a9821dcf774bd6d2e0e3335eb0e3d987722912bd14435b15eadfe9263af2066b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
Size 243KB
Sample260530-ntmllsbs8s
SHA256 a9821dcf774bd6d2e0e3335eb0e3d987722912bd14435b15eadfe9263af2066b
MD5 f5094623e41270a370b576e098748f10
SHA1 71eb31d4de003c55aa06d410328a8e1e5a8ebaf8
SHA512 0beab9544e10e9122602969d729f1456a40997ee3b5047e03bc34208c82930d5b078072508e90168aea7c8123c2c96743a8b30611431efb80f36aa71e18b6c37
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:PvMsLaOa3lLNngoqRttA72
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
632	CP.exe
2840	bwuomgezwr.exe
2364	CP.exe
1840	CP.exe
2160	i_bwuomgezwr.exe
4228	wrojhbztrl.sys
2604	CP.exe
4668	mgeywqobyt.exe
1564	CP.exe
1936	CP.exe
4180	i_mgeywqobyt.exe
4968	geywqojgby.sys
3792	CP.exe
660	ytrljdbvqo.exe
4544	CP.exe
4608	CP.exe
1184	i_ytrljdbvqo.exe
1264	ytqlidbvtn.sys
4436	CP.exe
724	nlfdyvqoig.exe
1008	CP.exe
2552	CP.exe
1752	i_nlfdyvqoig.exe
3256	vqoigaysid.sys
5072	CP.exe
4224	davsnlfdxv.exe
3104	CP.exe
2392	CP.exe
1392	i_davsnlfdxv.exe
1688	icavsnlfdx.sys
1184	CP.exe
4688	xsqkausnkf.exe
440	CP.exe
3444	CP.exe
1000	i_xsqkausnkf.exe
4604	aupnhfzxsp.sys
4680	CP.exe
1524	pkhcausmke.exe
4280	CP.exe
1048	CP.exe
4344	i_pkhcausmke.exe
4180	mkecwupmhf.sys
2404	CP.exe
1592	ezxrpjhczu.exe
3784	CP.exe
692	CP.exe
2260	i_ezxrpjhczu.exe
2648	omhezxrpbz.sys
1348	CP.exe
4600	ztrmjebwuo.exe
2152	CP.exe
4624	CP.exe
2936	i_ztrmjebwuo.exe
4872	jhbztrljeb.sys
4604	CP.exe
2072	bztrmjeuom.exe
1380	CP.exe
3548	CP.exe
2972	i_bztrmjeuom.exe
2512	bytrljdbvt.sys
3748	CP.exe
2136	trljdbwtom.exe
2652	CP.exe
3876	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqobyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdvsnkfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdvsnkfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxsmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqobyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxsmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2804	ipconfig.exe
4360	ipconfig.exe
1872	ipconfig.exe
3968	ipconfig.exe
1196	ipconfig.exe
1636	ipconfig.exe
3752	ipconfig.exe
1084	ipconfig.exe
4416	ipconfig.exe
540	ipconfig.exe
4212	ipconfig.exe
4332	ipconfig.exe
404	ipconfig.exe
2156	ipconfig.exe
3528	ipconfig.exe
540	ipconfig.exe
3032	ipconfig.exe
3152	ipconfig.exe
2772	ipconfig.exe
2176	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304ac6b431f0dc01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104fcdb431f0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1384977090"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486906261"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256617"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000d569c38bb570dd492791e2dc8e32d44fda8502484c0cc9df9c8e137f7e079f33000000000e80000000020000200000003cbc5acfdb19c0d57f65cfd7ebc9a356f51b9d4cabad4479d17918e9e86f7d8c20000000a31d2f97c19acb624bf007ece63ce0801c2b71a190cacf4b85b2544dd53457b040000000902930b720249f902d745938deb31af19ea744a87420a4b03569d2fc5fc3c453a2fa1558bd764b5b559c1fc8dbd332953c18138367f1bcb62dafeb0d07d24499	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7DBF5CB9-5C1C-11F1-BC3D-FE415EB581C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1380601686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256617"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000c04e16e3b6e1643e6a596a71685d31a897391d9f93e122eb99482ed5b4089cba000000000e8000000002000020000000e7d87aa3e70f9b63d4f4de5edadd94ef5cdb7393c74cbc6a4366a9f1ea5b97382000000078bb6b0d4080971e56933bd391f3234dbcf459448b2bba7ee1ff7b5d99368b7740000000aae753d2f9f84446c20c9bfd747c8c725957a8f8181429d3b0aad21d2d989c5b01d033eadc9bc9e1d716010f188cfd3f64359cb440adc51b09611c92f3f64ce5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	i_bwuomgezwr.exe
Token: SeDebugPrivilege	4180	i_mgeywqobyt.exe
Token: SeDebugPrivilege	1184	i_ytrljdbvqo.exe
Token: SeDebugPrivilege	1752	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	1392	i_davsnlfdxv.exe
Token: SeDebugPrivilege	1000	i_xsqkausnkf.exe
Token: SeDebugPrivilege	4344	i_pkhcausmke.exe
Token: SeDebugPrivilege	2260	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	2936	i_ztrmjebwuo.exe
Token: SeDebugPrivilege	2972	i_bztrmjeuom.exe
Token: SeDebugPrivilege	3804	i_trljdbwtom.exe
Token: SeDebugPrivilege	1180	i_oigaytqlid.exe
Token: SeDebugPrivilege	116	i_davtnlfdys.exe
Token: SeDebugPrivilege	2764	i_fdvsnkfdxn.exe
Token: SeDebugPrivilege	2076	i_usnkfdxvpn.exe
Token: SeDebugPrivilege	4492	i_pnhfzxsmke.exe
Token: SeDebugPrivilege	3220	i_jhbzurmjec.exe
Token: SeDebugPrivilege	4888	i_jebwuomgez.exe
Token: SeDebugPrivilege	1520	i_ebwuojgbzt.exe
Token: SeDebugPrivilege	4936	i_ytqljdbvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4812	iexplore.exe
4812	iexplore.exe
4836	IEXPLORE.EXE
4836	IEXPLORE.EXE
4836	IEXPLORE.EXE
4836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4812	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	89
PID 4812 wrote to memory of 4836	4812	iexplore.exe	90
PID 3536 wrote to memory of 632	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	92
PID 2840 wrote to memory of 2364	2840	bwuomgezwr.exe	95
PID 3536 wrote to memory of 1840	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	99
PID 3536 wrote to memory of 2604	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	109
PID 4668 wrote to memory of 1564	4668	mgeywqobyt.exe	111
PID 3536 wrote to memory of 1936	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	114
PID 3536 wrote to memory of 3792	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	120
PID 660 wrote to memory of 4544	660	ytrljdbvqo.exe	122
PID 3536 wrote to memory of 4608	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	125
PID 3536 wrote to memory of 4436	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	129
PID 724 wrote to memory of 1008	724	nlfdyvqoig.exe	131
PID 3536 wrote to memory of 2552	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	134
PID 3536 wrote to memory of 5072	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	140
PID 4224 wrote to memory of 3104	4224	davsnlfdxv.exe	142
PID 3536 wrote to memory of 2392	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	145
PID 3536 wrote to memory of 1184	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	150
PID 4688 wrote to memory of 440	4688	xsqkausnkf.exe	152
PID 3536 wrote to memory of 3444	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	155
PID 3536 wrote to memory of 4680	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	159
PID 1524 wrote to memory of 4280	1524	pkhcausmke.exe	161
PID 3536 wrote to memory of 1048	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	164
PID 3536 wrote to memory of 2404	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	168
PID 1592 wrote to memory of 3784	1592	ezxrpjhczu.exe	170
PID 3536 wrote to memory of 692	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	173
PID 3536 wrote to memory of 1348	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	177
PID 4600 wrote to memory of 2152	4600	ztrmjebwuo.exe	179
PID 3536 wrote to memory of 4624	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	182
PID 3536 wrote to memory of 4604	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	186
PID 2072 wrote to memory of 1380	2072	bztrmjeuom.exe	188
PID 3536 wrote to memory of 3548	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	191
PID 3536 wrote to memory of 3748	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	195
PID 2136 wrote to memory of 2652	2136	trljdbwtom.exe	197
PID 3536 wrote to memory of 3876	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	201
PID 3536 wrote to memory of 3800	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	210
PID 1112 wrote to memory of 1192	1112	oigaytqlid.exe	212
PID 3536 wrote to memory of 3768	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	215
PID 3536 wrote to memory of 1764	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	219
PID 3988 wrote to memory of 4968	3988	davtnlfdys.exe	221
PID 3536 wrote to memory of 1016	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	224
PID 3536 wrote to memory of 1852	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	228
PID 4076 wrote to memory of 1784	4076	fdvsnkfdxn.exe	230
PID 3536 wrote to memory of 3480	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	233
PID 3536 wrote to memory of 1824	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	237
PID 1456 wrote to memory of 3964	1456	usnkfdxvpn.exe	239
PID 3536 wrote to memory of 4012	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	242
PID 3536 wrote to memory of 1204	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	247
PID 2176 wrote to memory of 3976	2176	pnhfzxsmke.exe	249
PID 3536 wrote to memory of 2560	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	252
PID 3536 wrote to memory of 4860	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	256
PID 3256 wrote to memory of 4284	3256	jhbzurmjec.exe	258
PID 3536 wrote to memory of 1252	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	261
PID 3536 wrote to memory of 1636	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	265
PID 4292 wrote to memory of 4308	4292	jebwuomgez.exe	267
PID 3536 wrote to memory of 5020	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	270
PID 3536 wrote to memory of 1600	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	274
PID 4908 wrote to memory of 3052	4908	ebwuojgbzt.exe	276
PID 3536 wrote to memory of 316	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	279
PID 3536 wrote to memory of 3680	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	283
PID 2452 wrote to memory of 4456	2452	ytqljdbvtn.exe	285
PID 3536 wrote to memory of 3780	3536	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	288

C:\Users\Admin\AppData\Local\Temp\2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4812 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:632
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1840
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqobyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\mgeywqobyt.exe
    C:\Temp\mgeywqobyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqobyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\i_mgeywqobyt.exe
    C:\Temp\i_mgeywqobyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\ytrljdbvqo.exe
    C:\Temp\ytrljdbvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\i_ytrljdbvqo.exe
    C:\Temp\i_ytrljdbvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\davsnlfdxv.exe
    C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2392
- - C:\Temp\i_davsnlfdxv.exe
    C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\xsqkausnkf.exe
    C:\Temp\xsqkausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\i_xsqkausnkf.exe
    C:\Temp\i_xsqkausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4680
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1048
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1348
- - C:\Temp\ztrmjebwuo.exe
    C:\Temp\ztrmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\i_ztrmjebwuo.exe
    C:\Temp\i_ztrmjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjeuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\bztrmjeuom.exe
    C:\Temp\bztrmjeuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjeuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3548
- - C:\Temp\i_bztrmjeuom.exe
    C:\Temp\i_bztrmjeuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3748
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3876
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlid.exe ups_run
  2⤵
  PID:3800
- - C:\Temp\oigaytqlid.exe
    C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlid.exe ups_ins
  2⤵
  PID:3768
- - C:\Temp\i_oigaytqlid.exe
    C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdys.exe ups_run
  2⤵
  PID:1764
- - C:\Temp\davtnlfdys.exe
    C:\Temp\davtnlfdys.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdys.exe ups_ins
  2⤵
  PID:1016
- - C:\Temp\i_davtnlfdys.exe
    C:\Temp\i_davtnlfdys.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdvsnkfdxn.exe ups_run
  2⤵
  PID:1852
- - C:\Temp\fdvsnkfdxn.exe
    C:\Temp\fdvsnkfdxn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdvsnkfdxn.exe ups_ins
  2⤵
  PID:3480
- - C:\Temp\i_fdvsnkfdxn.exe
    C:\Temp\i_fdvsnkfdxn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfdxvpn.exe ups_run
  2⤵
  PID:1824
- - C:\Temp\usnkfdxvpn.exe
    C:\Temp\usnkfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfdxvpn.exe ups_ins
  2⤵
  PID:4012
- - C:\Temp\i_usnkfdxvpn.exe
    C:\Temp\i_usnkfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxsmke.exe ups_run
  2⤵
  PID:1204
- - C:\Temp\pnhfzxsmke.exe
    C:\Temp\pnhfzxsmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxsmke.exe ups_ins
  2⤵
  PID:2560
- - C:\Temp\i_pnhfzxsmke.exe
    C:\Temp\i_pnhfzxsmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
  2⤵
  PID:4860
- - C:\Temp\jhbzurmjec.exe
    C:\Temp\jhbzurmjec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
  2⤵
  PID:1252
- - C:\Temp\i_jhbzurmjec.exe
    C:\Temp\i_jhbzurmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomgez.exe ups_run
  2⤵
  PID:1636
- - C:\Temp\jebwuomgez.exe
    C:\Temp\jebwuomgez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomgez.exe ups_ins
  2⤵
  PID:5020
- - C:\Temp\i_jebwuomgez.exe
    C:\Temp\i_jebwuomgez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuojgbzt.exe ups_run
  2⤵
  PID:1600
- - C:\Temp\ebwuojgbzt.exe
    C:\Temp\ebwuojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuojgbzt.exe ups_ins
  2⤵
  PID:316
- - C:\Temp\i_ebwuojgbzt.exe
    C:\Temp\i_ebwuojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  PID:3680
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  PID:3780
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4936

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
- Executes dropped EXE
PID:4228

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
- Executes dropped EXE
PID:4968

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\vqoigaysid.sys
C:\Temp\vqoigaysid.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:1688

C:\Temp\aupnhfzxsp.sys
C:\Temp\aupnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\omhezxrpbz.sys
C:\Temp\omhezxrpbz.sys
1⤵
- Executes dropped EXE
PID:2648

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\bytrljdbvt.sys
C:\Temp\bytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:2512

C:\Temp\ytqljdbvto.sys
C:\Temp\ytqljdbvto.sys
1⤵
PID:540

C:\Temp\sqlidavtnl.sys
C:\Temp\sqlidavtnl.sys
1⤵
PID:3712

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:2732

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
PID:4156

C:\Temp\ausmkfcxup.sys
C:\Temp\ausmkfcxup.sys
1⤵
PID:3192

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
PID:1692

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
PID:4424

C:\Temp\ljdbwtomge.sys
C:\Temp\ljdbwtomge.sys
1⤵
PID:620

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aupnhfzxsp.sys

Path C:\Temp\aupnhfzxsp.sys
Size 141KB
SHA256 042b92c04a4b56cf496092cef0a9ea4d27867f2b15e94c58e7b554a9087f58ae
MD5 61aa98f8d313db091667ccacbf832b89
SHA1 10294b36fabba3b494fe07a9f016aad6d76dfbed
SHA512 5399d1451e877358349a654c8b53210da0c39203c1fba25421c4d8e2fa8be9126b961b1359a422826fe13fee03b4bcb3e0525166ae0c6f7fe2a07b0d3cf3f39c
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgezwr.exe

Path C:\Temp\bwuomgezwr.exe
Size 243KB
SHA256 38535b32053ad493b37bc7d0dc75e21c7e45fc75be70cdebd208bf96eeb749f9
MD5 1592703d73ab41dede40e2533236b1a5
SHA1 4840aa4eca6e8d831a8219726856e98937f5f56e
SHA512 9e2fff1d3d132dddef2b03fc0598374cfa54d532b153e2b8373059a0760f494fa73b0847099865497cabd1ce5dbf32039af84576c714650be56fb2c49bcd587e
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:zvMsLaOa3lLNngoqRttA7m
TLSH
T1B4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlfdxv.exe

Path C:\Temp\davsnlfdxv.exe
Size 243KB
SHA256 8fbaff96efcf44ed09ea09358c0a81c7bd5fbe7e658fe40d336cfeb52ed10a4b
MD5 0db19bd5caf8fabeaa3134020e74da20
SHA1 ad3dff82da0c0283d930bfa1f159854ec109e466
SHA512 98a544e1ca775ab3916f59d809bf8fb234d77635418e6c38e46ce3bc89b47b1349751e75510cb752282cc4bc75d5ea9dba10e6383fa526e9ea755b381e801368
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:PvMsLaOa3lLNngoqRttA7a
TLSH
T1E3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhczu.exe

Path C:\Temp\ezxrpjhczu.exe
Size 243KB
SHA256 1f99decd6fa6c2c400c2b944a57e16ada48b40df03a80f9af609245aa061b689
MD5 3c3b1d57e24f0aedf543bf1e2c72eaaa
SHA1 3c6e09d01be59f33cb9c15fc587b3cbfd7a0b938
SHA512 b9c2d6de0a672fb8eda999f26efc82a367a73f6f3379b62236ec9ff37bc031052e9bf670fcd7f16b04dce4f0f0db6bcd45ea0ff4b5fa4686c49a55eff12feca5
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:gvMsLaOa3lLNngoqRttA73
TLSH
T153345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgby.sys

Path C:\Temp\geywqojgby.sys
Size 141KB
SHA256 2c6ae9e2964f6b0213b473d6d7cbdda97c048bacc33a6d7f2a25cb068e874d70
MD5 23a5bb6cfce6c9b488f03cb6f85be1e1
SHA1 bf4b38c28ea4132e27b9c01e0096c664a8dd08d2
SHA512 65432954676309dce9f67a84c35fea707429c457d9d7daa730feed529b63043c2c3db4eeecacd39d1c0440a6298c66e524e9cd99b48600883a317419442d1860
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomgezwr.exe

Path C:\Temp\i_bwuomgezwr.exe
Size 243KB
SHA256 9f3a5aad1399710a7fd863fc9ccda2bff307a6e30d20ea81d62fa65139c9ee9f
MD5 9ec82210778d0494fa4d863db0fac73d
SHA1 110b20f662b1124301506a4e95ee256c4f2f794b
SHA512 7cf939abcce420888cd6d516cb959a51e6fd5686385485403bc5bc61dc4a42726088944889d850dc9cf722ab9c65ecb7edbf058ce192f856a45eadd9279cf91a
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:DvMsLaOa3lLNngoqRttA7u
TLSH
T116345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsnlfdxv.exe

Path C:\Temp\i_davsnlfdxv.exe
Size 243KB
SHA256 bdb86221832a885d909ccefd17540fb54720ee2004d5320b249ae334555b0aee
MD5 c50ca156c254db836e54b325aff8f1d3
SHA1 124b1ad9e0525a04158fdbac36600aa4d764ff2f
SHA512 2f93054a3877282a597352e4947fb359dd5153d0ae18879ad183d86d7e2472b47ec893d19ee4ba432e19d0dc26e8800d9720adbff596007913b09fcac9a81c28
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:WvMsLaOa3lLNngoqRttA79
TLSH
T1F5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqobyt.exe

Path C:\Temp\i_mgeywqobyt.exe
Size 243KB
SHA256 6a1f6dc31ae80ad0f00bda5193b037f221c6afc66a1e6fb19e6f8d55cc84c92a
MD5 ed739d1c9d353bde1784692707af22ee
SHA1 551d828337b5e4b26f296aa3821c5c7543be7e05
SHA512 0d4c8bf08e3352d150d217beb3f769edf1a072b1bec16cefaaf2a8ca35bf6addede4348903510c7c2446c6dcea7fe18d25ff0f8211cbc3b7dfcbc39902609582
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:zvMsLaOa3lLNngoqRttA7q
TLSH
T139345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdyvqoig.exe

Path C:\Temp\i_nlfdyvqoig.exe
Size 243KB
SHA256 21ac6e6352ae8981c0e0e687a46aaab3a9ad94e0a5c9d43cd2b0d3964cdd269f
MD5 4b5f990350ca00c1b69ecaa4d439d39f
SHA1 f441bc2f3da234a0a4399d2f84e83c4bfacec2b4
SHA512 d94cd3c3fd3e6f9ee4d9502278abf71da643b9278947f08144be10c49b735a83440e49f331cb909566946127e16f9c84c0bb839233eb3390e58070c4984584d6
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:HvMsLaOa3lLNngoqRttA7a
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausmke.exe

Path C:\Temp\i_pkhcausmke.exe
Size 243KB
SHA256 d8a5809f53a86d30ea3ea7c04bf51d3943a3fce0eebd178f4e3a47b68b81b887
MD5 5d529cdbbd6a29a7a82946dbd48cf537
SHA1 f6747386d8be8a44610096f13f04573e61c8a98e
SHA512 1ed255917a0d4144eddb153565de7b70d12bc9f641d96e06c85b6b331604fba5adea2178fe9e69d53b7954384c07e1371497ea47cd5b6b3abab3ce95de4e2b1f
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:KvMsLaOa3lLNngoqRttA7x
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xsqkausnkf.exe

Path C:\Temp\i_xsqkausnkf.exe
Size 243KB
SHA256 e255f36842f52c81b3cf0ff6cdb5ff0c95932344cf55329f0ef365c37df2126f
MD5 f88305db9593b54a4c58d4ac75dba4e0
SHA1 290b295cb0ef797f3c9f867471558a003333f205
SHA512 4b955c9b9a5f8f531d5dd08ab6f1cdd667cba72d85b2bd752ca28395c7601a6f1248e4f01664aac833b31c60521b87526f97d789da005ff9a63c9c6aa5bcb5dc
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:xvMsLaOa3lLNngoqRttA7U
TLSH
T137345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljdbvqo.exe

Path C:\Temp\i_ytrljdbvqo.exe
Size 243KB
SHA256 474a10481843a240d5eade712bf685ee5f725d89c210c2881498f47ed8794046
MD5 2a9a539b8249766baf61fda308d9babd
SHA1 36c58d65d8144ef5a22a91d4d775b3f77045d70f
SHA512 e6ccd94262cfcce24f491d4e0ba41228e5af33f5c9ffe601f60abecd795ceb7e5bcb82fb1e6b5a6c4029e69fa10a9b148eb6f398d935d4e0f71a185b813c095f
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:UvMsLaOa3lLNngoqRttA7b
TLSH
T103345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.sys

Path C:\Temp\icavsnlfdx.sys
Size 141KB
SHA256 7afa3f29ad786d3f3fad5ce12586df2be56256f0f6b05ae8c43fb3a0a15e90dd
MD5 52c83ab28e771567244a0d55cff4aba6
SHA1 dfe3be1b7d1fe7da8dfe30c5ea42beae58ff79d0
SHA512 ce0bf5184fb2731c6f29cba1363349b2ba01e575769ba826cd2ce78d07e0a6193e927443834274307f26259b826ee123395779ce7ac44135c8de14f4fe6e67e6
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T164E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqobyt.exe

Path C:\Temp\mgeywqobyt.exe
Size 243KB
SHA256 9ebb368c0f33e36ef8db29d3df7c62bae58621f361200554afbc2168b1f206d7
MD5 c8a1419c8cf87d2c5ed50ff68753892a
SHA1 4bdfd70d04c138e87429e26d10d28915911606cc
SHA512 64163fc507f8797d78aec11a71968686b99cdddfe523e0b2189cd908aecaf214259b47a41a080c765ad29be4bc9f9c69965ca0610eea2ab818270157da0fe9c0
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:/vMsLaOa3lLNngoqRttA7i
TLSH
T1AC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhf.sys

Path C:\Temp\mkecwupmhf.sys
Size 141KB
SHA256 9ffb4505f2f7b82ca04aba5079c7a35e94564ed5707924cb143e44d1f79ac301
MD5 7c97f3de92aa7acd8851ffcba9c177e6
SHA1 b33d69250544b498aaa1bf099debcaa4c5d80dfe
SHA512 26f67e4063d4533c734c341dd0ea1468516c6dc078cf3c9585423a63de7380ece2ef631070af2744aa1349250583e53094262ce7433ef69d167fdae815548121
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.exe

Path C:\Temp\nlfdyvqoig.exe
Size 243KB
SHA256 aea991eb1404fa629c246880d9c476c62f7393af5abf0bf454ece2d23e8702c5
MD5 2d56bead0807863487a96398c34b763b
SHA1 f7cf98657b8653dd0758bdc574675db29b6ab9af
SHA512 56adcb8ba0fa6d3fad6819edabae55be610c13b91e08837e6e7523cd5c227b312eab64a605422c9dc521f6109e379260972d519e768f22e4c4cc38c7fd6663a8
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:XvMsLaOa3lLNngoqRttA7G
TLSH
T1C4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.exe

Path C:\Temp\pkhcausmke.exe
Size 243KB
SHA256 a4fc2c7f68120a689d8d5afd8a3fbd9566bdd3bdc11267f62953bed177f7e30a
MD5 cec190662ec8217d98a58f815a74e2a2
SHA1 df1483d17ab3ebdd50daebd2cfac5009c6eba909
SHA512 273ce5043dc4a196d828ea39ac432458b56d83cd55fa8dc420db2c84c9321d665e2af36292e0f615de55e69f666933e7601396add36e7c947815f8afefa4b6c3
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:6vMsLaOa3lLNngoqRttA71
TLSH
T1DC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysid.sys

Path C:\Temp\vqoigaysid.sys
Size 141KB
SHA256 d45c8b064e754f6e270bafa6bbe614ea09317559ccfc04778ce0449bcfd5ff33
MD5 94df24310f84cdb37a4ae7f7de00ef34
SHA1 9fc63d47b671d5e3a12b2da3596f1239dc0c3e5f
SHA512 e0583325607c1e71eb015ae9403786e2337c8a2902a9a5105bc8b729cba17729d152b6c78f7f79de42506e854ef9e40d4827200775839d2208cad7c0040b8c67
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrl.sys

Path C:\Temp\wrojhbztrl.sys
Size 141KB
SHA256 083edf79c381ace06da6a3cd71928f3074cb3676368b4d21f5283557a32fa556
MD5 c7d5bb2e97c422bb42fee7b25efe41cc
SHA1 4bbd172411053485fdd483d93557a78ea7a669a8
SHA512 acd18008b33945334ff0abeec8a51f6bed2f7acef05f83395fd88ee3c00cbd3b0aee42a8373fd8a4f55357c324d7e4d68fc6f3bbbf7d1781baf0b4007bd2fc71
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkausnkf.exe

Path C:\Temp\xsqkausnkf.exe
Size 243KB
SHA256 66824b2daa3d47b80f4ee30039f7796a40e6b2445e661b55e0f9ee15cd67c545
MD5 295121ca6d3a2a0db27856ca235c93cb
SHA1 75168ee97d9bd45473af6a278a66163a7426c9ee
SHA512 751abbc4ac6dca3a338fa8c8188d46ac47ab974124aecb07a5a6464aae115d1f56cd22c056f98cd36bd1dfbb729bcc815b39b5ef15d583a079bf512cae2c63da
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:GvMsLaOa3lLNngoqRttA7h
TLSH
T16F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidbvtn.sys

Path C:\Temp\ytqlidbvtn.sys
Size 141KB
SHA256 5ed73d5c653288fac8fef11f4a69446cf18cafc2ed267609af8866b9651b13a6
MD5 1f60bf7610beb1569972a43962f563bf
SHA1 d04e3c8e4e6ba022def5f410c83790ad1df7f27d
SHA512 8d5c0849933f6495735f543f4d07326af2f90349cee971ab7531d5507a265dcb06c1a49ed88405748a4cb0e92e48eeaeb48ca679c30539ee89a6308f181e20a9
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvqo.exe

Path C:\Temp\ytrljdbvqo.exe
Size 243KB
SHA256 a418448c14f8e2eb93dada54285dc907f5408ff2c6a3fb2ba93f20db64eed513
MD5 7c31cfab1e6eed2b58dbc2f2031d3d44
SHA1 8e68a99939f3991387333fc19cb7bbc90c4e3017
SHA512 c6f5746f1db6fa2b9c8acd2c2104f931a9191e4ed721df1387e9b592ef54dda5bda51b7c77f18d30ca5589cad10c9d4f1f9cd7b3d656a7dbf7d767baffd59577
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:uvMsLaOa3lLNngoqRttA7N
TLSH
T182345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 4d03a5b17d74c1087482c349e0450f67aae3cc7b9f2df31e070cb8509cafa4a5
MD5 fd2ee56eb401407431b75cb607946369
SHA1 ba015123a6a48b074277349de9e602593c9a6af2
SHA512 0727a74837262149a428ee9b0f70a51f658633fec59d5048ba7f3ded7e73e4cfe9a5f07f94fc4393ea2fb431c8823f42b360ffde0497d221174f71c1252dd7df
TLSH
T1ABF0D493D16CD012A57105EC49C54F74B0A260628094109D672C94E68DE6E745F39433
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 50b16fc80e9b4a255b0d2581d7bfe5faa9c68d0c2d905eee7420f3f6f4b08abf
MD5 3621ff463ee2b9e7917ef7776776bb57
SHA1 0b705da11ed41ebd402711d1a54fde98d635a113
SHA512 77e3a79b947e8260fb951ccd2c9393a91dec25426f5c15a9ff4eed87bb37c292bccb23887422ae951da1cd0b010f979e87ea548f9da7c408ea1ffeea70ce9fae
TLSH
T197E0C02415FA412FE1F4D4364BD57525C66EF022183CE2B825E4DB08B7126009E02A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2CAWFFZ1\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/620-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1264-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1692-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2512-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2648-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2732-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3192-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3620-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3712-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4156-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4156-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4228-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4424-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4968-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads