb1bea1f356f9da808c534f3e2359c160d4074c715933d3c49d213f
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.exe

Path C:\Temp\ztrmjecwuo.exe
Size 243KB
SHA256 711180988616d101dbb2226f8babb0dbf0699936cafba6dcae91aa779031861b
MD5 662bb01a7f56e64875119b2aa5dd326b
SHA1 4383dcb09188779c66c0a3712ec432305686f567
SHA512 854b8bc458a823114ede55a63f6fe24d0e35398b0976a48490ea90d6082379b6c8389936f10292455ded50ba4a1849eb0f809802fe1d90d49ba1498810419b75
SSDEEP 3072:tBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:3b3TfLAUa3lLNngoqRttA7J
TLSH
T1A034490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 cbc2cd0f9873d598c7b91533858c85f5cef2dc878ccc9c9ac71407c28fbfa239
MD5 7203bd45c43c621983e58810b6bb60ad
SHA1 9793b14273cd0907e2b53cb37b448fee0e2932b0
SHA512 ac0352469024f99b31a27eabb545195612ffc3020731b0dd008f56c48a2d0c34bb4737a603193d24dbad8c43414d8356f37d8eaca940013d6bb9726bba576109
TLSH
T11AF0DC57C97CB850A92954EC33BC431A3070E6678CC2C26A78B886E1040537F2E0E236
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 743e6b5d9c7298bd0abfef3f6373413c1f5088e7db81cb1d60142013ee2828a0
MD5 6a1e65e1ce95329b44b6a872392fd2af
SHA1 75a8ad110a3e84af706ebf6bc8cf618a2a12ecc5
SHA512 d88aebddcd9db21cb5c2e1d80dbd93d4886d6a42f8bed95b75ebb74b2d1a558c3ad1bfc589823e8904bc4dd1c5ae6cbf2e740e8094a2a4e4d06f99039e6bc3d2
TLSH
T19AE0C02419F6826EF0E8E4344BD6B422946EF136942993B83DD88B08EB02A409D03E35
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG9UOCZZ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/964-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1920-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1940-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2316-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3172-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3624-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3756-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3768-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3980-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4484-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4632-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5112-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads