54ed00aedb596c3c0bab801dd73e156f1ea75875155207b27e40ae4588d6c76c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
Size 243KB
Sample260516-ppldesdw2z
SHA256 54ed00aedb596c3c0bab801dd73e156f1ea75875155207b27e40ae4588d6c76c
MD5 604bf8744757283259e1267bc306d532
SHA1 fd34adc85159745d8c1dae0d9f18fac6bf5b6dff
SHA512 d5e81e3f7d940ac17b844a65e956b16825cb4f3a19430651d17476a8b920c2115981438e103a1c68fbc78b2ba3a517968a22084dd55158f04bde35dd29a33446
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:uvMsLaOa3lLNngoqRttA7B
TLSH
T168345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2236	CP.exe
4420	urmkecwupj.exe
3360	CP.exe
3904	CP.exe
1632	i_urmkecwupj.exe
396	jecwuomgez.sys
4116	CP.exe
2284	ytrljebwto.exe
4480	CP.exe
2140	CP.exe
4176	i_ytrljebwto.exe
3416	mgeywrojgb.sys
4484	CP.exe
3392	trljdbwtom.exe
1756	CP.exe
2404	CP.exe
4588	i_trljdbwtom.exe
3268	gbytrljdbw.sys
3436	CP.exe
2424	vtolgeywqo.exe
1816	CP.exe
4680	CP.exe
2704	i_vtolgeywqo.exe
1772	yvqoigaysq.sys
372	CP.exe
3724	qlidbvtnlg.exe
824	CP.exe
868	CP.exe
1860	i_qlidbvtnlg.exe
4784	aysicavsnl.sys
4488	CP.exe
3900	kidavtnlfd.exe
2840	CP.exe
4660	CP.exe
4352	i_kidavtnlfd.exe
4300	vpnifaxsqk.sys
1436	CP.exe
1396	kausmkfcxv.exe
1864	CP.exe
3524	CP.exe
4604	i_kausmkfcxv.exe
4132	pkicausnkf.sys
1712	CP.exe
1288	fzxspkhcau.exe
2632	CP.exe
3560	CP.exe
3552	i_fzxspkhcau.exe
4040	kfzxrpjhcz.sys
440	CP.exe
1980	zurmkecwuo.exe
2260	CP.exe
1636	CP.exe
4876	i_zurmkecwuo.exe
2124	bwuomhezxr.sys
4624	CP.exe
4352	rmjecwuomg.exe
3256	CP.exe
2600	CP.exe
3508	i_rmjecwuomg.exe
1260	uomgeywroj.sys
1056	CP.exe
4016	eywrojhbzt.exe
3268	CP.exe
4956	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kausmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kausmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezw.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3760	ipconfig.exe
4308	ipconfig.exe
2508	ipconfig.exe
1100	ipconfig.exe
1248	ipconfig.exe
4752	ipconfig.exe
4388	ipconfig.exe
2504	ipconfig.exe
4660	ipconfig.exe
4084	ipconfig.exe
3340	ipconfig.exe
4768	ipconfig.exe
1576	ipconfig.exe
4792	ipconfig.exe
2588	ipconfig.exe
3116	ipconfig.exe
2712	ipconfig.exe
1344	ipconfig.exe
2492	ipconfig.exe
2288	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486067895"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31254665"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03488bb91e8dc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1496009115"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{849D6176-547C-11F1-B40A-6E95C79F7E05} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07983bb91e8dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef8200000000020000000000106600000001000020000000cb143dad6d8dcf339012aee2a7fe8cb921e5eaf55a61ed0b6502a661662bee53000000000e8000000002000020000000ec073351fa276fed5ffcabe983fa4999e45122a3926ddfb6aa0cb7d1b5dcc24420000000725883bb49dbdfd4d546fe0bbd57d65b46f695b4fcbbcc4288a490b5e4b3a8e34000000093750f2e30666f4c183b7b359565fd20df39f9f2bf7f6076e51f0358827ce4d5ceb50cee5a1b2f00de0d15d05f093001dbcabd060877fdf333c8e470a033a9f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef8200000000020000000000106600000001000020000000f41219ea2424e9bae98c332a5792f577fd30e6bbfb2425a4518fb152b78c3c19000000000e80000000020000200000008bbb4e71b827ac9971ad2e67fe5decd2cb64b4cbb4f89140f10eb8fc2e922e7120000000ff5188d2959a7e04a40a8e2eaec6ed3c44cafcd04c6f08bef8d870f932847d25400000006322eebe9bd57e05a8ac4a0e32cdb691d081adf114d66167434034fe51793077ed497cc59ed8cb50214e4bb2f0749a95234c9886e2e5acf4546d2b6c492e847c	iexplore.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	i_urmkecwupj.exe
Token: SeDebugPrivilege	4176	i_ytrljebwto.exe
Token: SeDebugPrivilege	4588	i_trljdbwtom.exe
Token: SeDebugPrivilege	2704	i_vtolgeywqo.exe
Token: SeDebugPrivilege	1860	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	4352	i_kidavtnlfd.exe
Token: SeDebugPrivilege	4604	i_kausmkfcxv.exe
Token: SeDebugPrivilege	3552	i_fzxspkhcau.exe
Token: SeDebugPrivilege	4876	i_zurmkecwuo.exe
Token: SeDebugPrivilege	3508	i_rmjecwuomg.exe
Token: SeDebugPrivilege	2056	i_eywrojhbzt.exe
Token: SeDebugPrivilege	1808	i_mgeywqojgb.exe
Token: SeDebugPrivilege	2096	i_gaytqljdbv.exe
Token: SeDebugPrivilege	4756	i_dyvqnigays.exe
Token: SeDebugPrivilege	3368	i_ifaqkicaus.exe
Token: SeDebugPrivilege	2932	i_faxspkicau.exe
Token: SeDebugPrivilege	2872	i_cwupmhfzxr.exe
Token: SeDebugPrivilege	4216	i_cwupmhezxr.exe
Token: SeDebugPrivilege	4092	i_ecwuomhezw.exe
Token: SeDebugPrivilege	1020	i_bwtolgeywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4004	iexplore.exe
4004	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4004	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	83
PID 4004 wrote to memory of 2972	4004	iexplore.exe	84
PID 2328 wrote to memory of 2236	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	85
PID 4420 wrote to memory of 3360	4420	urmkecwupj.exe	88
PID 2328 wrote to memory of 3904	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	91
PID 2328 wrote to memory of 4116	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	95
PID 2284 wrote to memory of 4480	2284	ytrljebwto.exe	97
PID 2328 wrote to memory of 2140	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	100
PID 2328 wrote to memory of 4484	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	110
PID 3392 wrote to memory of 1756	3392	trljdbwtom.exe	112
PID 2328 wrote to memory of 2404	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	115
PID 2328 wrote to memory of 3436	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	119
PID 2424 wrote to memory of 1816	2424	vtolgeywqo.exe	121
PID 2328 wrote to memory of 4680	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	124
PID 2328 wrote to memory of 372	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	130
PID 3724 wrote to memory of 824	3724	qlidbvtnlg.exe	132
PID 2328 wrote to memory of 868	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	135
PID 2328 wrote to memory of 4488	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	139
PID 3900 wrote to memory of 2840	3900	kidavtnlfd.exe	141
PID 2328 wrote to memory of 4660	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	144
PID 2328 wrote to memory of 1436	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	148
PID 1396 wrote to memory of 1864	1396	kausmkfcxv.exe	150
PID 2328 wrote to memory of 3524	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	153
PID 2328 wrote to memory of 1712	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	157
PID 1288 wrote to memory of 2632	1288	fzxspkhcau.exe	159
PID 2328 wrote to memory of 3560	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	162
PID 2328 wrote to memory of 440	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	166
PID 1980 wrote to memory of 2260	1980	zurmkecwuo.exe	168
PID 2328 wrote to memory of 1636	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	172
PID 2328 wrote to memory of 4624	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	176
PID 4352 wrote to memory of 3256	4352	rmjecwuomg.exe	178
PID 2328 wrote to memory of 2600	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	182
PID 2328 wrote to memory of 1056	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	186
PID 4016 wrote to memory of 3268	4016	eywrojhbzt.exe	188
PID 2328 wrote to memory of 4956	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	191
PID 2328 wrote to memory of 4220	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	195
PID 1988 wrote to memory of 4764	1988	mgeywqojgb.exe	197
PID 2328 wrote to memory of 5108	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	200
PID 2328 wrote to memory of 4908	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	204
PID 2124 wrote to memory of 460	2124	gaytqljdbv.exe	206
PID 2328 wrote to memory of 2348	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	209
PID 2328 wrote to memory of 1248	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	213
PID 3636 wrote to memory of 3824	3636	dyvqnigays.exe	215
PID 2328 wrote to memory of 4592	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	218
PID 2328 wrote to memory of 1916	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	223
PID 4492 wrote to memory of 4128	4492	ifaqkicaus.exe	225
PID 2328 wrote to memory of 3972	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	228
PID 2328 wrote to memory of 4616	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	232
PID 3648 wrote to memory of 2748	3648	faxspkicau.exe	234
PID 2328 wrote to memory of 176	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	237
PID 2328 wrote to memory of 4876	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	241
PID 672 wrote to memory of 3024	672	cwupmhfzxr.exe	243
PID 2328 wrote to memory of 2000	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	246
PID 2328 wrote to memory of 1852	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	250
PID 4456 wrote to memory of 3264	4456	cwupmhezxr.exe	252
PID 2328 wrote to memory of 1696	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	255
PID 2328 wrote to memory of 1724	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	259
PID 1728 wrote to memory of 3396	1728	ecwuomhezw.exe	261
PID 2328 wrote to memory of 4448	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	264
PID 2328 wrote to memory of 4612	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	268
PID 976 wrote to memory of 556	976	bwtolgeywq.exe	270
PID 2328 wrote to memory of 2588	2328	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4004 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwupj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2236
- - C:\Temp\urmkecwupj.exe
    C:\Temp\urmkecwupj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwupj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_urmkecwupj.exe
    C:\Temp\i_urmkecwupj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljebwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\ytrljebwto.exe
    C:\Temp\ytrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljebwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_ytrljebwto.exe
    C:\Temp\i_ytrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3436
- - C:\Temp\vtolgeywqo.exe
    C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4680
- - C:\Temp\i_vtolgeywqo.exe
    C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:372
- - C:\Temp\qlidbvtnlg.exe
    C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\i_qlidbvtnlg.exe
    C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kausmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Temp\kausmkfcxv.exe
    C:\Temp\kausmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kausmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Temp\i_kausmkfcxv.exe
    C:\Temp\i_kausmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\fzxspkhcau.exe
    C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3560
- - C:\Temp\i_fzxspkhcau.exe
    C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1056
- - C:\Temp\eywrojhbzt.exe
    C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_eywrojhbzt.exe
    C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  PID:4220
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  PID:5108
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  PID:4908
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  PID:2348
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run
  2⤵
  PID:1248
- - C:\Temp\dyvqnigays.exe
    C:\Temp\dyvqnigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins
  2⤵
  PID:4592
- - C:\Temp\i_dyvqnigays.exe
    C:\Temp\i_dyvqnigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaqkicaus.exe ups_run
  2⤵
  PID:1916
- - C:\Temp\ifaqkicaus.exe
    C:\Temp\ifaqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaqkicaus.exe ups_ins
  2⤵
  PID:3972
- - C:\Temp\i_ifaqkicaus.exe
    C:\Temp\i_ifaqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run
  2⤵
  PID:4616
- - C:\Temp\faxspkicau.exe
    C:\Temp\faxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins
  2⤵
  PID:176
- - C:\Temp\i_faxspkicau.exe
    C:\Temp\i_faxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  PID:4876
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  PID:2000
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run
  2⤵
  PID:1852
- - C:\Temp\cwupmhezxr.exe
    C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins
  2⤵
  PID:1696
- - C:\Temp\i_cwupmhezxr.exe
    C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezw.exe ups_run
  2⤵
  PID:1724
- - C:\Temp\ecwuomhezw.exe
    C:\Temp\ecwuomhezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezw.exe ups_ins
  2⤵
  PID:4448
- - C:\Temp\i_ecwuomhezw.exe
    C:\Temp\i_ecwuomhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtolgeywq.exe ups_run
  2⤵
  PID:4612
- - C:\Temp\bwtolgeywq.exe
    C:\Temp\bwtolgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtolgeywq.exe ups_ins
  2⤵
  PID:2588
- - C:\Temp\i_bwtolgeywq.exe
    C:\Temp\i_bwtolgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1020

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
- Executes dropped EXE
PID:396

C:\Temp\mgeywrojgb.sys
C:\Temp\mgeywrojgb.sys
1⤵
- Executes dropped EXE
PID:3416

C:\Temp\gbytrljdbw.sys
C:\Temp\gbytrljdbw.sys
1⤵
- Executes dropped EXE
PID:3268

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
- Executes dropped EXE
PID:1772

C:\Temp\aysicavsnl.sys
C:\Temp\aysicavsnl.sys
1⤵
- Executes dropped EXE
PID:4784

C:\Temp\vpnifaxsqk.sys
C:\Temp\vpnifaxsqk.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
- Executes dropped EXE
PID:4132

C:\Temp\kfzxrpjhcz.sys
C:\Temp\kfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4040

C:\Temp\bwuomhezxr.sys
C:\Temp\bwuomhezxr.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:2952

C:\Temp\nlgdywqoig.sys
C:\Temp\nlgdywqoig.sys
1⤵
PID:2340

C:\Temp\tnlxvqnifa.sys
C:\Temp\tnlxvqnifa.sys
1⤵
PID:1832

C:\Temp\snlfdxvpni.sys
C:\Temp\snlfdxvpni.sys
1⤵
PID:700

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:2700

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
PID:1608

C:\Temp\rmkecwupmh.sys
C:\Temp\rmkecwupmh.sys
1⤵
PID:2120

C:\Temp\pjebwuomge.sys
C:\Temp\pjebwuomge.sys
1⤵
PID:2100

C:\Temp\mgbztrljdb.sys
C:\Temp\mgbztrljdb.sys
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysicavsnl.sys

Path C:\Temp\aysicavsnl.sys
Size 141KB
SHA256 90d2851cbbcdd76a9fec774fc8f949f0ff5a42a6e0c737c0311b4106b318bb1b
MD5 2f22fa5114c71583e1036c4a2d74a24e
SHA1 ebf14e7d09462513791c2320cb118d6e5b247f5b
SHA512 418bc9aa0df47f22936ae2b743a9c82663e0171047fc547dc7cd8f12d501474e9c6dd366ba2ae5bf0dc24725b03e3af21d627677800c739e11a3d1cc353810a2
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhcau.exe

Path C:\Temp\fzxspkhcau.exe
Size 243KB
SHA256 84faf769ba69217d9cbc60a0e77af68c4ebe6b99d70e14d39c1694fa11ca0569
MD5 5a44b971962777ec9ba49ef3fce8778b
SHA1 f58c3a6e981314986bd70dc7e22ac301b3e17325
SHA512 82a164685b087d707d1e18e6d6a869d26338a67d0350c2e1eafcb5c1506d5b6f2ffe9c1076fd280f357c3c163a4bb9cb4517edeb6977a639e55de6d9efa83576
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:EvMsLaOa3lLNngoqRttA7/
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.sys

Path C:\Temp\gbytrljdbw.sys
Size 141KB
SHA256 a45de63eb37386c50c18d8f76ca4daf526893a6b91f5ec3367c144ed0a5c881a
MD5 519a7f4a0a2b3a556dca31b6bf0c669b
SHA1 556c50fbddeb0c335cccacfda767f48a1fc19749
SHA512 1919d41d61711136cb2375e951bd1dc5358b0702acc4cea7b813ca61c507cb8ee4975b9010b248bd87d424375bcf4fa700a7cd0cb30c2d82daee8357a9ad8aaa
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkhcau.exe

Path C:\Temp\i_fzxspkhcau.exe
Size 243KB
SHA256 98b517621ae1596ab1e5ac49ac44d70486aab5b924ef447ad488af7b654ee860
MD5 6eb92369f2f2c73e262e2f9d7c072505
SHA1 e753662728d4e9a74a5fa953cb7789ccc730589d
SHA512 17904771d9041c6bd8b5ba134c2624940ab88fc5644b6297afc528c898e639f597af0330aa8c95055b09254025b03bdf6fcba43d724ef1cd6a2311d9a54913bb
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:ovMsLaOa3lLNngoqRttA7r
TLSH
T1F6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kausmkfcxv.exe

Path C:\Temp\i_kausmkfcxv.exe
Size 243KB
SHA256 dd83c5c8eafae5ed691d974954efbe72fef2477571198bd23fcedfd57d88e995
MD5 b7cc43eff47bc6b2f7e77a551c9659f5
SHA1 e16012bcea37bd43486bd69989e07ea83b142f99
SHA512 f5667046ca154abdafd570debbecd1ddfd6fdf9389058f489b2b9ab101765f8824057af398c93b25dfe1222b7987887f1b6df26a076cc9709b0f52c57b283d37
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:VvMsLaOa3lLNngoqRttA7A
TLSH
T117345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidavtnlfd.exe

Path C:\Temp\i_kidavtnlfd.exe
Size 243KB
SHA256 ffa557b58afbf5f53d1f44a1fbaa6b500b12fbf92d050e0818c9e52bc3906985
MD5 1bd2b9554e6f45bd64553641f488ea16
SHA1 ff7749764cd79601a0758def01687787199d6e5d
SHA512 d820194895eb41823ce8d725ff005a05c6e7c1141b7d6421a6eb67e018d8fb125e0c02cb7264e039fc3f06f1f0420831fd78f88fa1815868cda7a76742ec25b7
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:5vMsLaOa3lLNngoqRttA7c
TLSH
T111345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvtnlg.exe

Path C:\Temp\i_qlidbvtnlg.exe
Size 243KB
SHA256 8b47fd183f2fe165ce829614c68378f60142fa6a3a5afeeaa185d1d0834890b5
MD5 8896db7c387668c5bdff347dbc353561
SHA1 616ecdada9aa1808db4145446788d28414acab01
SHA512 a8dcb6f535669c0298e860c3af35d228359c39fd07a52e3328537d30b571806869f78d0fbabfb0562ebb83f6cd45b7fe163756cd7a7160efd9a89643ab3dcf38
SSDEEP 3072:06CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76C:6vMsLaOa3lLNngoqRttA7l
TLSH
T1FB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtom.exe

Path C:\Temp\i_trljdbwtom.exe
Size 243KB
SHA256 1839294d1dab3358bcbbc76f06713384400c4fae948ecfd04e22df5ccd70c7bd
MD5 8922a23124c3578481c2e140d5e56f9e
SHA1 2a6f0b0f31503aac9d85855b1e0c55c82a0030c7
SHA512 f0a1e39f6b98d85c3664f7a26e84f6429e1eb76f0e5c0efc0f6fde4cb2f68190d1ae7e153c60abc3eb4674a278eec6821fe627f5d43c8f03f5fd615dfc039e48
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:jvMsLaOa3lLNngoqRttA7W
TLSH
T18E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwupj.exe

Path C:\Temp\i_urmkecwupj.exe
Size 243KB
SHA256 da83e0e7e4752d10134ffd9096d0205a92d585f14edf2878e46f428e7f447990
MD5 a68b3eb527897782e5dd9811c9f42906
SHA1 f6a2ec82f84b6abdfc68b72bced8d8b9b558ec9b
SHA512 d8aa4643ec7ce042d6101450f35543673cac736aea64b945c5886ba57a8893cf9ad4a3b9f9cff227a4fc6b455563d38671880f7663f73f3c7259f45ada4ed377
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:SvMsLaOa3lLNngoqRttA7J
TLSH
T170345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgeywqo.exe

Path C:\Temp\i_vtolgeywqo.exe
Size 243KB
SHA256 2ff0e63b89937629df3d839f789b6cced2fb4cac5780966dfa3c65a187e19662
MD5 8bf74971bf1e09ce41281f302c4ac4f9
SHA1 382c792e6673b88dee4f25367ed4913066d413b6
SHA512 dea5c3884afc919250295a3bb6ddc08f6a9f755c36ef735e9707bbb4e4aa1b08c18bc1cc2f559a0f65fb21a8f776dd4e6c69842bb25342859f5132b654c47bec
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:JvMsLaOa3lLNngoqRttA7I
TLSH
T147345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljebwto.exe

Path C:\Temp\i_ytrljebwto.exe
Size 243KB
SHA256 5941c6cbed2ea9a12895e6fa70368a038368c8db53da756e9bd5f9506aa58a63
MD5 09ebe195cecff3ebfbb34583e6fa05b0
SHA1 0e29a3fc8d3d848dc24c16c8a0dcfb8a12cb2078
SHA512 7499a551ab8794f76cf8b3f615542e8f297057b3f11f91d51ccc8eedf8230bd4c345f087aeb171a7d45410966067014e91bf6d703ebb274d4df47ed752a50610
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:gvMsLaOa3lLNngoqRttA7D
TLSH
T129345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomgez.sys

Path C:\Temp\jecwuomgez.sys
Size 141KB
SHA256 05f512950529633897cafea435704330d13057bdf14f0a145814c6e061189fbc
MD5 d36affe773d4e1e9e8e8d6c6716350c9
SHA1 3be5c8eba948d5924b2566bdc5036001da3539d1
SHA512 eb79c80443e81b95f51f295b38b3e27b0e1ff0720e978d46fcf38789c5bbfb934076d4337bebc25477e21e900140e44dfcfbd66c4a37272777caeed43bb1545d
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T181E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kausmkfcxv.exe

Path C:\Temp\kausmkfcxv.exe
Size 243KB
SHA256 018830a198b5c33c5e0d6dea2324228f85b6b49c98258a47db30786681e93a1c
MD5 5ea00d6b49294599e5499e6a2d77649b
SHA1 9d020840142df0d098d190c34353cb662340cb8b
SHA512 a1cb2aa1e15816f99f71404fe0cbba6b7ce5bd588904cb67a8e940c11ce18a0578c650c81e1711a7b7c44d86cc7214059dfed26a8638939d209547de61486394
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:LvMsLaOa3lLNngoqRttA7m
TLSH
T1D4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavtnlfd.exe

Path C:\Temp\kidavtnlfd.exe
Size 243KB
SHA256 6de40c44b71eddbee471a2ff9504a73d16d98c9c40d251611aa3bd2575583b61
MD5 1ae804d0826a8b04d31903dccba52e0c
SHA1 651ca898e375525d7e6c4d953de6916bf25b4097
SHA512 f997aa83095cb9f55ab6b01d8debbf44d29aa2d41a32732299c8160347018d6d77dbb317480fc451f3fb7ef2a8b8a831c89387662eb11952371fa0e8d377d828
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:OvMsLaOa3lLNngoqRttA7N
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojgb.sys

Path C:\Temp\mgeywrojgb.sys
Size 141KB
SHA256 5231bb2ea5f87655f2e0992f573055dea30741d7d9d5295a81e9d0e83246abc5
MD5 da32fc64c233e310a0da750fe0d533be
SHA1 903b262ac24fcc8ee45722e832a9ec3a32f0c1a8
SHA512 c3cef0fff2068bd5fd8270abd34d34d164373ea78f1b18decde0fe1af65f8d0d76b2b1254e39f68f6bdeccb8396348f854716867c7df564c44bde6c918bdd318
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FCE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.sys

Path C:\Temp\pkicausnkf.sys
Size 141KB
SHA256 effae920624be4ecc8047c915df14049744dab46c55078fb54a7a8800b76023b
MD5 a4ab9326f608da24c34cec662306d7a1
SHA1 c362934b9262b1af5c3535475a01f114f2a3ed90
SHA512 4aa1fb9717c73ee83362b0d67ea24294f18d3246449f6ddb501bd24f99fec15e7d4791ebbb75926e5dbe84914039d4c56502c3c95f5ef1bb17652cd9ddd575f8
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.exe

Path C:\Temp\qlidbvtnlg.exe
Size 243KB
SHA256 d71d492ddc42d8cdb060fa0212e09d314abcd7376b18acfb1ae75165aed990ee
MD5 8d632e050f876c2748ff6b0d794ca169
SHA1 771c712d8997dce8b9cc071b7718eb18d27b8439
SHA512 afb399df7787bb239ce202054ff538ced13fc0180a34b06159bb1a32a659f9adcbf9c21963bb7ceb40b8f2ce10ebd5f96656c7a285db288d718eb65e6e06a340
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:LvMsLaOa3lLNngoqRttA7u
TLSH
T112345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.exe

Path C:\Temp\trljdbwtom.exe
Size 243KB
SHA256 8c622011125de9bae6227c4ec28ba4350ddcd871fa4bdc374c26b5f28add707e
MD5 1fdc251417f69df7af80ee7ec1fbe292
SHA1 f12756543efefd8cba8cd7fe80882769de0319cc
SHA512 6575aed3e97d83aac7d1998b50017852d88a67a9436a332b0f11a31b16fa1e5345ac25b4315dd3f057100e8fe3805a9c868045cdc1e989b01b77b5a63e03fbc9
SSDEEP 3072:JCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:0vMsLaOa3lLNngoqRttA7j
TLSH
T13D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupj.exe

Path C:\Temp\urmkecwupj.exe
Size 243KB
SHA256 0550480a355dc1b8b28bf70cad119285982c62e482e432dedb0641d3a8c38fc2
MD5 5c92a7f52621a6858e1914ff77acce9b
SHA1 f8781f721dc113c3b156d10664e6b379e4bf074c
SHA512 e025d88b8e8f1bb1777ddb6603f8b034aed816d32defe51066f6b7c098a43c14507987ee6312d1ede650181b3af763579aad07b222f8c63d930158fa8b0f9018
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:7vMsLaOa3lLNngoqRttA7S
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaxsqk.sys

Path C:\Temp\vpnifaxsqk.sys
Size 141KB
SHA256 edc15e551342444eb7e352944e31b5489e085622c836ce6c0bd8e081fd9af191
MD5 f1f8226c48c37ef51e8eebae85e1a863
SHA1 cc8971d92e9734d4ac19044011657db57e59bc81
SHA512 7488b92905ec153285ed64bbe22b2286ba69bcb3a88dd41e4db5da5b14fe8e52044928d45ab53d0e12e5f9e4ff1a98f1f01959f7f4a2a69041210a97d7e3a530
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqo.exe

Path C:\Temp\vtolgeywqo.exe
Size 243KB
SHA256 027d73b2cee8a128084a4b3fbedf7792e09e16499dc0a47d6d0de356c71fc021
MD5 8dbfa8c3e1a0b848ec04fb65d2becfff
SHA1 b04c8bb2057a77e6ccdd79773300281e3371ad32
SHA512 db7d29236f2e157f8d776779d599a5edbef76e5a4e716e66246e3a96d4c468efbcc49c00037aa36354f24b02aff994bab0ad71cf74a2c49a68b4fadd4b22deb8
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:cvMsLaOa3lLNngoqRttA7j
TLSH
T16C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljebwto.exe

Path C:\Temp\ytrljebwto.exe
Size 243KB
SHA256 590d5a9f5f225d1d971b3e96178a198e62b3fce3925e70faf587c9f1689fcc0e
MD5 672893444610f7bfb3f9db5c73947727
SHA1 51d15bf11e224597bd46acd341908f6d637782d1
SHA512 6b21da32fd1163b4b8f941510fa8d7c037b9ea4b9583330b2419821eb0690b2a8470be0a59451b809beda1b985a88d9cf25207f2655c26118d05adbec0d9b143
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:5vMsLaOa3lLNngoqRttA70
TLSH
T106345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.sys

Path C:\Temp\yvqoigaysq.sys
Size 141KB
SHA256 4616e5329213b07755e5f345a75c6a76c70e2771cf87756947d1ff4aa4283065
MD5 7f80fe4eebd2533a8a4220475a7544b9
SHA1 35818cc5c6bb84107518250753f785931b2f44d7
SHA512 2fcb221046df1b68fe7cf4eb5f08b1c50be1b445d2d95d243ab215c0ef1699f841fe630e23bb0f39f3f0fba5e4eca20f11fa5dd8d4261e90b8767f5e5a64809e
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GF2Q29DT\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/700-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1260-118-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1608-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2100-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2120-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-114-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2340-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2508-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2952-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-56-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3416-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4040-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-92-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-80-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4784-68-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads