9f3dbc22384ca2976c0a85f6d7543989eeb3cc399637dabf457b629eefbd34d5

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe
Size 243KB
Sample261113-e62fvszx5k
SHA256 9f3dbc22384ca2976c0a85f6d7543989eeb3cc399637dabf457b629eefbd34d5
MD5 413bca9a6c8e90b0115352a095b23cc7
SHA1 6d5a5f1b983cb7d0df45d0fbcb5e7b44a1b67345
SHA512 db65fbafd80a91078cd551cdb5b2e2756aebea3c7bb0c718fb87541566d6a34526d82aec4be03ded3500476e93c961ecc0043bb800188a7aec3dbe076a8420f0
SSDEEP 3072:bF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:53frLQsa3lLNngoqRttA7f
TLSH
T116345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
756	CP.exe
2208	sqkicausnk.exe
4404	CP.exe
3060	CP.exe
2024	i_sqkicausnk.exe
4048	mkfcxupnhf.sys
464	CP.exe
744	causmkfcxv.exe
820	CP.exe
4332	CP.exe
4832	i_causmkfcxv.exe
2680	czusmkecwu.sys
2748	CP.exe
4900	upmhezxrpj.exe
3608	CP.exe
4512	CP.exe
3480	i_upmhezxrpj.exe
3280	zurmkecwup.sys
4716	CP.exe
4196	gezwrpjhbz.exe
3812	CP.exe
1756	CP.exe
2088	i_gezwrpjhbz.exe
888	rpjhbztrmj.sys
4788	CP.exe
2872	jeywrojhtr.exe
4960	CP.exe
1912	CP.exe
4708	i_jeywrojhtr.exe
4336	eywqojgbyt.sys
3944	CP.exe
1308	trljdbvtol.exe
4660	CP.exe
5112	CP.exe
1808	i_trljdbvtol.exe
2444	tqljdbvtol.sys
1656	CP.exe
2592	lgdywqoiga.exe
1652	CP.exe
1772	CP.exe
1604	i_lgdywqoiga.exe
3804	qlidavtnlx.sys
3432	CP.exe
4520	avtnlfdyvq.exe
5084	CP.exe
4320	CP.exe
4400	i_avtnlfdyvq.exe
1612	lfdxvqnifa.sys
3676	CP.exe
516	aysqkicank.exe
556	CP.exe
1620	CP.exe
2600	i_aysqkicank.exe
5040	idxvpnhfax.sys
2160	CP.exe
3724	usmkfcxvpn.exe
3824	CP.exe
2120	CP.exe
2680	i_usmkfcxvpn.exe
5092	usmkecwupm.sys
3788	CP.exe
5008	mkecxupnhf.exe
3528	CP.exe
4580	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywrojhtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywrojhtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2720	ipconfig.exe
3592	ipconfig.exe
1308	ipconfig.exe
4592	ipconfig.exe
3840	ipconfig.exe
4388	ipconfig.exe
2368	ipconfig.exe
3016	ipconfig.exe
2484	ipconfig.exe
3104	ipconfig.exe
2020	ipconfig.exe
2096	ipconfig.exe
4684	ipconfig.exe
1684	ipconfig.exe
4944	ipconfig.exe
516	ipconfig.exe
3700	ipconfig.exe
1472	ipconfig.exe
3480	ipconfig.exe
456	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1178693903"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290152"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c30000000002000000000010660000000100002000000058372b7c2d18a6e74c6e404bffec6d2dd57a2bbcbff4d4310bb641fc74ea8aaa000000000e80000000020000200000006c310ba833c1530b7a144e25d811124955c61bee74973bcd8183c593e1fb93002000000052930e81cd24659c8df4e5889b319c29e8cc2543759b21c9486d789187fa7261400000008c59e67c65e2ca9440e68199574b3f4db1e28066696e0a204ff2b3c7de210a25dd9cb055ddcae5a8d37653076ea33f39b027183fb0bac920ba9e4fed450e0b2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{715E4E03-DF1B-11F1-A0CA-621E4F736A29} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fcd9462873dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "501309414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1175256068"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c300000000020000000000106600000001000020000000fdabfe1b7139a58e8ce742347005bf67df554bf8b1379d7dc5ee3ddc16e9cbaf000000000e80000000020000200000009d3851c2b11b4fdccdddc22f3d258e235098844ff12f044bab3bb513aba4c9ef200000005b0842a1b8081ae2bc6108f1f23e9393e5d96708e1de67126e8f67b015baec1840000000a90ea9911cf51b43d4b1e19661b7834bb783d75ae9634567181328330b351c6e17580c3d017c7e425e71c3115c6c0615caf7fd869c8695c6775f650a27e01d72	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290152"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d0d2462873dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	i_sqkicausnk.exe
Token: SeDebugPrivilege	4832	i_causmkfcxv.exe
Token: SeDebugPrivilege	3480	i_upmhezxrpj.exe
Token: SeDebugPrivilege	2088	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	4708	i_jeywrojhtr.exe
Token: SeDebugPrivilege	1808	i_trljdbvtol.exe
Token: SeDebugPrivilege	1604	i_lgdywqoiga.exe
Token: SeDebugPrivilege	4400	i_avtnlfdyvq.exe
Token: SeDebugPrivilege	2600	i_aysqkicank.exe
Token: SeDebugPrivilege	2680	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	4532	i_mkecxupnhf.exe
Token: SeDebugPrivilege	4928	i_kecwupmhez.exe
Token: SeDebugPrivilege	3976	i_mjecwuomhe.exe
Token: SeDebugPrivilege	4708	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	2680	i_bvtolgeywq.exe
Token: SeDebugPrivilege	1464	i_qlidavtnlf.exe
Token: SeDebugPrivilege	4928	i_sqkidavtnl.exe
Token: SeDebugPrivilege	1712	i_pnifaxsqki.exe
Token: SeDebugPrivilege	3080	i_khcausmkec.exe
Token: SeDebugPrivilege	2652	i_hczurmkecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3764	iexplore.exe
3764	iexplore.exe
4804	IEXPLORE.EXE
4804	IEXPLORE.EXE
4804	IEXPLORE.EXE
4804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3764	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	85
PID 3764 wrote to memory of 4804	3764	iexplore.exe	86
PID 4292 wrote to memory of 756	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	87
PID 2208 wrote to memory of 4404	2208	sqkicausnk.exe	90
PID 4292 wrote to memory of 3060	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	93
PID 4292 wrote to memory of 464	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	102
PID 744 wrote to memory of 820	744	causmkfcxv.exe	104
PID 4292 wrote to memory of 4332	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	109
PID 4292 wrote to memory of 2748	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	113
PID 4900 wrote to memory of 3608	4900	upmhezxrpj.exe	115
PID 4292 wrote to memory of 4512	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	118
PID 4292 wrote to memory of 4716	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	122
PID 4196 wrote to memory of 3812	4196	gezwrpjhbz.exe	124
PID 4292 wrote to memory of 1756	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	127
PID 4292 wrote to memory of 4788	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	132
PID 2872 wrote to memory of 4960	2872	jeywrojhtr.exe	134
PID 4292 wrote to memory of 1912	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	138
PID 4292 wrote to memory of 3944	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	142
PID 1308 wrote to memory of 4660	1308	trljdbvtol.exe	144
PID 4292 wrote to memory of 5112	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	147
PID 4292 wrote to memory of 1656	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	151
PID 2592 wrote to memory of 1652	2592	lgdywqoiga.exe	153
PID 4292 wrote to memory of 1772	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	156
PID 4292 wrote to memory of 3432	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	160
PID 4520 wrote to memory of 5084	4520	avtnlfdyvq.exe	162
PID 4292 wrote to memory of 4320	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	165
PID 4292 wrote to memory of 3676	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	169
PID 516 wrote to memory of 556	516	aysqkicank.exe	171
PID 4292 wrote to memory of 1620	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	174
PID 4292 wrote to memory of 2160	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	178
PID 3724 wrote to memory of 3824	3724	usmkfcxvpn.exe	180
PID 4292 wrote to memory of 2120	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	183
PID 4292 wrote to memory of 3788	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	187
PID 5008 wrote to memory of 3528	5008	mkecxupnhf.exe	189
PID 4292 wrote to memory of 4580	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	192
PID 4292 wrote to memory of 2908	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	194
PID 3768 wrote to memory of 3284	3768	kecwupmhez.exe	196
PID 4292 wrote to memory of 764	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	199
PID 4292 wrote to memory of 3896	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	203
PID 3200 wrote to memory of 2564	3200	mjecwuomhe.exe	205
PID 4292 wrote to memory of 4296	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	208
PID 4292 wrote to memory of 4140	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	212
PID 3468 wrote to memory of 4048	3468	ebwuomgeyw.exe	214
PID 4292 wrote to memory of 3276	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	217
PID 4292 wrote to memory of 1692	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	221
PID 872 wrote to memory of 2180	872	bvtolgeywq.exe	223
PID 4292 wrote to memory of 1324	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	226
PID 4292 wrote to memory of 3368	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	230
PID 5012 wrote to memory of 552	5012	qlidavtnlf.exe	232
PID 4292 wrote to memory of 3784	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	235
PID 4292 wrote to memory of 3100	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	239
PID 368 wrote to memory of 1456	368	sqkidavtnl.exe	241
PID 4292 wrote to memory of 4364	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	244
PID 4292 wrote to memory of 4348	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	248
PID 1660 wrote to memory of 4596	1660	pnifaxsqki.exe	250
PID 4292 wrote to memory of 3892	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	253
PID 4292 wrote to memory of 5060	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	257
PID 1420 wrote to memory of 4908	1420	khcausmkec.exe	259
PID 4292 wrote to memory of 1224	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	262
PID 4292 wrote to memory of 2504	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	266
PID 2580 wrote to memory of 4480	2580	hczurmkecw.exe	268
PID 4292 wrote to memory of 2820	4292	2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe	271

C:\Users\Admin\AppData\Local\Temp\2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_413bca9a6c8e90b0115352a095b23cc7_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3764 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:756
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3060
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhezxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\upmhezxrpj.exe
    C:\Temp\upmhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhezxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\i_upmhezxrpj.exe
    C:\Temp\i_upmhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4716
- - C:\Temp\gezwrpjhbz.exe
    C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Temp\i_gezwrpjhbz.exe
    C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywrojhtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\jeywrojhtr.exe
    C:\Temp\jeywrojhtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywrojhtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\Temp\i_jeywrojhtr.exe
    C:\Temp\i_jeywrojhtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3944
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\avtnlfdyvq.exe
    C:\Temp\avtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\i_avtnlfdyvq.exe
    C:\Temp\i_avtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicank.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Temp\aysqkicank.exe
    C:\Temp\aysqkicank.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicank.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1620
- - C:\Temp\i_aysqkicank.exe
    C:\Temp\i_aysqkicank.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2160
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2120
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\mkecxupnhf.exe
    C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_mkecxupnhf.exe
    C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhez.exe ups_run
  2⤵
  PID:2908
- - C:\Temp\kecwupmhez.exe
    C:\Temp\kecwupmhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhez.exe ups_ins
  2⤵
  PID:764
- - C:\Temp\i_kecwupmhez.exe
    C:\Temp\i_kecwupmhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  PID:3896
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomhe.exe ups_ins
  2⤵
  PID:4296
- - C:\Temp\i_mjecwuomhe.exe
    C:\Temp\i_mjecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:4140
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:3276
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgeywq.exe ups_run
  2⤵
  PID:1692
- - C:\Temp\bvtolgeywq.exe
    C:\Temp\bvtolgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgeywq.exe ups_ins
  2⤵
  PID:1324
- - C:\Temp\i_bvtolgeywq.exe
    C:\Temp\i_bvtolgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidavtnlf.exe ups_run
  2⤵
  PID:3368
- - C:\Temp\qlidavtnlf.exe
    C:\Temp\qlidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidavtnlf.exe ups_ins
  2⤵
  PID:3784
- - C:\Temp\i_qlidavtnlf.exe
    C:\Temp\i_qlidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  PID:3100
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  PID:4364
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run
  2⤵
  PID:4348
- - C:\Temp\pnifaxsqki.exe
    C:\Temp\pnifaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins
  2⤵
  PID:3892
- - C:\Temp\i_pnifaxsqki.exe
    C:\Temp\i_pnifaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run
  2⤵
  PID:5060
- - C:\Temp\khcausmkec.exe
    C:\Temp\khcausmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins
  2⤵
  PID:1224
- - C:\Temp\i_khcausmkec.exe
    C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmkecw.exe ups_run
  2⤵
  PID:2504
- - C:\Temp\hczurmkecw.exe
    C:\Temp\hczurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmkecw.exe ups_ins
  2⤵
  PID:2820
- - C:\Temp\i_hczurmkecw.exe
    C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

C:\Temp\mkfcxupnhf.sys
C:\Temp\mkfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:4048

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\zurmkecwup.sys
C:\Temp\zurmkecwup.sys
1⤵
- Executes dropped EXE
PID:3280

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
- Executes dropped EXE
PID:888

C:\Temp\eywqojgbyt.sys
C:\Temp\eywqojgbyt.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\tqljdbvtol.sys
C:\Temp\tqljdbvtol.sys
1⤵
- Executes dropped EXE
PID:2444

C:\Temp\qlidavtnlx.sys
C:\Temp\qlidavtnlx.sys
1⤵
- Executes dropped EXE
PID:3804

C:\Temp\lfdxvqnifa.sys
C:\Temp\lfdxvqnifa.sys
1⤵
- Executes dropped EXE
PID:1612

C:\Temp\idxvpnhfax.sys
C:\Temp\idxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:5040

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\trmjebwuom.sys
C:\Temp\trmjebwuom.sys
1⤵
PID:3228

C:\Temp\ljdbwtomge.sys
C:\Temp\ljdbwtomge.sys
1⤵
PID:2104

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:4040

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
PID:4372

C:\Temp\dyvqnigays.sys
C:\Temp\dyvqnigays.sys
1⤵
PID:448

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
PID:3424

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
PID:1684

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdyvq.exe

Path C:\Temp\avtnlfdyvq.exe
Size 243KB
SHA256 3ea44e3092ce5a553465a72f535f6acfea2876cf47fb6d84a5891f40298b92fa
MD5 9dfdb30ab9840f0ff48ef611173e8f62
SHA1 11563b32a81cd0b28b91aab7a09d6131c667060a
SHA512 142c5a322bfab1ba5276d4da928d823f46a6136673c5a438c6858641853d028e9d5b32f6cd15492a8c6f22c63f19720351328f4acaa52a14dbcf7dc8d19f8059
SSDEEP 3072:eF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:+3frLQsa3lLNngoqRttA7O
TLSH
T1BD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxv.exe

Path C:\Temp\causmkfcxv.exe
Size 243KB
SHA256 62fa6ca7057ac81936a4939904f5d30d1ed83087bd8e204bf480cc9c92e075a6
MD5 9bcafaf40499ccec47065467e0c78f60
SHA1 5e942ee30fb7e7b9289c5a67427619fb3b00c222
SHA512 1846e499bae1ab96394f1fffc30cebb39a345251544d0ad61843f67f98e4d28db0265b118ac2bdf89efa7850a81334fef7d463521f24452869b4a27b9c62d21b
SSDEEP 3072:rF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:p3frLQsa3lLNngoqRttA7f
TLSH
T108345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwu.sys

Path C:\Temp\czusmkecwu.sys
Size 141KB
SHA256 b87ea5ed13c9e225a49843fc85771a788a1e77b1b37ace677fb17cc4ae9d6298
MD5 992047e573d8ee4bc3759a4aec0fb5c7
SHA1 45a6ffdf61fc34faf898b598088d946b5bb73b5d
SHA512 c20a001ba7c6e7bad1b8a2dfa89ca9bb70bacb9cc02c96dc67fe1139840949b1ee877f680b8adee23334b39df1b5e56feb475c451e870bc26088916233b43c13
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbyt.sys

Path C:\Temp\eywqojgbyt.sys
Size 141KB
SHA256 092d93504a19e9c08c1bed44bda1a62e4fa1538ac24ecf32aa03f36ee010768f
MD5 7acc533fb64bffefd87f9f7c069525e4
SHA1 9b1a44c1e0c120e2ce3988d5e2a1bcbbcd9c9979
SHA512 9180555091db26cf8c1406336d5be54c416964ebafbffe6c397d69db42a0037eb49f22c7f1ac4c94859b0fff10c8386cb74bc47a2e8936d7502a16ae3a74c485
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbz.exe

Path C:\Temp\gezwrpjhbz.exe
Size 243KB
SHA256 a77cabba75b62a5a9386f8b92f20a0621bcc6709f187a8440a2ac7fb31fadfbf
MD5 a4343e0a6f231e38d3d16a61f8e1223a
SHA1 f89c062ec027281245344d701c4fd4450808aaba
SHA512 5daa94179d1487536df1f33f46e640296ad541206ee228bbc1dd5c986ff65697e1959e8dc896872179b7f19ef1e034612c58343ce1e860f9cedadbadc9a52ea4
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:d3frLQsa3lLNngoqRttA7v
TLSH
T113345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkfcxv.exe

Path C:\Temp\i_causmkfcxv.exe
Size 243KB
SHA256 f7344a5665d54f39deb9d1f0b44f67af0061d5506934f90e07f6291a54932651
MD5 4b7ac127d53a471fbc08f8f5c24b33b5
SHA1 bafc0c28a65d607d97a616055ea2adb97277ce65
SHA512 0e316b16f207aa5849dd36d671fba807af86b748f6481d86b74f2bf04e6834ec30a7c7f1f371f9a19eea62a18515895fe2de237ec974610406a523912d86ca67
SSDEEP 3072:5F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:73frLQsa3lLNngoqRttA7F
TLSH
T166345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwrpjhbz.exe

Path C:\Temp\i_gezwrpjhbz.exe
Size 243KB
SHA256 74e1b60a302821731a00f7eb883e7c23233198355b5ee8752418f81e8a2c1bd8
MD5 775f1186b5de01c722ad6e4214405177
SHA1 b7dcec280ba13d030630bd51cf06ca94cf0fb855
SHA512 5e51f3134a6e3a2339b5b7959cbe5d7e155ec24efc59c51cefaeb6c27d5ab77761159e1e68e8a9f9a3019e2333582d2d427205555e4adf10abb532e9fa12b2c8
SSDEEP 3072:hF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:j3frLQsa3lLNngoqRttA7d
TLSH
T19D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jeywrojhtr.exe

Path C:\Temp\i_jeywrojhtr.exe
Size 243KB
SHA256 07e7610113bbd926fb9d17f54def431a08bb7049a226fab36a63232d5760ee0c
MD5 b82ae048a062597c285179ae52660824
SHA1 7421d1d0695b452f664ec913a4f444d45392a7b3
SHA512 1135bac4cb47b51b2f69c6ce5666ccf723483344fbc0f2dc33c3ae41b4c8a0686696b1e682bfdced3779c6677a9dee4b531bee630a43906d1954edc756a49581
SSDEEP 3072:3F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:13frLQsa3lLNngoqRttA7D
TLSH
T18D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqoiga.exe

Path C:\Temp\i_lgdywqoiga.exe
Size 243KB
SHA256 eb9f9b1f7202000795a247aec62c2ee0e6ba4227f77075deba48e5aa7370ac2d
MD5 7fc1863506dc495591a6a6af2ebb42dc
SHA1 c33fdbed1032be9025ea6ffb8412fee0e4ba9565
SHA512 1c9d46f5dcfb58c44d8f04fbd801b21e20b74255d7c1fba4cec7cd6a5caedd1f0b4da336c71e9a90f680a6359f0878b23983573c8b77cd63f362fcb77fec8fa1
SSDEEP 3072:8F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:o3frLQsa3lLNngoqRttA7g
TLSH
T126345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicausnk.exe

Path C:\Temp\i_sqkicausnk.exe
Size 243KB
SHA256 d4893ee6431cb849815d865d8e1de03b06e82ef563189765efb993243ed98653
MD5 100f641e6391ac26424181f2ae98a080
SHA1 0275c3ee8caab7d1488f80e76dc1dd057297091c
SHA512 f77ce04f68d78ee17253ccbfd8fbcdfdfd2b26044da2c4adde3d9b2ba806acad69aa429c9b6459f2fc65ac027907ef1017787acba4b44f332ea821301da0515b
SSDEEP 3072:GF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:G3frLQsa3lLNngoqRttA7+
TLSH
T13A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbvtol.exe

Path C:\Temp\i_trljdbvtol.exe
Size 243KB
SHA256 f439dc6ba4c6e20e9b77c0f2bf7d16f59a6ff3e8f6592755e38c800d782dae58
MD5 5ee259f86c919eba430828ca96a0b9db
SHA1 1ada27bdcbadbd8e9833383c3ec5993eb145ca67
SHA512 e66e4db7f8518e8e0420ef9b12a7b59069f622933f59f3c2d13f04a1f1e45fa96574a3f53c0d0d35f0e7ffbe4b8c4662d1a90c842f539ab9f92070fb3405ae18
SSDEEP 3072:qF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:63frLQsa3lLNngoqRttA7G
TLSH
T176345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhezxrpj.exe

Path C:\Temp\i_upmhezxrpj.exe
Size 243KB
SHA256 928a344e1d694fe9d6dff2485f1f559a657e1a32efe54e2a561945df0c14c2d7
MD5 d63447161c4ce0808fc1a37461570ae9
SHA1 2062f827651488aad96308cceec19842e712b0f4
SHA512 6cd2fe5a15b3ba28bb03c72c43b3bc0e80b0ef2cf39bce01beb738a408c516a8eb941b749da73f718a980c8ab83e6d2b374e18584d857de68b6f538286bd1185
SSDEEP 3072:HF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:l3frLQsa3lLNngoqRttA7n
TLSH
T1AB345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeywrojhtr.exe

Path C:\Temp\jeywrojhtr.exe
Size 243KB
SHA256 badfd79c264b929d20c50238af9b31d0068ec9960d57b244fee32378327bd180
MD5 6b22cde5f9ceede61e8e01c24483bd00
SHA1 48ca256cd9e9474f939ccdfb38880819b65ac8d3
SHA512 c1d04f1b4c3cf071abf1b72eed0fb39ba7306277912daf3d975888451f40f4146c6365528fa9740a49fbae87bee4cf8dda2e221509b252d7b0e43e7f1d473a2a
SSDEEP 3072:fF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:93frLQsa3lLNngoqRttA7H
TLSH
T14B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.exe

Path C:\Temp\lgdywqoiga.exe
Size 243KB
SHA256 a7403fb6e0d1831d5404310bf0a4810331127dbee699117733e4ba1dc1bcf0a9
MD5 250b7633fca63028d9ab21a89c37e772
SHA1 79a93cde528b737c844fb75ece82f12c7941ac3e
SHA512 3b2a05997e3f307f0dfa77c82cd9ea55f5c4177011d2a812fb743012804a6a7cf4e14c66ab39e1acdad308107e082fcb0f1fe8b48645079fe205cc65e29b36c8
SSDEEP 3072:XF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:V3frLQsa3lLNngoqRttA7D
TLSH
T1B2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.sys

Path C:\Temp\mkfcxupnhf.sys
Size 141KB
SHA256 baaa26c28027179f8d39532223e842d05b6110cfd920c5d7d2e68eb07de44186
MD5 efcd19a8af816ca64c0f5ccca5df3ad7
SHA1 b04b477a275741b3e1e7a21c87becd795df96f53
SHA512 ab548c835ce40a6166b62a52cb0f095a90b13c47ba95a390bb4236a07634799ceb0a3ce910f02e4975d3545f74bf7170d9e365eadccf055bd27f7c096d75d5c7
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidavtnlx.sys

Path C:\Temp\qlidavtnlx.sys
Size 141KB
SHA256 72986ea23d5ee5c9d7bb2a78e66e19221c61691151c00908b891252900df58ee
MD5 b8a2c8f605e81e19a6478e23542b2b6f
SHA1 9a38f3a1773473a1d97b6c0a69fca84d7a298a3b
SHA512 9fead460ef94ef51bd5e5600244fa1536f31cd027319153ab92566cc9daab9db4fd65ea5ddd15d9e7252af4ff2d2f97a37d15a0f677568545dc3f4300e5ea4c2
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrmj.sys

Path C:\Temp\rpjhbztrmj.sys
Size 141KB
SHA256 285f107ec24656e79d0bcaae01ec7d43718795a6ecd8eae565db418693ca592d
MD5 f6a91ce6a21091c9e6ddb805b46442c5
SHA1 b402d53599432fd1c1d47bb97fb4e169dac9685a
SHA512 63d54036f7b4538dfdb32995d3ad7a3219f5e5c754da036c01df71dc4194fdf2d4b9475783450cc1e560184d601f565fc907c5cd7b326cc58263a107d3843185
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicausnk.exe

Path C:\Temp\sqkicausnk.exe
Size 243KB
SHA256 b9e45205a72b86a510f212e9a6faafc028a543fdf66f81689f7995b7a9f1d760
MD5 8879bdb0ae27c66c50173c0d6a9d1d1b
SHA1 a8460d307bcd6b2eaa29f77d34dcdcc0d3c382ca
SHA512 a83d97e9f2e85b16b94dd7a9f4303e353238a12c7ab79cb2a8c2b3ea8120e14315b6d2c805259274add8933f74a6c2adfe4386aaf7258cdaa35656c5f3a1d6fd
SSDEEP 3072:jF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:B3frLQsa3lLNngoqRttA7z
TLSH
T1FD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtol.sys

Path C:\Temp\tqljdbvtol.sys
Size 141KB
SHA256 cdfc86b18749aa3c50dc9e7f5681a98ab241278be390a04a32e71bc7de03aeb3
MD5 728794b4f64841044f0a23fe84a0f0e3
SHA1 456b74a7f79a053f8e3a673ee29e42577600be95
SHA512 63cdcf68332dee1c4f25572d8ee889402118eee9d712d17736f96776f3c7cd30ba5e4655d3803bdd2fbd22f0b8a86f05a96ef93edb36b54c00a3790a687e7a90
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.exe

Path C:\Temp\trljdbvtol.exe
Size 243KB
SHA256 16fd78e80f4eddc1acc4c4e45d01e30a3d4aa44d8b0c4f5dd3cef1ab27bb569d
MD5 7444113034d1dfb0eb988ecd6a9c1658
SHA1 0f6e966add76be232b9602880b850328bb0f2fa5
SHA512 6c6e7773c40331fe94ec3b5ebb812777a77c1f5a2d70a2d5f79051a54ed5ba4cea6085173b69596c0cf9f9f1c52f9ae8e4a8729b566469cb36ffaef988b7133a
SSDEEP 3072:WF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:23frLQsa3lLNngoqRttA7S
TLSH
T175345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxrpj.exe

Path C:\Temp\upmhezxrpj.exe
Size 243KB
SHA256 e6f48572bffeb61802cb1cf9de9174f29e8e36493b30876f8a8ad6123debb568
MD5 58bca4b55ceb230849a054a8ee837695
SHA1 d84b4ba6ce9e6708285b2839be4fbe1ed8fc22aa
SHA512 6ef65e5a1b90830d24cfbb44c474a718bafba8a5e215cdb6ad00a69befe799f9692cc9020bc04b6d24cffc7820bf7b8c3aa81f7b4522cf520e24b675b83aed8a
SSDEEP 3072:HF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:l3frLQsa3lLNngoqRttA7v
TLSH
T1E3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwup.sys

Path C:\Temp\zurmkecwup.sys
Size 141KB
SHA256 ad5a53f8c4269843639f61bfd8cb7e07297a244410e148963f0b05878434ff6e
MD5 d851f803b862097a8f3db7856f44448b
SHA1 27a6d185919290838b65ef040b08d67d31eba20b
SHA512 1ab0bfa4f251f0536621c1f4b6eb944b32a5599c0cb5b85a6dde1ff5579ebd2034a4036503baf81820b85677fb2e32cab8179fbd9df32e73dc3b38190d6355ad
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 4a88320563047a54f3bfa004ef3efbf0710cf1fe4fa35899e5604566c4a7b14e
MD5 c2d0c6ffc9884abf6aa1e5a72ce8c399
SHA1 c101a0ba2e578a522abf47b794be51e5d6a7644f
SHA512 676cbfcedde6590287c098d8b8543a97401ebfbfc67751eda214f74d5daf47c0e92584cfeb64da69f622d2a2cd4cd679a22192c14223cc138f5a0d6fd3aaf608
TLSH
T175F0DC02C8BEB852BF13ACEDA165067E3030AD7264B38817A03901E60BA4B7A561C039
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 efe608b74082815ca396116696ed206fe59fe09599d5273e89b03a0f2c9c81aa
MD5 be0d9c0b639e5ff02a7f74ca41aec735
SHA1 180afddd70a91ee78942e24db6aabbbd25e07125
SHA512 b1396f0fed66dec835b6b0e0d5ce17ab294ba1413e10322197eba424ee1ae216ae88d87764240bf303299d4fa68dbe1fed525d3bd39dc57d6ba9784be87635c2
TLSH
T16BE0C03416F7421FF4F5E5358BD5B4268999F1360418B3F43DC49F04A306A409C03A2D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FBHLEWR\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/888-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1612-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1684-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2104-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3280-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3424-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3524-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3804-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4040-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4040-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4048-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5040-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5092-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads