74eb2deadf1aab67f35156a38fadeca23ade7d25795d04c94d9640ece58d36f9

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe
Size 243KB
Sample261113-bfazfaes5t
SHA256 74eb2deadf1aab67f35156a38fadeca23ade7d25795d04c94d9640ece58d36f9
MD5 6a1a5776aa79d4b5987b32965162665e
SHA1 8494de922710744a3b4927bf58d4b6e421fc9d41
SHA512 a1bc6a1b7cd151e8b366ef40d02107bd490cea4876914881ca8ccbbcf84c2badece0c6bb4469889fce42427a3aecf8ffbb647fe4f837e29f986a6f3479c85301
SSDEEP 3072:nF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:F3frLQsa3lLNngoqRttA7n
TLSH
T17F34590172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5992	CP.exe
1792	oigaytqlfd.exe
2008	CP.exe
5636	CP.exe
5452	i_oigaytqlfd.exe
2076	sidavtnlfd.sys
5060	CP.exe
1252	dxvpnifays.exe
2352	CP.exe
6104	CP.exe
4732	i_dxvpnifays.exe
2784	lfdxvpnifa.sys
4972	CP.exe
2468	spkicausmk.exe
4880	CP.exe
4300	CP.exe
5472	i_spkicausmk.exe
4672	ausnkfcxvp.sys
4208	CP.exe
4312	pnhfzxspki.exe
3504	CP.exe
2704	CP.exe
2592	i_pnhfzxspki.exe
3672	pmhfzxrpjh.sys
1688	CP.exe
1344	hczurmkecw.exe
4800	CP.exe
2504	CP.exe
2600	i_hczurmkecw.exe
5740	mbwuomgezw.sys
4044	CP.exe
1244	trmjecwuom.exe
776	CP.exe
5160	CP.exe
828	i_trmjecwuom.exe
2128	bztrljebwu.sys
1736	CP.exe
4584	lgeywqojgb.exe
2536	CP.exe
4824	CP.exe
4712	i_lgeywqojgb.exe
948	rlgeywqoig.sys
3732	CP.exe
4256	geywqojgbz.exe
5928	CP.exe
636	CP.exe
1788	i_geywqojgbz.exe
5076	fdyvqoigay.sys
332	CP.exe
872	ytqljdbvtn.exe
1116	CP.exe
972	CP.exe
3640	i_ytqljdbvtn.exe
2992	lxvqnigays.sys
1548	CP.exe
3992	sqkidavtnl.exe
5432	CP.exe
4284	CP.exe
5932	i_sqkidavtnl.exe
5948	faysqkidav.sys
2396	CP.exe
3096	nkfdxvpnhc.exe
5364	CP.exe
3840	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysqc.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1248	ipconfig.exe
5576	ipconfig.exe
2240	ipconfig.exe
4640	ipconfig.exe
6128	ipconfig.exe
5144	ipconfig.exe
3312	ipconfig.exe
5736	ipconfig.exe
5376	ipconfig.exe
5892	ipconfig.exe
5852	ipconfig.exe
4636	ipconfig.exe
1788	ipconfig.exe
4572	ipconfig.exe
1796	ipconfig.exe
788	ipconfig.exe
3764	ipconfig.exe
3764	ipconfig.exe
344	ipconfig.exe
4152	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "501296859"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "189771465"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{368A55DB-DEFE-11F1-8FDF-5E640711BF8A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000fb0c7f10340750ac8fbb693e25f6989638ee605fb493f48d1a354b1de0fbc023000000000e80000000020000200000006177579f1043ed0f46d80bd1597b437344c68e5bc542fc72740506c488216fb8200000001fd981e4e10036e54ffc71bf2c0d9408713af8e815cc41f30299b392b0fa80df400000005b7ea36cc4a8e5c1b56a020e69a01f5bbaac78be0e70529e8ea88c9c1974905510cb1e4e053322e16a5bf25885b6eb86ad9c1052289438a94bc18c7445133867	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000f812b01249202e82ed2db4dce23764fed44f44591fc535fd818fe3e2f2954ea2000000000e8000000002000020000000c3fd6a99db70f2692a493f20b07944d7c511af78e6fe988dc61ac01aa1dd8a9a200000000a0e1b88eaaa398d9ffdd59cc127169aaaf3c880706998cc9d142892713b8d7a4000000050ff1a98d4644e09d92ab90b010791729fadca83eb59ff6860062c37ed430eaf693b1f72495088e8e6c1a8dc33c3a0e5baa3bc844ca2ead9a8b4fc3a20ddf274	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e3cd0b0b73dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290123"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290123"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09ed20b0b73dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "184928698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5452	i_oigaytqlfd.exe
Token: SeDebugPrivilege	4732	i_dxvpnifays.exe
Token: SeDebugPrivilege	5472	i_spkicausmk.exe
Token: SeDebugPrivilege	2592	i_pnhfzxspki.exe
Token: SeDebugPrivilege	2600	i_hczurmkecw.exe
Token: SeDebugPrivilege	828	i_trmjecwuom.exe
Token: SeDebugPrivilege	4712	i_lgeywqojgb.exe
Token: SeDebugPrivilege	1788	i_geywqojgbz.exe
Token: SeDebugPrivilege	3640	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	5932	i_sqkidavtnl.exe
Token: SeDebugPrivilege	224	i_nkfdxvpnhc.exe
Token: SeDebugPrivilege	3908	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	3212	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	820	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	2624	i_hezwjhbztr.exe
Token: SeDebugPrivilege	4360	i_bztrljebwt.exe
Token: SeDebugPrivilege	5832	i_wqoigbytrl.exe
Token: SeDebugPrivilege	4768	i_tnlfdyvqni.exe
Token: SeDebugPrivilege	5096	i_vpnifaysqc.exe
Token: SeDebugPrivilege	4412	i_snkfdxvpnh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6140	iexplore.exe
6140	iexplore.exe
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE
3420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 6140	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	84
PID 6140 wrote to memory of 3420	6140	iexplore.exe	85
PID 3864 wrote to memory of 5992	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	89
PID 1792 wrote to memory of 2008	1792	oigaytqlfd.exe	92
PID 3864 wrote to memory of 5636	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	97
PID 3864 wrote to memory of 5060	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	105
PID 1252 wrote to memory of 2352	1252	dxvpnifays.exe	107
PID 3864 wrote to memory of 6104	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	110
PID 3864 wrote to memory of 4972	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	114
PID 2468 wrote to memory of 4880	2468	spkicausmk.exe	116
PID 3864 wrote to memory of 4300	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	119
PID 3864 wrote to memory of 4208	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	123
PID 4312 wrote to memory of 3504	4312	pnhfzxspki.exe	125
PID 3864 wrote to memory of 2704	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	128
PID 3864 wrote to memory of 1688	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	135
PID 1344 wrote to memory of 4800	1344	hczurmkecw.exe	137
PID 3864 wrote to memory of 2504	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	140
PID 3864 wrote to memory of 4044	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	144
PID 1244 wrote to memory of 776	1244	trmjecwuom.exe	146
PID 3864 wrote to memory of 5160	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	149
PID 3864 wrote to memory of 1736	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	153
PID 4584 wrote to memory of 2536	4584	lgeywqojgb.exe	155
PID 3864 wrote to memory of 4824	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	158
PID 3864 wrote to memory of 3732	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	162
PID 4256 wrote to memory of 5928	4256	geywqojgbz.exe	164
PID 3864 wrote to memory of 636	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	167
PID 3864 wrote to memory of 332	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	172
PID 872 wrote to memory of 1116	872	ytqljdbvtn.exe	174
PID 3864 wrote to memory of 972	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	177
PID 3864 wrote to memory of 1548	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	181
PID 3992 wrote to memory of 5432	3992	sqkidavtnl.exe	183
PID 3864 wrote to memory of 4284	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	186
PID 3864 wrote to memory of 2396	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	190
PID 3096 wrote to memory of 5364	3096	nkfdxvpnhc.exe	192
PID 3864 wrote to memory of 3840	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	195
PID 3864 wrote to memory of 212	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	197
PID 904 wrote to memory of 5780	904	pnhfzxspkh.exe	199
PID 3864 wrote to memory of 4064	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	202
PID 3864 wrote to memory of 4088	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	206
PID 3796 wrote to memory of 5520	3796	mhfzxrpjhc.exe	208
PID 3864 wrote to memory of 464	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	211
PID 3864 wrote to memory of 4700	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	215
PID 4604 wrote to memory of 6088	4604	ezxrpjhczu.exe	217
PID 3864 wrote to memory of 4980	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	220
PID 3864 wrote to memory of 3056	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	224
PID 1964 wrote to memory of 1292	1964	hezwjhbztr.exe	226
PID 3864 wrote to memory of 2772	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	229
PID 3864 wrote to memory of 4056	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	233
PID 4544 wrote to memory of 4580	4544	bztrljebwt.exe	235
PID 3864 wrote to memory of 1304	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	238
PID 3864 wrote to memory of 3456	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	242
PID 5660 wrote to memory of 4952	5660	wqoigbytrl.exe	244
PID 3864 wrote to memory of 492	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	247
PID 3864 wrote to memory of 5904	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	251
PID 3536 wrote to memory of 884	3536	tnlfdyvqni.exe	253
PID 3864 wrote to memory of 4356	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	256
PID 3864 wrote to memory of 5320	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	260
PID 824 wrote to memory of 1264	824	vpnifaysqc.exe	262
PID 3864 wrote to memory of 2568	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	265
PID 3864 wrote to memory of 4772	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	269
PID 5040 wrote to memory of 4656	5040	snkfdxvpnh.exe	271
PID 3864 wrote to memory of 3956	3864	2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_6a1a5776aa79d4b5987b32965162665e_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6140 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5992
- - C:\Temp\oigaytqlfd.exe
    C:\Temp\oigaytqlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5636
- - C:\Temp\i_oigaytqlfd.exe
    C:\Temp\i_oigaytqlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6104
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2704
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\hczurmkecw.exe
    C:\Temp\hczurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Temp\i_hczurmkecw.exe
    C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4044
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5160
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1736
- - C:\Temp\lgeywqojgb.exe
    C:\Temp\lgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Temp\i_lgeywqojgb.exe
    C:\Temp\i_lgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3732
- - C:\Temp\geywqojgbz.exe
    C:\Temp\geywqojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:636
- - C:\Temp\i_geywqojgbz.exe
    C:\Temp\i_geywqojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:332
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:972
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1548
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4284
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\nkfdxvpnhc.exe
    C:\Temp\nkfdxvpnhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\i_nkfdxvpnhc.exe
    C:\Temp\i_nkfdxvpnhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspkh.exe ups_run
  2⤵
  PID:212
- - C:\Temp\pnhfzxspkh.exe
    C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
  2⤵
  PID:4064
- - C:\Temp\i_pnhfzxspkh.exe
    C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  PID:4088
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  PID:464
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  PID:4700
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  PID:4980
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwjhbztr.exe ups_run
  2⤵
  PID:3056
- - C:\Temp\hezwjhbztr.exe
    C:\Temp\hezwjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwjhbztr.exe ups_ins
  2⤵
  PID:2772
- - C:\Temp\i_hezwjhbztr.exe
    C:\Temp\i_hezwjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run
  2⤵
  PID:4056
- - C:\Temp\bztrljebwt.exe
    C:\Temp\bztrljebwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins
  2⤵
  PID:1304
- - C:\Temp\i_bztrljebwt.exe
    C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
  2⤵
  PID:3456
- - C:\Temp\wqoigbytrl.exe
    C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
  2⤵
  PID:492
- - C:\Temp\i_wqoigbytrl.exe
    C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\tnlfdyvqni.exe
    C:\Temp\tnlfdyvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqni.exe ups_ins
  2⤵
  PID:4356
- - C:\Temp\i_tnlfdyvqni.exe
    C:\Temp\i_tnlfdyvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaysqc.exe ups_run
  2⤵
  PID:5320
- - C:\Temp\vpnifaysqc.exe
    C:\Temp\vpnifaysqc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaysqc.exe ups_ins
  2⤵
  PID:2568
- - C:\Temp\i_vpnifaysqc.exe
    C:\Temp\i_vpnifaysqc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:4772
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4412

C:\Temp\sidavtnlfd.sys
C:\Temp\sidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:2784

C:\Temp\ausnkfcxvp.sys
C:\Temp\ausnkfcxvp.sys
1⤵
- Executes dropped EXE
PID:4672

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:3672

C:\Temp\mbwuomgezw.sys
C:\Temp\mbwuomgezw.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
- Executes dropped EXE
PID:2128

C:\Temp\rlgeywqoig.sys
C:\Temp\rlgeywqoig.sys
1⤵
- Executes dropped EXE
PID:948

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\lxvqnigays.sys
C:\Temp\lxvqnigays.sys
1⤵
- Executes dropped EXE
PID:2992

C:\Temp\faysqkidav.sys
C:\Temp\faysqkidav.sys
1⤵
- Executes dropped EXE
PID:5948

C:\Temp\usmkecxupm.sys
C:\Temp\usmkecxupm.sys
1⤵
PID:2200

C:\Temp\usmkeuomhe.sys
C:\Temp\usmkeuomhe.sys
1⤵
PID:3004

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
PID:5100

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
PID:4724

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:2860

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:2760

C:\Temp\gavtnlfdxv.sys
C:\Temp\gavtnlfdxv.sys
1⤵
PID:3108

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfcxvp.sys

Path C:\Temp\ausnkfcxvp.sys
Size 141KB
SHA256 ec9dfd2cb95804ad52907154490579b6839952f8f1b203586b472834540e7a97
MD5 d64cceadbc412f580fbf8b3ef76afe3c
SHA1 cf90c3b1861d5ccd4f3daf0eb1d2afcc9aa194d1
SHA512 deede741d4418fdc0d008253449bbdecdc76f28ecc809a4f1a1b71a94bf9262e3cd24c554523cfddc7d97b553aed11c518f3eb4cfab20d5ac017c99435369dd1
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T182E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwu.sys

Path C:\Temp\bztrljebwu.sys
Size 141KB
SHA256 392d05ad425242d3a9d24020fb32fa0c6302c1a408c94660bdd8f7a017c5c385
MD5 51b29737f4d58f2b5934e9853ae05542
SHA1 0cd9462a3d3a851589a81dbebf57ba24d583b2c7
SHA512 39d5e8cb81050e8104071c0ff1b53670eb6bf0d81ced45ccd21bea8d09b20b206781c086f962156faef9558a821f120cbe89255f94ea3f30d1d856b464aa7a26
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifays.exe

Path C:\Temp\dxvpnifays.exe
Size 243KB
SHA256 95abf5c86d7e445ad38ccea1f3c634b00edf679beaabc52ad764721b15527448
MD5 9e5f847518165bfed58f752dc25ea660
SHA1 1db0773f1cd4daaea8c3e69786d0b65170a05682
SHA512 7447312f6d7c59bfc1576c6578c4f1a42064fb3bed22ceaa7b96a1cadce8f6c57d3977994cdb50cf3d12e93a4be578f5b62bf58e706926e5384f4f0917160e99
SSDEEP 3072:BF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:D3frLQsa3lLNngoqRttA7x
TLSH
T1BA345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbz.exe

Path C:\Temp\geywqojgbz.exe
Size 243KB
SHA256 16b6183b6e3db2cca470695798c52f91baeb031851baa7c4c119a2720cce2bf7
MD5 6592e68e61f480ca44eba53b2021a4d4
SHA1 ef7a2b2de49f182ebcde35120a5afc84617b05d8
SHA512 84123a29a3339fbcbff14cae545fc50992963516c84a3a1770e439e868c35182bf255c27f23a3947b76cb1614a9bed87938a0bc422686505c8a90bce8f08f87a
SSDEEP 3072:BF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:D3frLQsa3lLNngoqRttA7R
TLSH
T1B4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmkecw.exe

Path C:\Temp\hczurmkecw.exe
Size 243KB
SHA256 20c9a7a4a97e79a487e955814f9eff5baa8a5a551aa06f9f1cf84fa9e15a1cac
MD5 9765d222e349cae279ac29906cb99cb2
SHA1 a4fa533e0ecd7d3557b64ca0d400031fa627cf0d
SHA512 6bae565af8a8bcb01d6c04c037c0d9bc6e11f809bf5d7a563984b056adc56c261bcb199e3f0eb090506439567a3a5d2b95b3159a5a3ae6a59f63707e3bf91236
SSDEEP 3072:oF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:E3frLQsa3lLNngoqRttA7s
TLSH
T157345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnifays.exe

Path C:\Temp\i_dxvpnifays.exe
Size 243KB
SHA256 cc9d87eb3cd1f272e86e3d6cc800d00ced97dae42c307e99233032b3ec8e876d
MD5 43b9d74967b75e1c7d1d0dfcb14ebd50
SHA1 33bdc38100a0d22e2631f2351ebe8df7d45ec908
SHA512 6be76becf83232d4d2330468380ed785a023a3eb43b9e53a6c62d4ce573dcd1674837e57fc4478101e584b83c00a52fec6a71c4c56f49f884cbb74998a99788c
SSDEEP 3072:hF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:j3frLQsa3lLNngoqRttA7V
TLSH
T1B3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczurmkecw.exe

Path C:\Temp\i_hczurmkecw.exe
Size 243KB
SHA256 ab2de8ef707f9e0a6e6fd2a28a9a1c2928762c8627eeb39f997a539fc70a20ac
MD5 b236c348871221a03b0ae486616b04b6
SHA1 27bd05745f19fd065ce1badfdc0e2d3a5cf960d0
SHA512 1c1983293215a6ae868d84e43bd296e904f7e34ef306a666f534fc720d069c64b7d625ba70caed3990ad150b9d0f7ce23396f77cce922aa28ed915bbe6eb4d88
SSDEEP 3072:eF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:+3frLQsa3lLNngoqRttA7O
TLSH
T1F1345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgeywqojgb.exe

Path C:\Temp\i_lgeywqojgb.exe
Size 243KB
SHA256 5843624e776fea1d743ab6ccee31db2ab713a3dce3521a96486857e22ed25a1f
MD5 9f9aa527b6877d52e1661a6afb1a6456
SHA1 5f56c4867e25d44bcec48888bc323057f1181d84
SHA512 8862b5b11d44bafb3f17fb781298c9440f45a79c6d024cbd3bc31781b4f2eae955011bd6d221a6d27119b326b35a1a3c7a88d7c5cfbda1692584add47dd58f07
SSDEEP 3072:xF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:T3frLQsa3lLNngoqRttA7F
TLSH
T1DD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaytqlfd.exe

Path C:\Temp\i_oigaytqlfd.exe
Size 243KB
SHA256 5902082da982e66b1675e862210030fde704015b40273c920762df64e3c9e660
MD5 75809626638684446bff43e08f6cdaa0
SHA1 eae498097611810a4ea55a2db1b6ee890960385c
SHA512 c62b094ff0b65cc8044617af654d15a2b342d86a8ee47a4b34516fa462c7ccdbb82addacdcc2b3db77030ea95cb0d76052fea1c7f097a8686c5036eabbcc3d98
SSDEEP 3072:IF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:k3frLQsa3lLNngoqRttA74
TLSH
T18F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspki.exe

Path C:\Temp\i_pnhfzxspki.exe
Size 243KB
SHA256 2c2f15119b087e40e3b8cbb32f0cca19b99cdf6a827dbfd688ca5aec4b51fe2d
MD5 b17b18fde17fa5ac7eeca449457cb79e
SHA1 95b7198bd78df7e57cfa8f2fe1ea8ef8b74999a2
SHA512 591d223aad31808a3118f19757ca88c1521f50a5307320ceff3eb79579128763c885f48184364d42e874d78155d67e493ed1f09333f0e67c3781f2da2427487b
SSDEEP 3072:rF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:p3frLQsa3lLNngoqRttA7T
TLSH
T1E8345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausmk.exe

Path C:\Temp\i_spkicausmk.exe
Size 243KB
SHA256 e3bed69d84232fd0475a5559dae0cfd805480c916feec5427c3dd506d4e3df86
MD5 33c0076cffb5f0473ee9b7199ba54fa4
SHA1 347cb2fe99dce2ace22987b14f9ec33500671528
SHA512 48c6895234f748dd943fd028eadf50fca6323406b5b39aae422124e2675f5ef9800dada6b34f18aa38f498329a251a99f486201e016effd9097b7949e1506f86
SSDEEP 3072:kF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:w3frLQsa3lLNngoqRttA7w
TLSH
T116345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecwuom.exe

Path C:\Temp\i_trmjecwuom.exe
Size 243KB
SHA256 c8f5bb620faf9e8fc6814b40ce08e2277940b6e4eb80b8afbf46db895909594e
MD5 86254873f0587b0914904c800d7c8915
SHA1 9390f812024e7254a70e7552979262b0373998cd
SHA512 c4ba7ce455ed3f01b23e04765b1ae10996891e1db16f3e8f91a144528c17e443ebfe8f9143a887a76baaedff44191c5acee5b653060e8c3c8ec2e001e0709932
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:g3frLQsa3lLNngoqRttA7Y
TLSH
T191345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.sys

Path C:\Temp\lfdxvpnifa.sys
Size 141KB
SHA256 7eb53b079d3da2003ad6ec9d34170bd7194a3f9829bfebc1c0b94c6a03dfd734
MD5 6a5d35d19910a86fa155b391a6254a67
SHA1 21b08c745870a8dbce38778894cbaa18aa808e31
SHA512 95162add21ba2b4b0dc0d68f27edfb1b6eedd97f90fed797b6e3c1b0f41ba216a7c65e7eb159330c0a9f02d5cda1d24549e7f6369102ce909565bdea589c3b8a
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqojgb.exe

Path C:\Temp\lgeywqojgb.exe
Size 243KB
SHA256 8a413815438e8d011e631af491971a72967eadf7dca22204b3c327e9ef3dbda0
MD5 143d1d37b33cf4fffef66c196b84fa5a
SHA1 9e72ba0f1e7f9d334757930f49ef46845c4629a4
SHA512 b63a9e5d094f9673888a1944e6d127f32d5acc76753d85806dd8e83822f2504666746ad021656374d760be7b780f060ff5d74a7f54369fc72d770f7926326562
SSDEEP 3072:sF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:43frLQsa3lLNngoqRttA7A
TLSH
T1E3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbwuomgezw.sys

Path C:\Temp\mbwuomgezw.sys
Size 141KB
SHA256 cdccfdfca4531ce89c158fa0e00d4a0c75181e741b9cca379da3c06d77be1eb3
MD5 17fb619ccb77ccf4a9d9781b6ed9eff3
SHA1 2eb7b44e0cbc3f2526912038181f1572a0aa96ef
SHA512 107fc8a05953e889ab57b6d71dcc866d7c462424cd89a72356e0e464cefbf68b7982232031ea385f930effd8ba5507dd576ad501bb735699243003456f35aa98
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqlfd.exe

Path C:\Temp\oigaytqlfd.exe
Size 243KB
SHA256 64906116d2ae442c4ee43e64338ad5c8c0e2a140d240bf2e1c9a2aa2c75339b4
MD5 ae2cb9c9748ee39a06352a3c9982af92
SHA1 38673e936441a9d0a9062a24528d408e5ffbca4a
SHA512 b9ba1f2f34659f1c694c91723afef94c5250d818fca38039c2520c3c0b75d9da913d6d5eaae3050ba571e0a19dc8d6a6685b8753550dab6791e628ab1e225cfa
SSDEEP 3072:vF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:t3frLQsa3lLNngoqRttA7v
TLSH
T129345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 0e433b4020463fe1d94cf7fbd028be4646347055fe0fa66328c8e090f0e6ce15
MD5 ce8b2d011a2fc63f1c2022437b0d4a41
SHA1 02189c06714e0dbee4a73faa576450c4e765cef6
SHA512 2b009707bc86bff80ec9a09b56af7baeb22cb26227f632e040890b758a2a4ec3f277f615a0d9f90f92a76d4cd846f799f4b856d7a833a4701e62b1f1fbf2784d
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.exe

Path C:\Temp\pnhfzxspki.exe
Size 243KB
SHA256 05ecd3d7fbea778a4c6430f96832833a8208f3ab8c56bf3b149a43f2215f42db
MD5 bca8bdebb98e4ab93ccfe5dd86fd68d3
SHA1 7848f8c05b93255d7d4ecc12682b97bfb26abf00
SHA512 700f6769fed26b864101e364200eba8541fa6dcffa2c74f36f584d28c6d067994bac0ab2c0802761ce3fbb84b96a82d6bcb4a0cdf48365b8598f54eca94d7df4
SSDEEP 3072:lF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:H3frLQsa3lLNngoqRttA7Z
TLSH
T190345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgeywqoig.sys

Path C:\Temp\rlgeywqoig.sys
Size 141KB
SHA256 64642f22e1672530078557583148fbbc6c84eb8b1c839680e1ae46893edbc751
MD5 1db777a46ca5337ec7fac6384f87e6c4
SHA1 33bea05bb430fa14e822427532ae0c3f0ee2e844
SHA512 ad0b640d907867cb5889e868c4ef010242e214dd75596a7e70d8e3e1e2655a57e6a085143feafc7ca976b831bce0bafb13de5342fae8c876156d54efcbdbf67b
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sidavtnlfd.sys

Path C:\Temp\sidavtnlfd.sys
Size 141KB
SHA256 f388ea49e18679b1ed83cf10e9d878aac944ec7765770f72d1e1dc58476008d3
MD5 ad1047483481751fdf232b7314d6a329
SHA1 50dcc30debd1d87b33381388cb372d738a852e72
SHA512 205cb65bee1b4cc490a649b57ef9ba6f5b626da3100b5d88b84915b20ab554a1af3eb5b05b074054d4431b6f3c9b40260780a7cf5b4eae2ba021ba3a17bde2e7
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 243KB
SHA256 89ac17ef7e513f5c99f5cac781df1942448d38b52a9b94636853ef11982af919
MD5 443ccc1a0ddd70689357a16b226487bc
SHA1 22c9e66bbc3cb7c45b47d01623fa7c12e698c174
SHA512 505ac4172b339ce06b39f5e6bcbb95a1934e437a99eed31acb5a07f0a604d95d9ba96ff9df5e351c3f88b32f12337ce70f9e2f24afcf842189469b1ced097282
SSDEEP 3072:AF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:c3frLQsa3lLNngoqRttA7c
TLSH
T1E1345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.exe

Path C:\Temp\trmjecwuom.exe
Size 243KB
SHA256 ba1ee1b60e60dbce5e977927bc7bc29a9f02044ce35ce31afb3fe4367043ae5a
MD5 84362e6409377c59af63738d1c5ca101
SHA1 3ec6190a18d526f0a10d8b8398ce9ca4fbf51f98
SHA512 2cec006efe62d69cf0afdaf32b0155412e9ca9f01c633e123385c81f2748f46c989d17ec11a4e8b3e3197a00d2db1de9c93f1209b2bdfc1ede8ba97040177f23
SSDEEP 3072:nF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:F3frLQsa3lLNngoqRttA7z
TLSH
T18F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 4a88320563047a54f3bfa004ef3efbf0710cf1fe4fa35899e5604566c4a7b14e
MD5 c2d0c6ffc9884abf6aa1e5a72ce8c399
SHA1 c101a0ba2e578a522abf47b794be51e5d6a7644f
SHA512 676cbfcedde6590287c098d8b8543a97401ebfbfc67751eda214f74d5daf47c0e92584cfeb64da69f622d2a2cd4cd679a22192c14223cc138f5a0d6fd3aaf608
TLSH
T175F0DC02C8BEB852BF13ACEDA165067E3030AD7264B38817A03901E60BA4B7A561C039
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 df0d3671f17f7a99960e56ae70e8cb343599898df5982134e293215a7b866902
MD5 4e6bd569c82738325f2c785aeb35405e
SHA1 b202637f1a6ed24910890ada8828395481db4aec
SHA512 71cb7a3bcbd1cd2be9081b72401f67d6f8c0b3e63f56cf24af2718b766ef95f189646bfcff70afea515c36084952589f21c91a796bb1b3016bc9db5bd06c3607
TLSH
T180E0C02412FB411EE4F4E0354BD5B426889DF1360418B3F43DC48B08B702A40AC03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2200-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2784-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2860-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3108-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3596-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3672-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4724-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5100-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5948-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads