4f39bc3bfdcd50447ed9e9a58af96f3034d3716bc3126dc2e952753c789c4c4f

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe
Size 243KB
Sample261030-ggdplswtav
SHA256 4f39bc3bfdcd50447ed9e9a58af96f3034d3716bc3126dc2e952753c789c4c4f
MD5 44b9e515001be03c7eebb38acf463863
SHA1 53a0040fc759bd18a6223282bf95039e53524d5e
SHA512 0f6a09ca41c4d61a1af19ff608276be61aac34806c0f000ccce9c16342043f5531b034c5c09c03ede0feeb5c4c416e7854e7d7206e254a1be8a2b7271e9d4b7e
SSDEEP 3072:UF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:A3frLQsa3lLNngoqRttA7Y
TLSH
T18A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3920	CP.exe
736	nhcausmkfc.exe
4848	CP.exe
2336	CP.exe
312	i_nhcausmkfc.exe
2360	jhczusmkec.sys
4684	CP.exe
5024	zxrpjhbzur.exe
3356	CP.exe
4676	CP.exe
3892	i_zxrpjhbzur.exe
856	jecwuomhez.sys
4900	CP.exe
4864	rojhbztrmj.exe
2080	CP.exe
5044	CP.exe
3208	i_rojhbztrmj.exe
2320	ztrmjecwuo.sys
4488	CP.exe
4272	ojgbztrmje.exe
3656	CP.exe
532	CP.exe
2944	i_ojgbztrmje.exe
5064	oigbytrljd.sys
3844	CP.exe
752	gbztrljdbw.exe
4896	CP.exe
4200	CP.exe
4280	i_gbztrljdbw.exe
3936	bvtnlgdywq.sys
4716	CP.exe
4368	qoigaytqli.exe
3300	CP.exe
832	CP.exe
4832	i_qoigaytqli.exe
5004	aytqljdbvt.sys
4668	CP.exe
4492	lfdxvqniga.exe
1100	CP.exe
2428	CP.exe
2320	i_lfdxvqniga.exe
1660	qkicavsnlf.sys
2492	CP.exe
2244	idavtnlfdx.exe
4420	CP.exe
2188	CP.exe
4416	i_idavtnlfdx.exe
5084	kfaxspkica.sys
4748	CP.exe
4176	ausmkfdxvp.exe
2760	CP.exe
2260	CP.exe
3340	i_ausmkfdxvp.exe
4552	fzxrpkhczu.sys
3592	CP.exe
3284	usmkecwupm.exe
3676	CP.exe
2064	CP.exe
2140	i_usmkecwupm.exe
4112	hczurmkecw.sys
920	CP.exe
4264	rmkecwupmh.exe
2504	CP.exe
3132	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqli.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2464	ipconfig.exe
4580	ipconfig.exe
1944	ipconfig.exe
60	ipconfig.exe
1444	ipconfig.exe
1788	ipconfig.exe
864	ipconfig.exe
1200	ipconfig.exe
2360	ipconfig.exe
2996	ipconfig.exe
1684	ipconfig.exe
3820	ipconfig.exe
5116	ipconfig.exe
3284	ipconfig.exe
1648	ipconfig.exe
4132	ipconfig.exe
2996	ipconfig.exe
704	ipconfig.exe
2280	ipconfig.exe
2944	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b00000000020000000000106600000001000020000000fa46e7a9f8fcc35840b6b9802d7a7ce529f86057b86ba2e69ab2f190355b704b000000000e8000000002000020000000c07feafaa1460c8f612e89b7133cc90fa14f36468ab8a703cc921e853b29097e2000000010fc5bc5e75939de7df5e4c659c79e30c3a470ab9bae85216abd48a0af28a81240000000589ecdb5fba1bd05d420ced24709992b76ff06e793467e70f3974e105e72e1e6ed4acf0d06aee38ca4ae821ac19358d4f2cbfd2c32c16e835be463704ee67983	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90038f0e3268dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{38028E80-D425-11F1-9982-466A5CF93802} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "215036276"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287346"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b000000000200000000001066000000010000200000001aa73df00473a3bea8871998d166f0ab6b2667ae70efd40136978a325ca942f8000000000e8000000002000020000000462f58b0e02464f440b885dd998233f2afc178e1945acba4f68e1ee18fe4da7d2000000026d5fb04759b146fab3f279489eca8fbb5355d23dcd7e2d6f6999e7b97813bbd40000000af75e5dbb73775e2bfb6d8829c5ace163e9d1d30793c8fbe95cc67e9e166fafeda86f72125b57d8b12770365c965c7c6a759c8fef3a661f0fe63c397665681c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90218a0e3268dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500104149"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "210504686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	312	i_nhcausmkfc.exe
Token: SeDebugPrivilege	3892	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	3208	i_rojhbztrmj.exe
Token: SeDebugPrivilege	2944	i_ojgbztrmje.exe
Token: SeDebugPrivilege	4280	i_gbztrljdbw.exe
Token: SeDebugPrivilege	4832	i_qoigaytqli.exe
Token: SeDebugPrivilege	2320	i_lfdxvqniga.exe
Token: SeDebugPrivilege	4416	i_idavtnlfdx.exe
Token: SeDebugPrivilege	3340	i_ausmkfdxvp.exe
Token: SeDebugPrivilege	2140	i_usmkecwupm.exe
Token: SeDebugPrivilege	4628	i_rmkecwupmh.exe
Token: SeDebugPrivilege	516	i_uomgezwrpj.exe
Token: SeDebugPrivilege	3248	i_omgeywrojg.exe
Token: SeDebugPrivilege	3604	i_jdbvtolgey.exe
Token: SeDebugPrivilege	3516	i_aysqlidavt.exe
Token: SeDebugPrivilege	2748	i_fdxvqnigay.exe
Token: SeDebugPrivilege	1624	i_axsqkicaup.exe
Token: SeDebugPrivilege	1904	i_upnecxupnh.exe
Token: SeDebugPrivilege	2256	i_pjhczurmke.exe
Token: SeDebugPrivilege	3028	i_rmkecwupje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
1520	IEXPLORE.EXE
1520	IEXPLORE.EXE
1520	IEXPLORE.EXE
1520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1980	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	86
PID 1980 wrote to memory of 1520	1980	iexplore.exe	87
PID 1580 wrote to memory of 3920	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	88
PID 736 wrote to memory of 4848	736	nhcausmkfc.exe	93
PID 1580 wrote to memory of 2336	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	98
PID 1580 wrote to memory of 4684	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	106
PID 5024 wrote to memory of 3356	5024	zxrpjhbzur.exe	108
PID 1580 wrote to memory of 4676	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	111
PID 1580 wrote to memory of 4900	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	115
PID 4864 wrote to memory of 2080	4864	rojhbztrmj.exe	117
PID 1580 wrote to memory of 5044	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	120
PID 1580 wrote to memory of 4488	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	124
PID 4272 wrote to memory of 3656	4272	ojgbztrmje.exe	126
PID 1580 wrote to memory of 532	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	129
PID 1580 wrote to memory of 3844	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	136
PID 752 wrote to memory of 4896	752	gbztrljdbw.exe	138
PID 1580 wrote to memory of 4200	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	141
PID 1580 wrote to memory of 4716	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	145
PID 4368 wrote to memory of 3300	4368	qoigaytqli.exe	147
PID 1580 wrote to memory of 832	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	150
PID 1580 wrote to memory of 4668	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	154
PID 4492 wrote to memory of 1100	4492	lfdxvqniga.exe	156
PID 1580 wrote to memory of 2428	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	159
PID 1580 wrote to memory of 2492	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	163
PID 2244 wrote to memory of 4420	2244	idavtnlfdx.exe	165
PID 1580 wrote to memory of 2188	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	168
PID 1580 wrote to memory of 4748	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	172
PID 4176 wrote to memory of 2760	4176	ausmkfdxvp.exe	174
PID 1580 wrote to memory of 2260	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	177
PID 1580 wrote to memory of 3592	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	181
PID 3284 wrote to memory of 3676	3284	usmkecwupm.exe	183
PID 1580 wrote to memory of 2064	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	186
PID 1580 wrote to memory of 920	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	190
PID 4264 wrote to memory of 2504	4264	rmkecwupmh.exe	192
PID 1580 wrote to memory of 3132	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	195
PID 1580 wrote to memory of 3456	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	199
PID 2768 wrote to memory of 3540	2768	uomgezwrpj.exe	201
PID 1580 wrote to memory of 4820	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	204
PID 1580 wrote to memory of 4296	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	208
PID 3016 wrote to memory of 1636	3016	omgeywrojg.exe	210
PID 1580 wrote to memory of 1284	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	213
PID 1580 wrote to memory of 3440	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	217
PID 2184 wrote to memory of 3824	2184	jdbvtolgey.exe	219
PID 1580 wrote to memory of 4968	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	222
PID 1580 wrote to memory of 4172	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	226
PID 3868 wrote to memory of 1968	3868	aysqlidavt.exe	228
PID 1580 wrote to memory of 3428	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	231
PID 1580 wrote to memory of 3892	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	235
PID 1804 wrote to memory of 3320	1804	fdxvqnigay.exe	237
PID 1580 wrote to memory of 2432	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	240
PID 1580 wrote to memory of 1036	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	244
PID 1588 wrote to memory of 3948	1588	axsqkicaup.exe	246
PID 1580 wrote to memory of 4620	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	249
PID 1580 wrote to memory of 968	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	253
PID 3712 wrote to memory of 1948	3712	upnecxupnh.exe	255
PID 1580 wrote to memory of 4876	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	258
PID 1580 wrote to memory of 3972	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	262
PID 1200 wrote to memory of 1612	1200	pjhczurmke.exe	264
PID 1580 wrote to memory of 1608	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	267
PID 1580 wrote to memory of 4552	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	271
PID 2120 wrote to memory of 2068	2120	rmkecwupje.exe	273
PID 1580 wrote to memory of 2884	1580	2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe	276

C:\Users\Admin\AppData\Local\Temp\2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_44b9e515001be03c7eebb38acf463863_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhcausmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3920
- - C:\Temp\nhcausmkfc.exe
    C:\Temp\nhcausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhcausmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2336
- - C:\Temp\i_nhcausmkfc.exe
    C:\Temp\i_nhcausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4676
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\ojgbztrmje.exe
    C:\Temp\ojgbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:532
- - C:\Temp\i_ojgbztrmje.exe
    C:\Temp\i_ojgbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4716
- - C:\Temp\qoigaytqli.exe
    C:\Temp\qoigaytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:832
- - C:\Temp\i_qoigaytqli.exe
    C:\Temp\i_qoigaytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2492
- - C:\Temp\idavtnlfdx.exe
    C:\Temp\idavtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2188
- - C:\Temp\i_idavtnlfdx.exe
    C:\Temp\i_idavtnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\ausmkfdxvp.exe
    C:\Temp\ausmkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2260
- - C:\Temp\i_ausmkfdxvp.exe
    C:\Temp\i_ausmkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:920
- - C:\Temp\rmkecwupmh.exe
    C:\Temp\rmkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:60
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3132
- - C:\Temp\i_rmkecwupmh.exe
    C:\Temp\i_rmkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run
  2⤵
  PID:3456
- - C:\Temp\uomgezwrpj.exe
    C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins
  2⤵
  PID:4820
- - C:\Temp\i_uomgezwrpj.exe
    C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run
  2⤵
  PID:4296
- - C:\Temp\omgeywrojg.exe
    C:\Temp\omgeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins
  2⤵
  PID:1284
- - C:\Temp\i_omgeywrojg.exe
    C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  PID:3440
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  PID:4968
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidavt.exe ups_run
  2⤵
  PID:4172
- - C:\Temp\aysqlidavt.exe
    C:\Temp\aysqlidavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidavt.exe ups_ins
  2⤵
  PID:3428
- - C:\Temp\i_aysqlidavt.exe
    C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  PID:3892
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  PID:2432
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaup.exe ups_run
  2⤵
  PID:1036
- - C:\Temp\axsqkicaup.exe
    C:\Temp\axsqkicaup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaup.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_axsqkicaup.exe
    C:\Temp\i_axsqkicaup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnecxupnh.exe ups_run
  2⤵
  PID:968
- - C:\Temp\upnecxupnh.exe
    C:\Temp\upnecxupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnecxupnh.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_upnecxupnh.exe
    C:\Temp\i_upnecxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
  2⤵
  PID:3972
- - C:\Temp\pjhczurmke.exe
    C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
  2⤵
  PID:1608
- - C:\Temp\i_pjhczurmke.exe
    C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupje.exe ups_run
  2⤵
  PID:4552
- - C:\Temp\rmkecwupje.exe
    C:\Temp\rmkecwupje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupje.exe ups_ins
  2⤵
  PID:2884
- - C:\Temp\i_rmkecwupje.exe
    C:\Temp\i_rmkecwupje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3028

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:2360

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
- Executes dropped EXE
PID:856

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:5064

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\kfaxspkica.sys
C:\Temp\kfaxspkica.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\hczurmkecw.sys
C:\Temp\hczurmkecw.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:1780

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
PID:4024

C:\Temp\qljdbvtnlg.sys
C:\Temp\qljdbvtnlg.sys
1⤵
PID:4400

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
PID:2396

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
PID:1844

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
PID:3488

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
PID:1088

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
PID:2356

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqljdbvt.sys

Path C:\Temp\aytqljdbvt.sys
Size 141KB
SHA256 7dbc1ba6bc2074b37eee4fef7ed794da8d8a4c25f923abdc2d2f6b3b90fe0773
MD5 aca54c693c99d760744ed2fbc1c1c485
SHA1 c86dc5ebee2428c907e512780aea3d63cd57be53
SHA512 2aed9db11eb9a2ddf81207474e79fa1699d7710b3c2edd8fb5e74b1d9cf0aaa94140665ae64606e91563fb92991ff782c09ddde16584282508aa94bede5f7dc6
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.sys

Path C:\Temp\bvtnlgdywq.sys
Size 141KB
SHA256 c3a117a367de11476fcd2fbecf575a64e43882305d0f9441a14e805f097c1dab
MD5 46949a13c11709ca71f8f938af1c2c16
SHA1 e80d9df8061b38fe4c6964b0b10f74e01d54e426
SHA512 cd863188b92dd786f2b7706ee32aac794c494f8fb215be1c7d4f41b82326d15a09a73fb0fa786978921cad8e649dfc7f5da47d12cbf8bacda04840d485e9e0e1
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljdbw.exe

Path C:\Temp\gbztrljdbw.exe
Size 243KB
SHA256 cd003954103d8eefa4ad5a16e415b7c828291a09367848561ba9928fc03589e5
MD5 4bc95c713ef56b8a4fdd6a8736121471
SHA1 3661212218783f491879e6a9d3736398d825fac4
SHA512 31a82fd4f6b1f12f57e8a0133768ac211324d0b527e6a9d641be7221b2185fefdf1c462394252a7bfda1a97596c79efa5a7aad598917e7c50b10acb151075784
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:m3frLQsa3lLNngoqRttA7K
TLSH
T148345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljdbw.exe

Path C:\Temp\i_gbztrljdbw.exe
Size 243KB
SHA256 21af293a3e8fc845aad53c04c40b9e83724d7b4e81c831fb1578345d863f5370
MD5 71be1571dce827c0b4c3f1c2ee8d13fc
SHA1 4f46c2defaa1b7c48169c1349a77498b12b9f762
SHA512 755e225152d6a12c211854cb4dab6df46dfbc70e4952581a31fe9809ab263423d9ba589fa7d5ee7d25878c095d60da9c85ba01a8f69897b5d9d6c3b8cf1c0393
SSDEEP 3072:GF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:G3frLQsa3lLNngoqRttA76
TLSH
T1CB345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqniga.exe

Path C:\Temp\i_lfdxvqniga.exe
Size 243KB
SHA256 2824eecd883cc453edcf43eafb981e324632e7be29841ba0c09a0628f7365543
MD5 ea2049b19e939c4514e2d4b687dfef48
SHA1 c7f2f5035c66bb578f9bde97559e0890af3723a3
SHA512 4343084ead48ea9aa090afd48a2986c802a23e4e5d6bfa9da589d6566b928be53a842bdbae8ac599bb3f52683e5e4c0fe4de908a1b1bcd890d7101e61357eb8d
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:Q3frLQsa3lLNngoqRttA7g
TLSH
T123345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhcausmkfc.exe

Path C:\Temp\i_nhcausmkfc.exe
Size 243KB
SHA256 1a10331441f03406dc3a9ed330b37d808ced37a68e1a744bd800d763d2d95a89
MD5 5ccde4b48336e5e885fcc2bb306447fb
SHA1 c1a1727e1921ccc0343a64e2a61d40b93e0f55ac
SHA512 97d1047001e16a1a7086b4296a469ea6a25bb66f760e166e3fe02ccba676ccb568a2c9473ac20e392e8a3b26aafb947c72fce818c1bcbf2a896ffb678979342b
SSDEEP 3072:GF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:G3frLQsa3lLNngoqRttA7K
TLSH
T10F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbztrmje.exe

Path C:\Temp\i_ojgbztrmje.exe
Size 243KB
SHA256 350f6f835833e57b03ff0f985a54edf7cdd958a5a398ccd2709e6b47de65e036
MD5 4244ac76bf8a00995c4ca79a0599ee42
SHA1 8811076acfd25325073144afc147ba7291275f09
SHA512 84296a8b85b31f802f991779eb38f3d23a56da2807dacf916c8abf5fd60e3ac41527b886d36a4de95e57be39346d5ccf71f6f58e0c5e6f28061b169be7645c82
SSDEEP 3072:1F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:33frLQsa3lLNngoqRttA71
TLSH
T139345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaytqli.exe

Path C:\Temp\i_qoigaytqli.exe
Size 243KB
SHA256 0acc450d144e24914cab3eaa7a9452006ab274fb76742ec3bad28ae89d57f5e8
MD5 2530abaaea0ae14076db949e41608377
SHA1 20bde6c80589c3d4c10f68e4f8ca904c7cdcdd71
SHA512 5113315b0a0be9a35f2ef62d1da867f34e7d6060bc65eb83c74d2e7afec6855af946eb265a2730ffc58021335f347822c423fdcebcede9bf68d15151ff125e5e
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:g3frLQsa3lLNngoqRttA7U
TLSH
T112345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrmj.exe

Path C:\Temp\i_rojhbztrmj.exe
Size 243KB
SHA256 77f9e3f549624e514ed01331fb0774e75ba9232b168ce6d7dc47c63b30ec51b1
MD5 aa232bcff22c7975443fe1d95ed85a7e
SHA1 54b50f3760da5db4a801d4bf7af942d652d321db
SHA512 4b9449b30f973392c732fd974be8115f169392c8dfbcd3d0ae514038af988f1c85d9eb62e2b9d22e3c4b1ecb6f515e77c45dec19db6f5b6464125a2c6276214f
SSDEEP 3072:8F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:o3frLQsa3lLNngoqRttA7U
TLSH
T1CC345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhbzur.exe

Path C:\Temp\i_zxrpjhbzur.exe
Size 243KB
SHA256 348a8a7e03fc218685f6e5d4df26ea777c4a708dd3fdd9bbb47f843e38c9480d
MD5 f8f89d47170ffa662d2c56aaaae9e951
SHA1 466a250efe9452ef1ed2575e84dc6a749f101947
SHA512 eac63bb1f6b7ddce1bceeb401b84094138909a3e38f2a0cd23db21257aa2bcb6bec5113a0078322d3e8a104d5b99bd56470891bcd6b0177667d8e761bbb0c9d5
SSDEEP 3072:lF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:H3frLQsa3lLNngoqRttA7J
TLSH
T143345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdx.exe

Path C:\Temp\idavtnlfdx.exe
Size 243KB
SHA256 53c23d75e9a33730ad5d5751bae602d0b0b42d352c1a72b1323244c1e07a7f34
MD5 6b4aa16e878ca4bcde292d1622cedda6
SHA1 15faae9c23b9e89e8a95248eadc8379b0fe8a932
SHA512 3ee479b4492be8e040f08886b5638c932df085b1fdbd395f554f1cc448649a33fd53f3c520510324958e2f9408a960d192e3b48c531c30f375c2d1afd95005b2
SSDEEP 3072:NF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:v3frLQsa3lLNngoqRttA7t
TLSH
T1F5345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomhez.sys

Path C:\Temp\jecwuomhez.sys
Size 141KB
SHA256 05eb1c8f9fbffa524620177526fec162b88e06f83bacee7241cdb0cfc2b43d80
MD5 464b5f445fa5c45dc718298ca1fa3a1c
SHA1 0bb5efebd6f858da81ba4715e98a1dc2fb58f066
SHA512 90c9f1b653999c37a187bd75c7007c102d92fc249862ee465fe291046fcce6cea6669873d55f20541180efe9eb4e428ac6c27721d9b5a9651d058cfaac4e939d
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.sys

Path C:\Temp\jhczusmkec.sys
Size 141KB
SHA256 9d77438d2eeffce7cf7d49c1c9e6c3e2a0875680dc76ccdf84e731e3eac36b13
MD5 ecb096c38f6f60da59a8208c2ee4bc36
SHA1 e49d633eed59c86a6727927e3b01443a6bcaba74
SHA512 6798b4d37fdf1a77d71091d839ef11fd6cd012ef03b2c939a0378ea21b0d2c67ee26b66694248cb6c08df8d2279bdbaee6d1c720cfad4f29f37b3e5aaf7857dc
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqniga.exe

Path C:\Temp\lfdxvqniga.exe
Size 243KB
SHA256 df74e747d6fb21772a2dc54449654f34e2f332e9067bc522d7d644b0ef2f5ebc
MD5 ab27aee18a2cff7dfb2f534f85585bd7
SHA1 5fb651ade8ed3ea7f08332dd37bcfa110b46c37a
SHA512 69d0e3cd43326609a91fdfd865fa398bcbe525c3e75d61d47d2e9ce3e5b68b9e366abe1493c219c01fdbc3d352f21c0c5783e93e958c34448087bfede4b4a71a
SSDEEP 3072:2F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:W3frLQsa3lLNngoqRttA7e
TLSH
T148345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhcausmkfc.exe

Path C:\Temp\nhcausmkfc.exe
Size 243KB
SHA256 7a4191339c53aed221e7138b266e199b8e53a1e37724d01035ff791b6c14cbfa
MD5 afe9657e30f8ff4ef3c431f4d0d58e7f
SHA1 e6ed41523d7c3a47b4f44253538cb814026491a9
SHA512 c1bfa2985f59b4bd4c066debfe9c8acb65fed1569eaeac0fd6efc48227aee17d7def1a92c4c72e355ed4996ffa086a4e31a653b4452fb6a285080c5d2b8e9583
SSDEEP 3072:pF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:L3frLQsa3lLNngoqRttA7J
TLSH
T199345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 59cc0d595a095601a506eef2db9e42a60c0b57a0f13d27734574dbb64712f73e
MD5 04fc5e063df344cec3addf7d56077c1d
SHA1 e2094eef0b5c49e941e75d620a04a2e57de3a0aa
SHA512 b936575ce17324822a19ff3cd88fe82870ed025077648e23881b397516ec42ed51eb02a2ebb9a5d43b5603ffad7b099ff41edfdf4d7fe6005a92103abda943cb
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrmje.exe

Path C:\Temp\ojgbztrmje.exe
Size 243KB
SHA256 b456c0e7afc54035354af72ecc6ffa369f314e449b7a2237a1ca3b30ccd29975
MD5 2d77afeda8e093cc202232c5dd15af72
SHA1 d4c74f3c3c43acb17b90420ee1f0722c0c7c0af6
SHA512 3d9aab878297b6da96bfe1ea7ed03b63a6485d9f133f70534beca1d193e13a160860466921057798d07af90ef140c4fbc61bd336aa3fbe6ecb7cf21ec3ffe316
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:Q3frLQsa3lLNngoqRttA7E
TLSH
T1BC345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.sys

Path C:\Temp\qkicavsnlf.sys
Size 141KB
SHA256 815daaab8b1bbf942ed0fa1592e456f2610c2299f95ebb7d92f1f754758b5fff
MD5 7048068ba0b3647f09b0118793a9381f
SHA1 6d991d696b53064e20d5133a8c3d65e7af251816
SHA512 2ee22bff584857a3615e2a08a030263ca70322e30915cd4adc2936a72dff3eed0c9eea7d7af7a9e98e38938cd655b27d3721f198cfbf47e58e6358b89f2d9890
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqli.exe

Path C:\Temp\qoigaytqli.exe
Size 243KB
SHA256 175e554035b401e2b0e61818e23f12da360d98a87bca9a698c800cde491fea0b
MD5 e983336c488a0cf4a4e24d25542d74c6
SHA1 a9b34bfaf6bc6c3021571764000348b4b4e8ac90
SHA512 509c9761ea9ddb3c6e152651d85773b4ecbea0ae292722878b8ee4c8945af933dce54d8c861cc0acccf432febee97e1d4948029c14e1eec1efe0eae94916ed90
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:03frLQsa3lLNngoqRttA7o
TLSH
T166345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmj.exe

Path C:\Temp\rojhbztrmj.exe
Size 243KB
SHA256 22393a9669f93662f2f367c9c1af8e45cf787e02499e2128be15e3e95b14f0a6
MD5 3d6333ba89acad227099ee757fb0d0e3
SHA1 b64d9287cd088dac45adfa8d4cb526004c1f2dd8
SHA512 a0a6258c01634b01568692d93e7e77f947706776f78526a5d9d98a24eb2802c6433491791c312a72c734aa6a1abbdee12e2f468138aa369e8f1b6a6456454948
SSDEEP 3072:CF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:S3frLQsa3lLNngoqRttA7S
TLSH
T125345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.sys

Path C:\Temp\ztrmjecwuo.sys
Size 141KB
SHA256 eb0ba1e9852f0cebe279a330b7c9d52724ac3c4b31ddc5654af6759618cc42a7
MD5 ab0a8cacaf9ee4f3b1754543f7047221
SHA1 5499a1fd2c18fd5e7b0b3cbef0f497fee924c8e3
SHA512 0ed8f967d318fcffa36ee59c8ed063424af67b6d0571882e72f47e1eaf9dbb55fee5a2d1364a0ffce26201c6d5d864d5af933e2e00c0661a349c0750fbe9054e
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T163E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.exe

Path C:\Temp\zxrpjhbzur.exe
Size 243KB
SHA256 554ed2b72e5a3059510c4595fe61738d442d6a6dad9f8e0d01ab90227be7f1e6
MD5 e64a2a905685b1e528eb045b14a59954
SHA1 46b9d223fce772d1be4d8b98312d78756761a0e2
SHA512 57c6466d3013ee7f525c3a5cbdfe4ada5b74d84f1dfa73773b7c3024f73cab69661b2932bb64a276f107f73ad023283f50a517429f0becff92c237aab1472abe
SSDEEP 3072:2F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:W3frLQsa3lLNngoqRttA7q
TLSH
T1CD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 cbc2cd0f9873d598c7b91533858c85f5cef2dc878ccc9c9ac71407c28fbfa239
MD5 7203bd45c43c621983e58810b6bb60ad
SHA1 9793b14273cd0907e2b53cb37b448fee0e2932b0
SHA512 ac0352469024f99b31a27eabb545195612ffc3020731b0dd008f56c48a2d0c34bb4737a603193d24dbad8c43414d8356f37d8eaca940013d6bb9726bba576109
TLSH
T11AF0DC57C97CB850A92954EC33BC431A3070E6678CC2C26A78B886E1040537F2E0E236
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 4fa56c40f1ef8ef5dffeb7f95ec443228b89257adcc57a9f622d107aebb40429
MD5 860fa2eff453b4495fd01a079dbe2d0c
SHA1 d1b5088a363906e1e55cc0d8c9c386d6f4a4aa56
SHA512 6b8ecc6f410ed6aeb4848ba69bb15babef6c4c9830e0b5566ad5fbeef5fed78e355b9c603c5082dac618f8d7fb851807aacfda2cca4e2d07951a11f591a03dd7
TLSH
T175E0C02426F7426EF0F8E4344BD9B42285AEF132942993B83DC49B08EF06B00DC03E29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG9UOCZZ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1780-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1844-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2356-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2360-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3488-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4024-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4116-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5064-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5084-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads