d77cb4cf48761ef82182483233a624a03bf7c71f109835f5be0658b55a230e49

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe
Size 243KB
Sample261029-xe5cjsfv5p
SHA256 d77cb4cf48761ef82182483233a624a03bf7c71f109835f5be0658b55a230e49
MD5 c90a7c417030b70a117c46c916336c12
SHA1 81eda28912d86a8fb6f75257ddea4f781f5df06f
SHA512 6115ade3879ba0626d3dfee63ad589a1c94e20ac9e8092e0cd197e1ccc43a9bff5cafef1811792bdf0e0c86d059e770a9c6d2b0e36e6b479d75eddc6f35263c4
SSDEEP 3072:dVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:vXP7LQMa3lLNngoqRttA7c
TLSH
T10D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2516	CP.exe
1080	lfdyvqoiga.exe
1316	CP.exe
3280	CP.exe
5488	i_lfdyvqoiga.exe
2076	idavtnlfdx.sys
2880	CP.exe
2424	ysqkicavsn.exe
1300	CP.exe
2136	CP.exe
2172	i_ysqkicavsn.exe
3992	icausnkfdx.sys
1796	CP.exe
4280	snkfdxvpnh.exe
1108	CP.exe
4288	CP.exe
4292	i_snkfdxvpnh.exe
2132	xvpnhfzxsp.sys
5924	CP.exe
4244	pkhcausmke.exe
4556	CP.exe
3792	CP.exe
756	i_pkhcausmke.exe
2728	pmhfzxrpjh.sys
3916	CP.exe
3608	hczurmkecw.exe
1356	CP.exe
5408	CP.exe
568	i_hczurmkecw.exe
5736	ztrmjecwuo.sys
1764	CP.exe
2320	omgeywrojh.exe
3568	CP.exe
3600	CP.exe
5744	i_omgeywrojh.exe
1880	ztrljebwuo.sys
5880	CP.exe
4056	geywqojgby.exe
2544	CP.exe
5124	CP.exe
4576	i_geywqojgby.exe
5584	ojgbztrljd.sys
4600	CP.exe
4248	dbvtolgeyw.exe
3988	CP.exe
5280	CP.exe
1816	i_dbvtolgeyw.exe
2632	dyvqoigays.sys
4380	CP.exe
4920	wqoigaytql.exe
4392	CP.exe
3476	CP.exe
972	i_wqoigaytql.exe
5392	avtnlfdxvq.sys
1824	CP.exe
3992	pnifaysqki.exe
5432	CP.exe
5168	CP.exe
1732	i_pnifaysqki.exe
5472	dysqkidavs.sys
4292	CP.exe
5596	kfdxvpnhfa.exe
3096	CP.exe
548	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztjebwuo.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
872	ipconfig.exe
1984	ipconfig.exe
1496	ipconfig.exe
380	ipconfig.exe
872	ipconfig.exe
1868	ipconfig.exe
3304	ipconfig.exe
3064	ipconfig.exe
376	ipconfig.exe
956	ipconfig.exe
4936	ipconfig.exe
4012	ipconfig.exe
5380	ipconfig.exe
5576	ipconfig.exe
2836	ipconfig.exe
2120	ipconfig.exe
3748	ipconfig.exe
4568	ipconfig.exe
4948	ipconfig.exe
2388	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000008e845db191a9a20edd9535e614a11aebd09f204b2f22cc63cf8b08cd0d343ddf000000000e8000000002000020000000be6f39abc3d66fa15d4199768b1d839aa03432095da9a8a8bd8aabb2ce5e6a5420000000ccd0e1216f0ca860d31d32c7c6b2339a35a693c35fd957f954c327e9aa0d0bba400000004f74bbe30ae78e5eba76a8aa7c41e8de950f85f54a688dd0055eadbfd0f711d7f5f4ac92f9b463bc31d75133e196f679e3c29e33476721f2e46dfe816337f439	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4081694483"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0950ff4d567dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287253"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000cbf35a95ea1c3c0bd713f8754fd8df159fb49d871490509229c19ceb2a9ac7c5000000000e80000000020000200000000b2e4571201715aad8369809949304ed802b41332de7823e7b0171a93ab9d2e420000000602f8eb4a22fc3d650a40bc11ea699bebe8ad3a9b2374e0d1ae2c600355e715240000000de5403793320f1db2a0cb4e7b18663fe9616d38ca65a7d4f216b44a1b28a7ff2a8fbafb01928191dda30e0ee46a1f27384112e50b30bf6869a5a4c41d67c751b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500064593"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4086382364"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05014f4d567dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1EC579BF-D3C9-11F1-8FDF-5E640711BF8A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287253"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5488	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	2172	i_ysqkicavsn.exe
Token: SeDebugPrivilege	4292	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	756	i_pkhcausmke.exe
Token: SeDebugPrivilege	568	i_hczurmkecw.exe
Token: SeDebugPrivilege	5744	i_omgeywrojh.exe
Token: SeDebugPrivilege	4576	i_geywqojgby.exe
Token: SeDebugPrivilege	1816	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	972	i_wqoigaytql.exe
Token: SeDebugPrivilege	1732	i_pnifaysqki.exe
Token: SeDebugPrivilege	4652	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	5412	i_pkicausnkf.exe
Token: SeDebugPrivilege	560	i_nhfzxrpkhc.exe
Token: SeDebugPrivilege	776	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	1756	i_hbztjebwuo.exe
Token: SeDebugPrivilege	5344	i_bwtomgeywq.exe
Token: SeDebugPrivilege	1812	i_tqljdbvtol.exe
Token: SeDebugPrivilege	5060	i_nlfdyvqnig.exe
Token: SeDebugPrivilege	4860	i_qnigaysqda.exe
Token: SeDebugPrivilege	1640	i_faxspkicau.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3864	iexplore.exe
3864	iexplore.exe
3104	IEXPLORE.EXE
3104	IEXPLORE.EXE
3104	IEXPLORE.EXE
3104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3864	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	84
PID 3864 wrote to memory of 3104	3864	iexplore.exe	85
PID 3700 wrote to memory of 2516	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	86
PID 1080 wrote to memory of 1316	1080	lfdyvqoiga.exe	91
PID 3700 wrote to memory of 3280	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	97
PID 3700 wrote to memory of 2880	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	105
PID 2424 wrote to memory of 1300	2424	ysqkicavsn.exe	107
PID 3700 wrote to memory of 2136	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	110
PID 3700 wrote to memory of 1796	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	114
PID 4280 wrote to memory of 1108	4280	snkfdxvpnh.exe	116
PID 3700 wrote to memory of 4288	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	119
PID 3700 wrote to memory of 5924	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	123
PID 4244 wrote to memory of 4556	4244	pkhcausmke.exe	125
PID 3700 wrote to memory of 3792	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	128
PID 3700 wrote to memory of 3916	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	135
PID 3608 wrote to memory of 1356	3608	hczurmkecw.exe	137
PID 3700 wrote to memory of 5408	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	140
PID 3700 wrote to memory of 1764	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	144
PID 2320 wrote to memory of 3568	2320	omgeywrojh.exe	146
PID 3700 wrote to memory of 3600	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	149
PID 3700 wrote to memory of 5880	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	153
PID 4056 wrote to memory of 2544	4056	geywqojgby.exe	155
PID 3700 wrote to memory of 5124	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	158
PID 3700 wrote to memory of 4600	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	162
PID 4248 wrote to memory of 3988	4248	dbvtolgeyw.exe	164
PID 3700 wrote to memory of 5280	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	167
PID 3700 wrote to memory of 4380	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	172
PID 4920 wrote to memory of 4392	4920	wqoigaytql.exe	174
PID 3700 wrote to memory of 3476	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	177
PID 3700 wrote to memory of 1824	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	181
PID 3992 wrote to memory of 5432	3992	pnifaysqki.exe	183
PID 3700 wrote to memory of 5168	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	186
PID 3700 wrote to memory of 4292	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	190
PID 5596 wrote to memory of 3096	5596	kfdxvpnhfa.exe	192
PID 3700 wrote to memory of 548	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	195
PID 3700 wrote to memory of 4588	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	199
PID 4064 wrote to memory of 628	4064	pkicausnkf.exe	201
PID 3700 wrote to memory of 4100	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	204
PID 3700 wrote to memory of 1256	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	208
PID 4800 wrote to memory of 3212	4800	nhfzxrpkhc.exe	210
PID 3700 wrote to memory of 1688	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	213
PID 3700 wrote to memory of 5420	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	217
PID 5972 wrote to memory of 1956	5972	ezwrpjhbzt.exe	219
PID 3700 wrote to memory of 1884	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	222
PID 3700 wrote to memory of 1880	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	226
PID 5252 wrote to memory of 4928	5252	hbztjebwuo.exe	228
PID 3700 wrote to memory of 4200	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	231
PID 3700 wrote to memory of 5584	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	235
PID 2184 wrote to memory of 948	2184	bwtomgeywq.exe	237
PID 3700 wrote to memory of 5032	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	240
PID 3700 wrote to memory of 1896	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	244
PID 492 wrote to memory of 5132	492	tqljdbvtol.exe	246
PID 3700 wrote to memory of 3352	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	249
PID 3700 wrote to memory of 5504	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	253
PID 5460 wrote to memory of 440	5460	nlfdyvqnig.exe	255
PID 3700 wrote to memory of 2392	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	258
PID 3700 wrote to memory of 2004	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	262
PID 5308 wrote to memory of 4004	5308	qnigaysqda.exe	264
PID 3700 wrote to memory of 5540	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	267
PID 3700 wrote to memory of 4412	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	271
PID 4940 wrote to memory of 4420	4940	faxspkicau.exe	273
PID 3700 wrote to memory of 2024	3700	2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe	276

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c90a7c417030b70a117c46c916336c12_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3864 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2516
- - C:\Temp\lfdyvqoiga.exe
    C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\i_lfdyvqoiga.exe
    C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2136
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1796
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4288
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3916
- - C:\Temp\hczurmkecw.exe
    C:\Temp\hczurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5408
- - C:\Temp\i_hczurmkecw.exe
    C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1764
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3600
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5880
- - C:\Temp\geywqojgby.exe
    C:\Temp\geywqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\i_geywqojgby.exe
    C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5280
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\wqoigaytql.exe
    C:\Temp\wqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\i_wqoigaytql.exe
    C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5168
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4292
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:548
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:1256
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
  2⤵
  PID:1688
- - C:\Temp\i_nhfzxrpkhc.exe
    C:\Temp\i_nhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  PID:5420
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  PID:1884
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztjebwuo.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\hbztjebwuo.exe
    C:\Temp\hbztjebwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztjebwuo.exe ups_ins
  2⤵
  PID:4200
- - C:\Temp\i_hbztjebwuo.exe
    C:\Temp\i_hbztjebwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:5584
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:5032
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run
  2⤵
  PID:1896
- - C:\Temp\tqljdbvtol.exe
    C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins
  2⤵
  PID:3352
- - C:\Temp\i_tqljdbvtol.exe
    C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqnig.exe ups_run
  2⤵
  PID:5504
- - C:\Temp\nlfdyvqnig.exe
    C:\Temp\nlfdyvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqnig.exe ups_ins
  2⤵
  PID:2392
- - C:\Temp\i_nlfdyvqnig.exe
    C:\Temp\i_nlfdyvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqda.exe ups_run
  2⤵
  PID:2004
- - C:\Temp\qnigaysqda.exe
    C:\Temp\qnigaysqda.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqda.exe ups_ins
  2⤵
  PID:5540
- - C:\Temp\i_qnigaysqda.exe
    C:\Temp\i_qnigaysqda.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run
  2⤵
  PID:4412
- - C:\Temp\faxspkicau.exe
    C:\Temp\faxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins
  2⤵
  PID:2024
- - C:\Temp\i_faxspkicau.exe
    C:\Temp\i_faxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
- Executes dropped EXE
PID:3992

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:2132

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2728

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:5736

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
- Executes dropped EXE
PID:1880

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:5584

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:2632

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:5392

C:\Temp\dysqkidavs.sys
C:\Temp\dysqkidavs.sys
1⤵
- Executes dropped EXE
PID:5472

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
PID:792

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:4184

C:\Temp\xsmkeuomhe.sys
C:\Temp\xsmkeuomhe.sys
1⤵
PID:2300

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
PID:3056

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
PID:4476

C:\Temp\dywqoigbyt.sys
C:\Temp\dywqoigbyt.sys
1⤵
PID:3908

C:\Temp\gaytqljdbn.sys
C:\Temp\gaytqljdbn.sys
1⤵
PID:6064

C:\Temp\xvqnifaysq.sys
C:\Temp\xvqnifaysq.sys
1⤵
PID:4772

C:\Temp\pkicavsnkf.sys
C:\Temp\pkicavsnkf.sys
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.exe

Path C:\Temp\dbvtolgeyw.exe
Size 243KB
SHA256 c2e0d5d1a91c74558a7512675f1f86c78a69f10399495dd7bb4bc69f33412819
MD5 185d483711654b5fe5ba21e2bbe7d5b9
SHA1 18189bc4b4bd250646c10c4fcf2ef7fc373f093d
SHA512 a780e3184c2a25c05e88d62107f37ed8739b59e041b3b804866a0be41964f337c98cb2b454f7678184852cae6a95e46908ccf35badf374e533e31840a5b64b1a
SSDEEP 3072:+VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:uXP7LQMa3lLNngoqRttA7z
TLSH
T12C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgby.exe

Path C:\Temp\geywqojgby.exe
Size 243KB
SHA256 f120d2918594bf40b90358febc0dc7176100303b899947abd4ff5f93a8fa0a54
MD5 a8ccc204e4684117df439c2d5ee50e13
SHA1 467101776dc341f871006bcedcc900cabb8df0f0
SHA512 2fa396bc88df98e1804f19908e71565cdfec346622dba7a1adf7a76a7e09926f61a7aecd95688e4f68011328d353b00b7841d83bedd80dd8e53546bebbd99f5f
SSDEEP 3072:wVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:cXP7LQMa3lLNngoqRttA7Z
TLSH
T198345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmkecw.exe

Path C:\Temp\hczurmkecw.exe
Size 243KB
SHA256 427ef277a87db91ac9ddea508b8167aaa4e0c716ffa404791bd9ca43d319037f
MD5 f78111dfc227de77c72b6c876cb588b9
SHA1 07a263fd615f6bde3274ee596dcbbe3ea6f52b1b
SHA512 3e8dcc50967463302c5bcf7241946baa9008e60a30e52a633f9e937d17954a429a6880b9ecfc26d9d48b7c3044af18e6343ba8d4ebbe11b848976da9ad77476d
SSDEEP 3072:HVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:1XP7LQMa3lLNngoqRttA7+
TLSH
T149345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojgby.exe

Path C:\Temp\i_geywqojgby.exe
Size 243KB
SHA256 68075b4e493999393499c6f77bb1c9c5470937a008c7aa28ee63ad3e3440dba8
MD5 9da825e85691a8608fbfdad0fc9928f3
SHA1 4df516cd6b96572ed53965afb226a09df7e98d83
SHA512 8f5a3eb7cd962ca7807d814cb6614be84c84bfb7a6e03aa618a964d003753da68283ee94b4cb9bace2e61c383e264847e299920d784804c5567764a59bbd3b1b
SSDEEP 3072:GVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:2XP7LQMa3lLNngoqRttA7H
TLSH
T136345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczurmkecw.exe

Path C:\Temp\i_hczurmkecw.exe
Size 243KB
SHA256 593059208552265efec9f2e7ed65076803ec168c622834392508ffdcadf2af6a
MD5 8ab06c5e2e413a64e846e8041887db43
SHA1 a1d0d0663b9193a1c86a6653b5742d57bdaf1bc1
SHA512 832f1b84cedffb6eb342a2bcb0b0a68e2f9359c0f2d78706560cf389041f420dec9fa5d1294af3ee0058b0629b4a1e1fc6086a7ed73f5559da5087c30dacd6a5
SSDEEP 3072:RVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:DXP7LQMa3lLNngoqRttA7g
TLSH
T106345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqoiga.exe

Path C:\Temp\i_lfdyvqoiga.exe
Size 243KB
SHA256 e60df9c1e178ba92fdddd39f202bffeb33554825fa944965007c4ac2b86ed503
MD5 e190b7469ab6e68dc795a23817a6863d
SHA1 87e90959b6c1af72b5fd3747b056a5314c21dd2c
SHA512 a68edd30bbc5da7eabefff331e0c36e99001391acae2c7b37df829be16bf7d8a1a1f120228455801e734e2a6a6ea7dde4cb1345c5c10c659076d84f09c9916bb
SSDEEP 3072:yVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:yXP7LQMa3lLNngoqRttA7T
TLSH
T140345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywrojh.exe

Path C:\Temp\i_omgeywrojh.exe
Size 243KB
SHA256 cdce9b93211555749cbed750c830029b3c890a734d0dfacc8f1299377c98f552
MD5 c3707c7102a2df9ee7f1c46a98eae2c2
SHA1 9be2b5996cc1228e8d166c600623e28ba89673df
SHA512 05839271d52d8ffde7f94bc1c70f6e46e5e923e8aed19b2c18c02582fb9eb1d0c0139118d5f0d681b576d2ec6b47547623055bf1a3975a7a343d6348e1bb1d19
SSDEEP 3072:gVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:MXP7LQMa3lLNngoqRttA79
TLSH
T18F345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausmke.exe

Path C:\Temp\i_pkhcausmke.exe
Size 243KB
SHA256 ff21cc057508fb1de897e3d3f347fe656f0b33caaad5b395672e90fbc1725801
MD5 ba83c2eb98855cd5afda9f357bba4cac
SHA1 ca9a4776a7058d9d55d91f1aa62096ab8081d391
SHA512 0030c7ee9d8c47d23344581e09294fd78de96b25a1f6b6f51d90b059638a4a6b397f296953786ebe0e45610603eed7f0132ce3ec0064004846efa5d4110b0e5f
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:ZXP7LQMa3lLNngoqRttA7G
TLSH
T1AF345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpnh.exe

Path C:\Temp\i_snkfdxvpnh.exe
Size 243KB
SHA256 6e69589277b839085997ab9fd84a59d508631339a5d2b4faaf0629630b539905
MD5 ed24dfb42e88f5a8638f55da8771ab6c
SHA1 d66b0b6c95c55346889a384e02bf3515b61e6359
SHA512 b0c076de85a4bc64aaa6d6b282db8c30c94b948c49cea772906dfc53d771a5242eac4561f01f67a75993f5215ce2ac17664896aa86d0ae5dfca12b00aebbe2c5
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:aXP7LQMa3lLNngoqRttA7b
TLSH
T100345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavsn.exe

Path C:\Temp\i_ysqkicavsn.exe
Size 243KB
SHA256 c7da82bf31694806f19aac30e168d9d95ae1ee613cdcbe50bacd6859764ac2f8
MD5 6cccef6bb441211e1d0ecf7ef8d45cc6
SHA1 dff2487b2e5753e20d97564d7331c3612a0d799d
SHA512 42a3076d991c754d464f3ec6a73d351fc7e58d212fcaaf6450147e14f3e708fe3ea932e722bae2a38a793260c4670c9fb419aead7c6a6d55445315922828224e
SSDEEP 3072:YVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:kXP7LQMa3lLNngoqRttA7h
TLSH
T187345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausnkfdx.sys

Path C:\Temp\icausnkfdx.sys
Size 141KB
SHA256 ca918a347d048143b6284d5577eb0cdea50b056a98d4505302269d348dbc0a29
MD5 fb295c56b58d4365d3dac866742a6671
SHA1 61144441f258d75ca779937b86efbcf8d236ff1a
SHA512 02f467f4264f021d9fcdea80875af8db51a561c519a4d841d4d61da742e9f327fbc400201c3183ad24d1c8bfac0b9bbb8a11410a7b14448e0e7c2e35d4956bf2
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdx.sys

Path C:\Temp\idavtnlfdx.sys
Size 141KB
SHA256 6ebfd0e6630ba0f8839ca66af1e7bd46ca9af5bb71f45323eae7bc50764dee08
MD5 f985a3468b3afe99823f8c8299c0a6a8
SHA1 96dfd0a04f8ececd7d99b5fc83ed4e7ec74ce5d7
SHA512 486480451ef41124d17c26e1cb78d991a9f5d5e2a0cae728d2e1463f362294b89250ffc6b4742ef83de46410a22b10826fbe44432d127148d84aff32affa2052
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltg:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ECE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoiga.exe

Path C:\Temp\lfdyvqoiga.exe
Size 243KB
SHA256 95c0a1ba3db61927735833e3da4a0c2883f9f0bd44feec93285d1b755a254750
MD5 0601698f2c404952267b133bd7bb9b58
SHA1 307e3f023aaf28e2014923f1219a0ecbf90d19da
SHA512 65980501545c00e380169bd13953ab00cfff79a48be5a824d421e54656abbec62e323e7cca29d9771a68d758404320a0c641e441ce80698d3e93ca69392671c3
SSDEEP 3072:/VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:NXP7LQMa3lLNngoqRttA72
TLSH
T17D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.sys

Path C:\Temp\ojgbztrljd.sys
Size 141KB
SHA256 4f727f6c9e1882998b5b9999389d7f2520df4fc94f780d24466d9626c6e040dd
MD5 092970529d90258710c9cb66bccec13d
SHA1 a1e2ab711f5b88f487eb02324d88c70914131c7e
SHA512 e00c5699700149a8ad814af3afcad0d23b6d80203eaa37c41a496d371efa78e867c2901ac35439146f1c760ad4a27093caab322a294c83a3c42a5c842fa30d2d
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojh.exe

Path C:\Temp\omgeywrojh.exe
Size 243KB
SHA256 33d4f354779452314db505a470a659863fd4fb5074984743414a199d5630254e
MD5 4707df0143090d624b2d10555ce118ea
SHA1 c149cdc4a58bd3af91af3adf446591dc3124a4e3
SHA512 7a5bb956defb862b7624ad827db29fc9eab3265ad70a1b5f8921178759fa12f402c7de00611f2743d77136ff3d495f08357727db46c70038819e36b5746bff81
SSDEEP 3072:8VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:YXP7LQMa3lLNngoqRttA7l
TLSH
T1F5345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.exe

Path C:\Temp\pkhcausmke.exe
Size 243KB
SHA256 9fbfaa131150899527e23778645b7a14fd8f7bdfdd674f17c3d116a7daec471a
MD5 e4e509ef7414c0e7b7ba27676e88efb8
SHA1 f6cea70193816f42bba7ed46517470bc9a551e69
SHA512 00262ae52051b68e16a6bf85656c52737829d19338c02ecd7f4e6546a8e34b86fe05873b241998b655aad86981f1442e419fdd29ece1187d4c3de823dda82852
SSDEEP 3072:SVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:SXP7LQMa3lLNngoqRttA7D
TLSH
T128345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 0e433b4020463fe1d94cf7fbd028be4646347055fe0fa66328c8e090f0e6ce15
MD5 ce8b2d011a2fc63f1c2022437b0d4a41
SHA1 02189c06714e0dbee4a73faa576450c4e765cef6
SHA512 2b009707bc86bff80ec9a09b56af7baeb22cb26227f632e040890b758a2a4ec3f277f615a0d9f90f92a76d4cd846f799f4b856d7a833a4701e62b1f1fbf2784d
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.exe

Path C:\Temp\snkfdxvpnh.exe
Size 243KB
SHA256 620620f098395071388ae78fa774e94969e6728eb9ea52d5eefa758e33ed9036
MD5 feba3aad66f8792ddc044c0fe07f3232
SHA1 a09c77a4517bc873886da46f98cbb213930fa5dc
SHA512 480f85943e50b5fb78d3045b10a3d6e2a17934739fd40a2b31f20dcc657adac5bd0ce1fbeb3009ef74be79ab71685ac0360129c3f204117ebd44da7af15e7699
SSDEEP 3072:mVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:WXP7LQMa3lLNngoqRttA7/
TLSH
T107345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxsp.sys

Path C:\Temp\xvpnhfzxsp.sys
Size 141KB
SHA256 99f983899423faded2cff32926d5e83a6d376c6c4eff8190ec686b4a9a1cdf2a
MD5 dc4c327f080312d489196dcb87d3cf4c
SHA1 2a5ef683ed3f1e1de0c74cb4ed03334bf69bd26f
SHA512 80bc48a94252199ed287f81de474726308cb57d471bac015489c86a9c9129b478c16a82f0034a5b9d612cb4169923058e604fa8ee8336265d68d18f4aa911815
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.exe

Path C:\Temp\ysqkicavsn.exe
Size 243KB
SHA256 0ea505a5d8c8c2ffb5bc00f0d4f7934bac3fe760b73b891b3f1c615dc0ecaaf4
MD5 a539486bae04043cc94728a42019d1d2
SHA1 2b95b37aca971689819b8144457072e32639f0d5
SHA512 59b9f519a1237d094e7a23bed946a71def1e1a1704af7ad9532307e5bc217bedf51af3723c725daf12ffc6c873c04a9f589d471600b0a502eeb4bc29650f35cd
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:aXP7LQMa3lLNngoqRttA7r
TLSH
T19E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuo.sys

Path C:\Temp\ztrljebwuo.sys
Size 141KB
SHA256 c21fe039184eef6ae2f1dfa0aa7c1921510dc16437fb3623135ecf9e19f76e06
MD5 d6fac29a4bf719ee979cca5981f5b00c
SHA1 a9e291d798946ea8ca18dd4680c1239f11136cb9
SHA512 8f4808a702ea99a627533469c5e5718e0d819ba6c889852ec9a72916e705bce62699cbf614e799bb4ac52af924935bb1443dc4ebe2190c9f284a33b352757efc
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.sys

Path C:\Temp\ztrmjecwuo.sys
Size 141KB
SHA256 291bbb676af3f9038bd62c4fd373a02bcec47025150293c4e2c76bdcf3458c79
MD5 4e50ba2e141ae2fd262e999ee3b76a70
SHA1 560c486a714f1badebcaad0a003682bc41e96c63
SHA512 07d81e88dc31d386cf101fa64e344dbcde4cab1fd781422533599a8b64f710f48a6bdab002f918c3602fff10197c3380df78cbe235ba905ca53f384c38f95068
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 797139ac49c2435adb26e593937c5ad7e45d5158821c2758a8e536966897478b
MD5 dd5f41eacc93d6e44c67ab0d72b1b730
SHA1 385664d841eb8ab18fa66703272d05f467c9b10f
SHA512 e1cc514573289ce949269c48cee1c92df4e6eca758369c10d3e91eccffbae2023ef9e1e0e9619595e8ae5825805727d83e21349d1d1738a88ad8c7b166a38222
TLSH
T187F097199228F8A02E00E9E8416993AD70B2B3BA51414223A8BD82D650602EA6BD823D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 e72f5732d1504805f1aa78fe7f591a42586b9f8dee2b453897442b2d10fbf27d
MD5 f667bfc62917dd7f890278767c4518ee
SHA1 415219069f9b1db9b230e1e0441ae00cc872a32f
SHA512 26704c0c00c6bb45ebe80dbf08104d9d3c7fe2ffb2c345fb8a56d2120a1faecf62e8e22ebd0b061f9be21b6c344979cfdff274d4288eefdf7e71efd706aa30e4
TLSH
T1D4E0C02411F6812EE4F8D07547D5B526A5E9F122041CE3B439E55B08A702600FC02D26
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1880-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2300-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2632-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2728-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3056-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3908-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3992-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4296-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4476-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4772-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5392-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5472-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5472-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5584-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5736-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6064-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads