e18f397d56205a6f2befd177efd84c18652545fba8c5e1c8188571be813c9bb1

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe
Size 243KB
Sample260712-v2thfset8j
SHA256 e18f397d56205a6f2befd177efd84c18652545fba8c5e1c8188571be813c9bb1
MD5 300cc42a10dd9475274d0d80b56d5821
SHA1 ba8c43c2af2a6300310f56c5c1b89d9d36f2071f
SHA512 c34bad37562fe52ba1c1f4df6c235b0d86875229718d76f53a16a471c8761e2f4cbab3e9abcd27072f010e848259b3799ca186634760e4c2de26ba16ada117cc
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:cvMsLaOa3lLNngoqRttA7/
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5652	CP.exe
5668	hcausmkecx.exe
2268	CP.exe
2084	CP.exe
5548	i_hcausmkecx.exe
1896	kecwuomhez.sys
6072	CP.exe
6096	zxrpjhczus.exe
5904	CP.exe
5052	CP.exe
3764	i_zxrpjhczus.exe
668	hbzurmkecw.sys
6080	CP.exe
2764	ojhbztrlje.exe
2296	CP.exe
3556	CP.exe
2760	i_ojhbztrlje.exe
4140	omgeywrojg.sys
1848	CP.exe
2480	gbztrljebw.exe
1884	CP.exe
5300	CP.exe
5760	i_gbztrljebw.exe
5440	bztrljdbwt.sys
5308	CP.exe
5512	qljdbvtnlg.exe
5240	CP.exe
5700	CP.exe
3520	i_qljdbvtnlg.exe
1744	lidavtnlfd.sys
5304	CP.exe
1604	dbvtnfdyvq.exe
2140	CP.exe
724	CP.exe
876	i_dbvtnfdyvq.exe
6084	faysqkidav.sys
1408	CP.exe
2748	nkfdxvpnif.exe
532	CP.exe
2336	CP.exe
5804	i_nkfdxvpnif.exe
4404	sqkicavsnk.sys
6040	CP.exe
2416	kfcausnkfa.exe
3680	CP.exe
3100	CP.exe
4624	i_kfcausnkfa.exe
4500	ecxupnhfzx.sys
5268	CP.exe
2364	xspkicausm.exe
6116	CP.exe
5128	CP.exe
5140	i_xspkicausm.exe
5712	upnhfzxrpk.sys
4228	CP.exe
5180	kecwupmhez.exe
1564	CP.exe
4224	CP.exe
4932	i_kecwupmhez.exe
2760	omhezxrpjh.sys
3384	CP.exe
4472	wuomgezwrp.exe
3424	CP.exe
5720	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5848	ipconfig.exe
5332	ipconfig.exe
3800	ipconfig.exe
1416	ipconfig.exe
3760	ipconfig.exe
1992	ipconfig.exe
3052	ipconfig.exe
3784	ipconfig.exe
1120	ipconfig.exe
4240	ipconfig.exe
1776	ipconfig.exe
5768	ipconfig.exe
5140	ipconfig.exe
4796	ipconfig.exe
4848	ipconfig.exe
2204	ipconfig.exe
3468	ipconfig.exe
2380	ipconfig.exe
3488	ipconfig.exe
5884	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f000000000200000000001066000000010000200000004b066798dca44891672281de2a08834a9f945b06099e6ffdf433e8248e2332ea000000000e8000000002000020000000fc6038bed95cf69669303ba72178857534b535ef85eb6d839fc80f7a6ae59c57200000000d77a6db1680bb7ec78323122acc524c5f819146f66fe22d9503ffa4cf4686fe400000005af0133c2c944123d322a500e4dedb498d1363e48d5f7d5991cdbebd1f5555793dfcdb56384fe9e8fd464682dcc5edea138d7f0e8b377f6d578d5e88807c3ec0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f000000000200000000001066000000010000200000004d5d4eb14537492745c4745f26a0226dfd7c4c34eec1f10237e09cfa04d759e8000000000e80000000020000200000005e1171ebeb5a783423385b8b046ec48a3f7c2efd1ae059072a7f64b1357425b82000000030c6c7d9b0fa547cee679f3ae654b8e88bd77e972d8c13acd5e3b5f5c9d99d5140000000bcba7c4c0bbefc69729670b9ce83fb8ed361e7f8c268ff0302b890633e70eba3611b088d5c8da00605b9dd14edf15e1274b57350f4dd3d3c6df6e0640e9767b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "490642348"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31265316"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bbe8802c12dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02ceb802c12dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "336857757"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3F29C0FB-7E17-11F1-92B0-5AB93EA64185} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5548	i_hcausmkecx.exe
Token: SeDebugPrivilege	3764	i_zxrpjhczus.exe
Token: SeDebugPrivilege	2760	i_ojhbztrlje.exe
Token: SeDebugPrivilege	5760	i_gbztrljebw.exe
Token: SeDebugPrivilege	3520	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	876	i_dbvtnfdyvq.exe
Token: SeDebugPrivilege	5804	i_nkfdxvpnif.exe
Token: SeDebugPrivilege	4624	i_kfcausnkfa.exe
Token: SeDebugPrivilege	5140	i_xspkicausm.exe
Token: SeDebugPrivilege	4932	i_kecwupmhez.exe
Token: SeDebugPrivilege	4852	i_wuomgezwrp.exe
Token: SeDebugPrivilege	5992	i_ojgbztrlje.exe
Token: SeDebugPrivilege	2660	i_igbytrljdb.exe
Token: SeDebugPrivilege	824	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	4540	i_lfdxvqniga.exe
Token: SeDebugPrivilege	3300	i_nifaysqkic.exe
Token: SeDebugPrivilege	5400	i_fzxspkfcxv.exe
Token: SeDebugPrivilege	2068	i_ausmkecxup.exe
Token: SeDebugPrivilege	1056	i_rmjecwuomg.exe
Token: SeDebugPrivilege	5800	i_rpjhbztrmj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4824	iexplore.exe
4824	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4824	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	86
PID 4824 wrote to memory of 2948	4824	iexplore.exe	87
PID 4772 wrote to memory of 5652	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	88
PID 5668 wrote to memory of 2268	5668	hcausmkecx.exe	91
PID 4772 wrote to memory of 2084	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	94
PID 4772 wrote to memory of 6072	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	98
PID 6096 wrote to memory of 5904	6096	zxrpjhczus.exe	100
PID 4772 wrote to memory of 5052	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	103
PID 4772 wrote to memory of 6080	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	107
PID 2764 wrote to memory of 2296	2764	ojhbztrlje.exe	109
PID 4772 wrote to memory of 3556	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	114
PID 4772 wrote to memory of 1848	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	121
PID 2480 wrote to memory of 1884	2480	gbztrljebw.exe	123
PID 4772 wrote to memory of 5300	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	129
PID 4772 wrote to memory of 5308	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	135
PID 5512 wrote to memory of 5240	5512	qljdbvtnlg.exe	137
PID 4772 wrote to memory of 5700	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	140
PID 4772 wrote to memory of 5304	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	144
PID 1604 wrote to memory of 2140	1604	dbvtnfdyvq.exe	146
PID 4772 wrote to memory of 724	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	149
PID 4772 wrote to memory of 1408	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	153
PID 2748 wrote to memory of 532	2748	nkfdxvpnif.exe	155
PID 4772 wrote to memory of 2336	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	158
PID 4772 wrote to memory of 6040	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	164
PID 2416 wrote to memory of 3680	2416	kfcausnkfa.exe	166
PID 4772 wrote to memory of 3100	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	170
PID 4772 wrote to memory of 5268	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	174
PID 2364 wrote to memory of 6116	2364	xspkicausm.exe	176
PID 4772 wrote to memory of 5128	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	179
PID 4772 wrote to memory of 4228	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	183
PID 5180 wrote to memory of 1564	5180	kecwupmhez.exe	185
PID 4772 wrote to memory of 4224	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	188
PID 4772 wrote to memory of 3384	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	192
PID 4472 wrote to memory of 3424	4472	wuomgezwrp.exe	194
PID 4772 wrote to memory of 5720	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	197
PID 4772 wrote to memory of 4724	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	201
PID 3916 wrote to memory of 1880	3916	ojgbztrlje.exe	203
PID 4772 wrote to memory of 5640	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	206
PID 4772 wrote to memory of 3308	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	210
PID 3776 wrote to memory of 5748	3776	igbytrljdb.exe	212
PID 4772 wrote to memory of 1036	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	215
PID 4772 wrote to memory of 3584	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	219
PID 4116 wrote to memory of 2488	4116	ytqljdbvtn.exe	221
PID 4772 wrote to memory of 5020	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	224
PID 4772 wrote to memory of 2332	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	228
PID 6092 wrote to memory of 3788	6092	lfdxvqniga.exe	230
PID 4772 wrote to memory of 4696	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	233
PID 4772 wrote to memory of 4136	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	237
PID 3684 wrote to memory of 5272	3684	nifaysqkic.exe	239
PID 4772 wrote to memory of 3864	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	242
PID 4772 wrote to memory of 3420	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	246
PID 5548 wrote to memory of 4500	5548	fzxspkfcxv.exe	248
PID 4772 wrote to memory of 1736	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	251
PID 4772 wrote to memory of 5232	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	255
PID 1872 wrote to memory of 1296	1872	ausmkecxup.exe	257
PID 4772 wrote to memory of 3044	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	260
PID 4772 wrote to memory of 1644	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	264
PID 2880 wrote to memory of 1532	2880	rmjecwuomg.exe	266
PID 4772 wrote to memory of 5168	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	269
PID 4772 wrote to memory of 3068	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	273
PID 1080 wrote to memory of 4996	1080	rpjhbztrmj.exe	275
PID 4772 wrote to memory of 4716	4772	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	278

C:\Users\Admin\AppData\Local\Temp\2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4824 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5652
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2084
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6080
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3556
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1848
- - C:\Temp\gbztrljebw.exe
    C:\Temp\gbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5300
- - C:\Temp\i_gbztrljebw.exe
    C:\Temp\i_gbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5308
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5700
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\dbvtnfdyvq.exe
    C:\Temp\dbvtnfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:724
- - C:\Temp\i_dbvtnfdyvq.exe
    C:\Temp\i_dbvtnfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1408
- - C:\Temp\nkfdxvpnif.exe
    C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2336
- - C:\Temp\i_nkfdxvpnif.exe
    C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausnkfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Temp\kfcausnkfa.exe
    C:\Temp\kfcausnkfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausnkfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\i_kfcausnkfa.exe
    C:\Temp\i_kfcausnkfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5268
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5128
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4228
- - C:\Temp\kecwupmhez.exe
    C:\Temp\kecwupmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\i_kecwupmhez.exe
    C:\Temp\i_kecwupmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Temp\wuomgezwrp.exe
    C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5720
- - C:\Temp\i_wuomgezwrp.exe
    C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrlje.exe ups_run
  2⤵
  PID:4724
- - C:\Temp\ojgbztrlje.exe
    C:\Temp\ojgbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrlje.exe ups_ins
  2⤵
  PID:5640
- - C:\Temp\i_ojgbztrlje.exe
    C:\Temp\i_ojgbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run
  2⤵
  PID:3308
- - C:\Temp\igbytrljdb.exe
    C:\Temp\igbytrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins
  2⤵
  PID:1036
- - C:\Temp\i_igbytrljdb.exe
    C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  PID:3584
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  PID:5020
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  PID:2332
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  PID:3864
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkfcxv.exe ups_run
  2⤵
  PID:3420
- - C:\Temp\fzxspkfcxv.exe
    C:\Temp\fzxspkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkfcxv.exe ups_ins
  2⤵
  PID:1736
- - C:\Temp\i_fzxspkfcxv.exe
    C:\Temp\i_fzxspkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:5232
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:3044
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:1644
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:5168
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  PID:3068
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  PID:4716
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:1896

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
- Executes dropped EXE
PID:668

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
- Executes dropped EXE
PID:4140

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:5440

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:1744

C:\Temp\faysqkidav.sys
C:\Temp\faysqkidav.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
PID:3400

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:220

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:2044

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
PID:5792

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
PID:4976

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:5980

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:6088

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:5320

C:\Temp\cwuomhezwr.sys
C:\Temp\cwuomhezwr.sys
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwt.sys

Path C:\Temp\bztrljdbwt.sys
Size 141KB
SHA256 bed0d98997a780c5cb6ed8ba18467f7fc39526c355ae4f38d94d119d93d435ad
MD5 72972e1fe40a6cc41585f45a1ba5a28c
SHA1 b8018eca468dc771a5cda7e4054305c5c26ae62e
SHA512 b47906215d76d3d82971661da40910505a6698448688438a069aa2eebe23b7388d07f03e88cddb0afb4631c5b2cedc99d8fe545be1359570de39b3b71a4cf365
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnfdyvq.exe

Path C:\Temp\dbvtnfdyvq.exe
Size 243KB
SHA256 a1d84600faaa0ab21fcacd0c4fdfd1ccbc802a8e33dd01a371a1e452116fdc2a
MD5 681be35934f93b421568eb475e9cb1b7
SHA1 de8f726baebc61a72bd6fd3b796079b3df5f1cd0
SHA512 ff13eabc30ac371644f460d67aa65342f2752d4287b557535f5830230688ef01c34f0819fbd027cf91dd079597522e51c72188760940edab0d55ff215b9b4ba6
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:YvMsLaOa3lLNngoqRttA7j
TLSH
T1AC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkidav.sys

Path C:\Temp\faysqkidav.sys
Size 141KB
SHA256 74335f78d9046b409ea18c1d9c37a014cd6e54f51229aa38c34835587a8f804c
MD5 12d0518bb2e6801ea7a2fd1b7378114a
SHA1 1fdc65da1837cba1f6876748e318bf5b5b08e612
SHA512 8dab46ddc72c72a6f4ed8b2278af7d7e3a6a129b3ea506bfde1f7303394a4c2bdb5b0f5ff2406f5b71db56ef89952107d3c9b1bb63badb842a9e865cbe0f7a5a
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljebw.exe

Path C:\Temp\gbztrljebw.exe
Size 243KB
SHA256 af0c2366091083e5f44bc0453d814e97cd0ef2c8247660f2b6e3206f9a7348e1
MD5 e4ee6320cd9eb07358ef9e0cc3100075
SHA1 73d38a97bc433926357887033bf690a2b5cbcb46
SHA512 616289a0695e0d2dbe9b2b66796b271b447b5d01c4dc329ddcaa63fb97acb6025dbd2008ecb743dfa1c067dcca190c170457612446814ed5302d3890f533478a
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:tvMsLaOa3lLNngoqRttA7s
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkecw.sys

Path C:\Temp\hbzurmkecw.sys
Size 141KB
SHA256 5bc1bde7c1bf19ec60b3e1712360be8fe75d8a3fc559c3fb32680a1bf0ddcd5d
MD5 e3359d7c8b0f24bb2d5fda1398c03077
SHA1 b724e8a6570a07aeb7f1c3e3e00bf5a7169faf9e
SHA512 9c561ed6b4c1029c7df61e1dafe946ec0f91993465ba7d38e7df62bbc791ac1242cc0d9e4adfd043b92ee57fb04aca9389267fd93200d01a594855e9b5ce9f90
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.exe

Path C:\Temp\hcausmkecx.exe
Size 243KB
SHA256 bb0281e12a34e1d20e90214b67f93edb654d2cf9f487462b7354d9f55a731c66
MD5 fa8bdf8674647eeb5463b3efd576ab91
SHA1 74a8b624d464cabc4e9b71d3ab8888acb8d7d898
SHA512 df3a8cd2df72f5d4437d619cbf65fbdc384d9964c5ac7058d30fd8c51fc1a0390e8e4422005e37392dfc593ee0c310da57b0469428ee06379a0d279074e643d2
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:HvMsLaOa3lLNngoqRttA7e
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnfdyvq.exe

Path C:\Temp\i_dbvtnfdyvq.exe
Size 243KB
SHA256 4bd9c03bfc839eb629b1a44abb6b5c643800aadd6bd88fd72cebe6d3cca420ae
MD5 34003a5d7581f06f7f69f608633d8a7b
SHA1 2fec0bca3c0c6b5f64d04d8e1954edb409e0f627
SHA512 716f7be4f7170ac5b901043894e7eb1a36660c18a95c35e9e90bbf29438bdb16f842e2152c2ad62853b6148b563e4d33333580f55e7f58a59fecf0406cbba9db
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:cvMsLaOa3lLNngoqRttA7v
TLSH
T1E5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljebw.exe

Path C:\Temp\i_gbztrljebw.exe
Size 243KB
SHA256 7abb3d87604990e65b3fed27bc97bce5b87083932e64c816728bef3f84ba36ad
MD5 41368de7d3532fcf545d2ce91dfc5885
SHA1 94990ead31ec9cdea073b236e64006050ac51aa9
SHA512 e52ddf69da9c9457cdcf7e2e0cc6ef5f08abd525b52184aa980c44ebde00125e822ce2de1e3ed4d957d5f9aee55991f5911d8b62c7a050a0da4030dafb4f8e23
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:bvMsLaOa3lLNngoqRttA7W
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcausmkecx.exe

Path C:\Temp\i_hcausmkecx.exe
Size 243KB
SHA256 c8ef3e52a9dca5c7468576fc7219d3671aa095f2c130bcb7a81b514e0af23107
MD5 8f7d8ff9932986bca36a42ad107544b6
SHA1 1e8ff1cae7d6ef184bbbb5d7a2c3ce9ac1890cc3
SHA512 0d6b06b33be2081008ff2bbbf6812331093e56676377bb59a38280ff6737cd0c73e801faa5c9f250f59aaca03c3f983dc6f8f45784a8dc130e0fa0ea9d7e7a23
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:jvMsLaOa3lLNngoqRttA7O
TLSH
T19F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcausnkfa.exe

Path C:\Temp\i_kfcausnkfa.exe
Size 243KB
SHA256 650fe152fc2c245aa475f83b502d208ec1f6e679fbf054859c4773b955ad4317
MD5 b783864b45afe490ca94167d0c3d1b90
SHA1 f23c5b35962184bd61136641e3c0c91b40a39304
SHA512 ee1609f850196c176383a18258bd68e11288851022d1f22dc95f6eea5b35143dcc1af6069db26b264285533f32159f1c00641d635b759ebd97a94915ae432715
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:PvMsLaOa3lLNngoqRttA7S
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnif.exe

Path C:\Temp\i_nkfdxvpnif.exe
Size 243KB
SHA256 4c6c86cca2f10d532543f621a45dd44d76622bd76496e3759c8c74f34f741c8e
MD5 59c5550666650a4d4928c52418a04b30
SHA1 889f1a8573e99a5339b3022b85d2b744a7d82636
SHA512 41e468316e0783983528a957b17396d646120fa8e6b6179c3d752ae68e93640cc03ef130cce72b6079a383bfd86c814d7a8254c8e907bdbefcc3fe053f089ce7
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:JvMsLaOa3lLNngoqRttA7s
TLSH
T1CE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojhbztrlje.exe

Path C:\Temp\i_ojhbztrlje.exe
Size 243KB
SHA256 4d6390a1c5785efbe44da4c3b9380018c971409c5e0751872c9ed5f20e71a568
MD5 866f39be641f752f3ad3ae141188665d
SHA1 a795ba8ac84f94adc968e1cffd979fe791255a89
SHA512 7882e156f6c6afab00b0a111845c715049edd43d16e22a8cbca845177052c7310f38d8d6fa404fbb2f36ac144f320d788a5c771cf7dbfd32a6cced2de8bf8585
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:YvMsLaOa3lLNngoqRttA7b
TLSH
T10B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbvtnlg.exe

Path C:\Temp\i_qljdbvtnlg.exe
Size 243KB
SHA256 240966b6b2fa3a048ea621f120df5c9915bbdc0fe849b52d2825ad025fee11b6
MD5 52b2f91c7a5ae6daf9ff88844bc92085
SHA1 562f60ec0870f1b39281557a3ad5aa3839745b4c
SHA512 fc99e4ddf3328284d04f8c55e36107da94f0a2e877c1d89fac21a9d79ce9a0fa37b99fb9ae70d64845a9b702512b4d8d7f7f2990d8bdc495f52898484cb5ffe1
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:8vMsLaOa3lLNngoqRttA7r
TLSH
T1F8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczus.exe

Path C:\Temp\i_zxrpjhczus.exe
Size 243KB
SHA256 598c16c476c866d15aafb774d8b18260ae3da1321a80534268952333dfd88a3f
MD5 16eb5477b874c8aa5f4b8128a5350ed7
SHA1 4084e71a7a2a305987b76874b684c216c52ce0fa
SHA512 b01c1995d8fb5c8d07c2a3cf8a611fe35d5a9ec7a27ec742ccf4a6f715a1663627e6789d6b0356a928c77eef1435c3f4aeb7e92cd7fa79e3c7c0ca92bab372d3
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:SvMsLaOa3lLNngoqRttA7R
TLSH
T1D2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhez.sys

Path C:\Temp\kecwuomhez.sys
Size 141KB
SHA256 b84ac4d02a4e0086f93c98c41e5d38043890015dcb6754008f105c8eef623a2c
MD5 5f4555c2c178e8ae510b6535abe8757d
SHA1 f8ec4733a1563f4ff25b76f6712d6e20da6f5140
SHA512 5437dbbd71c33138038289b59ae0d4041c67d33eb92490b4bb37e34631558b5f3aca8403dd194eb4b18c3880060e3daa579bdb3d75bcf8bb7061a2eed952cf35
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcausnkfa.exe

Path C:\Temp\kfcausnkfa.exe
Size 243KB
SHA256 00b1cf12acb24f4eff75f919be6ea07a59ab069236a0601d2607ff2d79e53e67
MD5 6b7ba5b783f672cdb4dbf5a59aaa8c55
SHA1 35b9402e1b8cbe88d9fc3c84f7dd9c934d20575b
SHA512 997f45d8cae9d43a081b37410148bbd6b1b128683a75c5296cc1643d06684d8c8c7debfd60b0460ad5c09a32246d5e76ab444156693cbf4b4a02c8969bd54292
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:hvMsLaOa3lLNngoqRttA7g
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.sys

Path C:\Temp\lidavtnlfd.sys
Size 141KB
SHA256 5c0292925f34b641940d1511dbc74c7b1377dc9225b60eac769b4fd3a8abdf90
MD5 3b8542d57cb1cc498c7db7e51f0dae33
SHA1 83e1a06c563e05d91ce13180cd745a46425e6b18
SHA512 9d0421907060b8c988113d62dc140ddd3cf744ff858afea99cd175381043fcafd29935883b82d2e438cb2d6be66efc37596011a364144d93ab36d9f92e9f7d8f
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnif.exe

Path C:\Temp\nkfdxvpnif.exe
Size 243KB
SHA256 2ded9febf089af411413d902d95cff6c01a42c220e939f81991a89b2e62b80d1
MD5 f78fa999c63fcc585c57c58749511181
SHA1 ba1c21078c40541e3b5fc8651bd941f2f486d36a
SHA512 50ca0bcfadaad840d492dc42b21e8cfb5ace014bd126246e8d021d80a8e99874548dd50b2eef3e0827a96e10c2277861c0318613fd6a8823eaf0af0c695fa885
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:CvMsLaOa3lLNngoqRttA7J
TLSH
T1BF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrlje.exe

Path C:\Temp\ojhbztrlje.exe
Size 243KB
SHA256 fa384519cc71cb39e9597a826e31e0ace44a4c53bb29366ef94b6ea173a515e0
MD5 f74a8bc5b8bb91f1ff9962a34eb840e4
SHA1 5ec65584d31bac7f52a2cc8a4e3eeaa96258ac9e
SHA512 5c10468d9043104349ce8172b860917604f4388bd5d979a69521b376d9a0452ae1654c370a025fb2211757a114e10dd8cf09b63852c4b8d2b9d02c812b674f1f
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:JvMsLaOa3lLNngoqRttA7w
TLSH
T190345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojg.sys

Path C:\Temp\omgeywrojg.sys
Size 141KB
SHA256 c9a183ab7ccb7dd3f6475131b913eb7d956a8bb9f844b7b32748014030dab838
MD5 9fc1c6f4a03139e72654195826c11f9f
SHA1 c091fb294660ffcb5ad1f554040448e799d4f07d
SHA512 d95c777e53382fe5e422adf8697417fa0be9bbb0971f037c9f0909594c5fd72d87c99a86099d524aebdc71013fd267f86e887c583cbad9211e1abb9317cbc261
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlg.exe

Path C:\Temp\qljdbvtnlg.exe
Size 243KB
SHA256 c2cbd73ab7449e1d3aa92c1f801fbf9d3f4523f1fb06057a0f50bd1c68a8bbf3
MD5 ad8ad72d517230e2c40fa559403b4070
SHA1 6e121c01ecf3410465ebd71d104dd1981dac0b7a
SHA512 d8a92df4205558555b04edfe5d32aa3089b8b2a84d44cafc44b1f58b8bfded05824bc4053fd44c0bf7887b22b5b25da8de05d2655afcabd3dabe7c8b528e4bd2
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:EvMsLaOa3lLNngoqRttA7D
TLSH
T1FB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.sys

Path C:\Temp\sqkicavsnk.sys
Size 141KB
SHA256 5e145f792c67b3c60070abbecef0558833697814ab70c05f917a554a8224c3cd
MD5 331155fa5111a5e71eb6f9dfdd051671
SHA1 86d90eaadce412fd70d8b0b73f5edee5baaca9de
SHA512 874e2128aa66ed1c7d3a12e1fc59ae51ecd9da1da13ef7dc5e6de371a7d06cdbf75f6812f7dc34e6efd7dc80cfc1a5ba83730a978900d63c247e802e4beca750
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczus.exe

Path C:\Temp\zxrpjhczus.exe
Size 243KB
SHA256 8a007b622b2fb8a1dcafedc931c2b86501f53ecf48b4ce0e8a91b63a06ee4994
MD5 e8c52e3a447a27ed2c89ca5c367db78d
SHA1 c3ed6cb017efc386e0619f34b885d1b6f75ca1e2
SHA512 faa44aafb6476f02bea5ce5682f26dcfac4e9d7906560def5f18abf7a7c62348b44349674332ef7de9e4511f52015065d69e8ea16e65b11b974db4a318daea31
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:PvMsLaOa3lLNngoqRttA7G
TLSH
T18B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/668-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1744-65-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1896-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3392-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3400-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4140-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4976-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5320-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5440-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5792-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6084-77-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6088-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads