96421ed54751d56b88e21ab671359c75131a4da9e5dd2a770807e7ae0b4e9fdd

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
Size 243KB
Sample260729-nadvcsvscv
SHA256 96421ed54751d56b88e21ab671359c75131a4da9e5dd2a770807e7ae0b4e9fdd
MD5 3a6707f1c0aa83c01e8408ed724a08ab
SHA1 b6c0af0c448a9fd0cb3827a49e54d7a05e37c1b2
SHA512 f43eb0e0fa9175000e43dc53ac7061b56dffa73db8f42bcdbcbdab7b7ad76babdc059c599064bb9a3c65e4aa0a77d66624d8f95c6405cc2b511043ccfd6e0def
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:ZvMsLaOa3lLNngoqRttA7Y
TLSH
T135345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5160	CP.exe
2848	zurmkecwuo.exe
5968	CP.exe
1900	CP.exe
2864	i_zurmkecwuo.exe
2544	jebwuomgey.sys
4072	CP.exe
4440	zwrojhbztr.exe
1192	CP.exe
5804	CP.exe
2412	i_zwrojhbztr.exe
1528	ebwuomgeyw.sys
1664	CP.exe
2504	ojdbvtolge.exe
3316	CP.exe
5744	CP.exe
5328	i_ojdbvtolge.exe
3112	tolgeywqoj.sys
3892	CP.exe
3020	idbvtolgdy.exe
1820	CP.exe
3808	CP.exe
2244	i_idbvtolgdy.exe
220	dywqoigayt.sys
3776	CP.exe
2268	snlfdyvqni.exe
3232	CP.exe
760	CP.exe
5904	i_snlfdyvqni.exe
5288	qnigaysqki.sys
5112	CP.exe
3500	fdxvpnifay.exe
3696	CP.exe
2640	CP.exe
5332	i_fdxvpnifay.exe
4740	faysqkicav.sys
4464	CP.exe
3528	nhfzxspkic.exe
5180	CP.exe
2656	CP.exe
4360	i_nhfzxspkic.exe
4284	mkfcxvpnhf.sys
4112	CP.exe
4800	causmkecxu.exe
5416	CP.exe
1708	CP.exe
5840	i_causmkecxu.exe
2328	pjhczurmke.sys
872	CP.exe
3592	ecwupmhfwu.exe
1968	CP.exe
2492	CP.exe
2988	i_ecwupmhfwu.exe
1128	bwuomgezwr.sys
6064	CP.exe
1004	rmjebwuomg.exe
5796	CP.exe
5664	CP.exe
2472	i_rmjebwuomg.exe
2212	wuomgeywro.sys
4848	CP.exe
5552	gbztrljdyw.exe
5888	CP.exe
1368	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfwu.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2068	ipconfig.exe
2792	ipconfig.exe
2716	ipconfig.exe
3000	ipconfig.exe
5848	ipconfig.exe
5596	ipconfig.exe
3632	ipconfig.exe
1684	ipconfig.exe
4804	ipconfig.exe
1592	ipconfig.exe
5504	ipconfig.exe
2016	ipconfig.exe
1080	ipconfig.exe
3572	ipconfig.exe
3664	ipconfig.exe
4660	ipconfig.exe
5316	ipconfig.exe
1640	ipconfig.exe
2948	ipconfig.exe
4668	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268683"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0442e70531fdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0892970531fdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "613545826"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{38E4B049-8B3E-11F1-92B0-EEAAB15450A7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f00000000020000000000106600000001000020000000194568a704c4aaec9dc09dae624176ca48caf28ea302a3458adab26deb250d35000000000e8000000002000020000000786017c364e16f0f4cbb62c79c7d048ca29c5ec4a2a63cb684d818009baeca79200000009a7c5a29567238a5fdb73f9dc20aa5e27cc7b3213e66ce4114f3446e753ef66240000000312e1bc529c5b65b42675e3a13fa249746bfb9fecac41e55b8d08641a7e877975495cd9632ef51b2c66a64f928ea2b6c3078d688a3fb4b3f4fc1fc322231f1cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "555420871"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492088460"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f00000000020000000000106600000001000020000000622eef4398a064091406037a672c017dfe2dd1ee31f117149652cd584485c677000000000e80000000020000200000004b73ccbdd2a1e7b50dc1714a673f9c421b99a145395b7d351f22a95693a298512000000037776ac3cdbcf360c2416a5032cf7962a5504656e1366d42dfddfb1d769ccec74000000010cd3ac4e822a4c6279b79ca6960521ee05743c8c6b2543eb82e432e5e4f468cabd71a19718ece9959bc131e9ca8cf3ee38022eb8d33a4b2c3d87a00f5f157d6	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	i_zurmkecwuo.exe
Token: SeDebugPrivilege	2412	i_zwrojhbztr.exe
Token: SeDebugPrivilege	5328	i_ojdbvtolge.exe
Token: SeDebugPrivilege	2244	i_idbvtolgdy.exe
Token: SeDebugPrivilege	5904	i_snlfdyvqni.exe
Token: SeDebugPrivilege	5332	i_fdxvpnifay.exe
Token: SeDebugPrivilege	4360	i_nhfzxspkic.exe
Token: SeDebugPrivilege	5840	i_causmkecxu.exe
Token: SeDebugPrivilege	2988	i_ecwupmhfwu.exe
Token: SeDebugPrivilege	2472	i_rmjebwuomg.exe
Token: SeDebugPrivilege	1080	i_gbztrljdyw.exe
Token: SeDebugPrivilege	3572	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	3268	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	4356	i_qkidavtnlf.exe
Token: SeDebugPrivilege	4780	i_kicausnkfd.exe
Token: SeDebugPrivilege	5048	i_kfzxspkhca.exe
Token: SeDebugPrivilege	3312	i_czusmhfzxr.exe
Token: SeDebugPrivilege	3108	i_wuomhezwrp.exe
Token: SeDebugPrivilege	1748	i_ojhbztrjgb.exe
Token: SeDebugPrivilege	212	i_omgeywqojg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4756	iexplore.exe
4756	iexplore.exe
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4756	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	85
PID 4756 wrote to memory of 4132	4756	iexplore.exe	86
PID 4752 wrote to memory of 5160	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	89
PID 2848 wrote to memory of 5968	2848	zurmkecwuo.exe	92
PID 4752 wrote to memory of 1900	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	97
PID 4752 wrote to memory of 4072	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	105
PID 4440 wrote to memory of 1192	4440	zwrojhbztr.exe	107
PID 4752 wrote to memory of 5804	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	110
PID 4752 wrote to memory of 1664	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	114
PID 2504 wrote to memory of 3316	2504	ojdbvtolge.exe	116
PID 4752 wrote to memory of 5744	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	119
PID 4752 wrote to memory of 3892	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	123
PID 3020 wrote to memory of 1820	3020	idbvtolgdy.exe	125
PID 4752 wrote to memory of 3808	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	128
PID 4752 wrote to memory of 3776	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	134
PID 2268 wrote to memory of 3232	2268	snlfdyvqni.exe	136
PID 4752 wrote to memory of 760	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	139
PID 4752 wrote to memory of 5112	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	143
PID 3500 wrote to memory of 3696	3500	fdxvpnifay.exe	145
PID 4752 wrote to memory of 2640	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	148
PID 4752 wrote to memory of 4464	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	152
PID 3528 wrote to memory of 5180	3528	nhfzxspkic.exe	154
PID 4752 wrote to memory of 2656	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	157
PID 4752 wrote to memory of 4112	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	161
PID 4800 wrote to memory of 5416	4800	causmkecxu.exe	163
PID 4752 wrote to memory of 1708	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	166
PID 4752 wrote to memory of 872	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	171
PID 3592 wrote to memory of 1968	3592	ecwupmhfwu.exe	173
PID 4752 wrote to memory of 2492	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	176
PID 4752 wrote to memory of 6064	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	180
PID 1004 wrote to memory of 5796	1004	rmjebwuomg.exe	182
PID 4752 wrote to memory of 5664	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	186
PID 4752 wrote to memory of 4848	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	192
PID 5552 wrote to memory of 5888	5552	gbztrljdyw.exe	194
PID 4752 wrote to memory of 1368	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	197
PID 4752 wrote to memory of 5600	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	201
PID 220 wrote to memory of 216	220	dbvtolgeyw.exe	203
PID 4752 wrote to memory of 4144	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	207
PID 4752 wrote to memory of 3636	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	211
PID 5456 wrote to memory of 1172	5456	vtnlfdyvqo.exe	213
PID 4752 wrote to memory of 364	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	216
PID 4752 wrote to memory of 2584	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	220
PID 5516 wrote to memory of 5276	5516	qkidavtnlf.exe	222
PID 4752 wrote to memory of 4448	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	225
PID 4752 wrote to memory of 4352	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	229
PID 4644 wrote to memory of 4452	4644	kicausnkfd.exe	231
PID 4752 wrote to memory of 5252	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	234
PID 4752 wrote to memory of 556	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	238
PID 2100 wrote to memory of 5956	2100	kfzxspkhca.exe	240
PID 4752 wrote to memory of 2852	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	243
PID 4752 wrote to memory of 5268	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	247
PID 5148 wrote to memory of 5564	5148	czusmhfzxr.exe	249
PID 4752 wrote to memory of 2608	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	252
PID 4752 wrote to memory of 6020	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	256
PID 4712 wrote to memory of 2112	4712	wuomhezwrp.exe	258
PID 4752 wrote to memory of 3260	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	261
PID 4752 wrote to memory of 1532	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	265
PID 1720 wrote to memory of 5620	1720	ojhbztrjgb.exe	267
PID 4752 wrote to memory of 2948	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	270
PID 4752 wrote to memory of 5980	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	274
PID 1052 wrote to memory of 4012	1052	omgeywqojg.exe	276
PID 4752 wrote to memory of 204	4752	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	279

C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4756 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5160
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Temp\zwrojhbztr.exe
    C:\Temp\zwrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5804
- - C:\Temp\i_zwrojhbztr.exe
    C:\Temp\i_zwrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1664
- - C:\Temp\ojdbvtolge.exe
    C:\Temp\ojdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\i_ojdbvtolge.exe
    C:\Temp\i_ojdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtolgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3892
- - C:\Temp\idbvtolgdy.exe
    C:\Temp\idbvtolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtolgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\i_idbvtolgdy.exe
    C:\Temp\i_idbvtolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdyvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3776
- - C:\Temp\snlfdyvqni.exe
    C:\Temp\snlfdyvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdyvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:760
- - C:\Temp\i_snlfdyvqni.exe
    C:\Temp\i_snlfdyvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2640
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2656
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1708
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhfwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:872
- - C:\Temp\ecwupmhfwu.exe
    C:\Temp\ecwupmhfwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhfwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2492
- - C:\Temp\i_ecwupmhfwu.exe
    C:\Temp\i_ecwupmhfwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\rmjebwuomg.exe
    C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5664
- - C:\Temp\i_rmjebwuomg.exe
    C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\gbztrljdyw.exe
    C:\Temp\gbztrljdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1368
- - C:\Temp\i_gbztrljdyw.exe
    C:\Temp\i_gbztrljdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  PID:5600
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  PID:4144
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:3636
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:364
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run
  2⤵
  PID:2584
- - C:\Temp\qkidavtnlf.exe
    C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins
  2⤵
  PID:4448
- - C:\Temp\i_qkidavtnlf.exe
    C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  PID:4352
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins
  2⤵
  PID:5252
- - C:\Temp\i_kicausnkfd.exe
    C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfzxspkhca.exe ups_run
  2⤵
  PID:556
- - C:\Temp\kfzxspkhca.exe
    C:\Temp\kfzxspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfzxspkhca.exe ups_ins
  2⤵
  PID:2852
- - C:\Temp\i_kfzxspkhca.exe
    C:\Temp\i_kfzxspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmhfzxr.exe ups_run
  2⤵
  PID:5268
- - C:\Temp\czusmhfzxr.exe
    C:\Temp\czusmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmhfzxr.exe ups_ins
  2⤵
  PID:2608
- - C:\Temp\i_czusmhfzxr.exe
    C:\Temp\i_czusmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezwrp.exe ups_run
  2⤵
  PID:6020
- - C:\Temp\wuomhezwrp.exe
    C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezwrp.exe ups_ins
  2⤵
  PID:3260
- - C:\Temp\i_wuomhezwrp.exe
    C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrjgb.exe ups_run
  2⤵
  PID:1532
- - C:\Temp\ojhbztrjgb.exe
    C:\Temp\ojhbztrjgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrjgb.exe ups_ins
  2⤵
  PID:2948
- - C:\Temp\i_ojhbztrjgb.exe
    C:\Temp\i_ojhbztrjgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:5980
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:204
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:212

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:2544

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:1528

C:\Temp\tolgeywqoj.sys
C:\Temp\tolgeywqoj.sys
1⤵
- Executes dropped EXE
PID:3112

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:220

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:5288

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
- Executes dropped EXE
PID:4740

C:\Temp\mkfcxvpnhf.sys
C:\Temp\mkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\bwuomgezwr.sys
C:\Temp\bwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
- Executes dropped EXE
PID:2212

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
PID:4512

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:3780

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
PID:3132

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:4420

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
PID:3828

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:1600

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:4180

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
PID:3624

C:\Temp\ztrljebwto.sys
C:\Temp\ztrljebwto.sys
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecxu.exe

Path C:\Temp\causmkecxu.exe
Size 243KB
SHA256 0b2e2d8c24054265df9c02334c6bf33ef2149e7be64385d59181c66380fb38a0
MD5 06d2cea4862cff1aa3241fa1f86171dd
SHA1 171b03d19b16791b3b7303965b66d0e570f6fd56
SHA512 d3007cd523047d83eff079e1ec6ec7d7b4f7b7f3b6bf43a9d29b44408f7157b251b3bc691a04cfc2d6f4bba8959f7fa0c4e3cca8f3dfabcae4cadaa4295b63d9
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:GvMsLaOa3lLNngoqRttA7t
TLSH
T1EB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 141KB
SHA256 b14c238de3c969f3cfd9a516402125f3071072d3751f2ee6515b2f65a4ae24f7
MD5 b8e0670fa4374aa1232be7a8c18c12c7
SHA1 fb52ee0f755957542a3bee31ed66ac41194e1f5e
SHA512 390a34ab2cf737a8401daeff0d38c136103ca221b9d90f68535cb821f78588e34d8f05cc1a3264cbb3a25f279de76f2bb3ffdffbbc422f5257c365abc5dfaf56
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.sys

Path C:\Temp\ebwuomgeyw.sys
Size 141KB
SHA256 593769f2b7ff4a4835acac56f31679cb7882ac8cf79eb078747c99a1ce6b5812
MD5 6292ef7c7a6662ca160a257a2008132b
SHA1 7d0cffc0aa9c548cc2de0435a4e313f89bc02ad8
SHA512 be45f8a89e82990cd41f608c6fe3b45136ae42a5899b6f76b75b0d95139c67eb7327f30a652a3af0f04b745d195aaeafacaeb0db47905f99d46365f8814a1f6d
SSDEEP 1536:pNa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXl+:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicav.sys

Path C:\Temp\faysqkicav.sys
Size 141KB
SHA256 f45312648fb5093ec12898ee408555866910c1594e35bb45b098a3d1f160ada5
MD5 e7cd7ff6c5720af08d7b4fce0472744e
SHA1 e22dcb6c0a4d8e6d8de7229b867341931746f4f0
SHA512 0972f0520c7df34d0e98b2e05a747b7be1aa104fc451929cd821b7a36af3d43c510c506958c40b711dba33451b452437d65df3065ee34c70b043cd038522261e
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.exe

Path C:\Temp\fdxvpnifay.exe
Size 243KB
SHA256 76cac64772b8364d8579606354fbfee933591a29a7eac66640fa13e8e99aabeb
MD5 722fde44ed200ccdb11710c31e181898
SHA1 4eb1b74288f21ac7c94dc0c1177fe03fddbda0c2
SHA512 bbd6e171e1f480ff08f632d7ea143d5103d0e566e7ecd1f257be3f6cc3ead9a2a612a1aa0f55da8d9433b692dbca973ef4d9048da4467f5e16cd78995b805c36
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:UvMsLaOa3lLNngoqRttA7H
TLSH
T1FD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkecxu.exe

Path C:\Temp\i_causmkecxu.exe
Size 243KB
SHA256 58a4e2815a1a44c341ff08d984dd109aa4e77de7ec12c130d09a9b9a491ee7f6
MD5 5cda811d3ec79afcd3ea493bf9b5b87f
SHA1 cfe9dd97ae7b462c3f12bc5e5032e4bf8bd97b5a
SHA512 594664a27c2ffffc1ab89c5f871f74a6d1c6f50924b222960864a04d1d6f0d70ea740d23fc3502831f60fe82fe8648068243341deece647db9a67d70eb5853e4
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:OvMsLaOa3lLNngoqRttA7R
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifay.exe

Path C:\Temp\i_fdxvpnifay.exe
Size 243KB
SHA256 3bee8754bcd640e255c0f6f81cb7d33a0ceb1646e874f0b8a5cc92e58aa90a31
MD5 98549bdbd4bb75fd1024e6c4e68e8851
SHA1 61745f90452e598822b4bf1b4485613bcecf8970
SHA512 04bd3e40a9780fd1b27d601bbe36bb53ce80dd450949a6b6624e6f6a4b5e7541b51ec0bbd05271ad3da1f5a250a96c4ba5488b4fe2b9402c52a790c255fcf28b
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:UvMsLaOa3lLNngoqRttA7D
TLSH
T107345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtolgdy.exe

Path C:\Temp\i_idbvtolgdy.exe
Size 243KB
SHA256 bfaa2439b3cfe665697be20f223af88722650231512f2fc8853d7954637f6a32
MD5 692fca812b52bc923b47d2f67cf8d045
SHA1 3afa097e279b8468cc73b499a22e279ea05d4fe8
SHA512 175abfab9990abfac7dc24f9e50feaf1d6cf28c6a422cd4ea3b0431457e69fc7c349e2d8f9a46c375ec66277ef2fe4f030b51ba6c46d3fc1ab1a540c28da6ad7
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:rvMsLaOa3lLNngoqRttA7C
TLSH
T16A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 243KB
SHA256 d6805471c4e5d14778dde534094cf1df3f8b920bdfe63acd4abeb0714921e345
MD5 5eb1d98aae01b293110f9e039499b96a
SHA1 ca8ca03e2a401ccb30a7f1a36de34a8712e7612b
SHA512 4bee0a71235cdb1a9420e9feb63c2ba8a3e99818ee84b12ad9d103d50eef11de39eb82a39f34ec47848f19bc6098bd57785e96ddd9b63dfaa291cccf373d0a9b
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:XvMsLaOa3lLNngoqRttA7u
TLSH
T14B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojdbvtolge.exe

Path C:\Temp\i_ojdbvtolge.exe
Size 243KB
SHA256 9c7a5440cfb6374313ca7d13eb944e1a74206ff31b4679a01294fed3e4cfe259
MD5 9d73bb037a8782ff29c26aab3d19baa9
SHA1 7c0c5d7332f8d3d2de3e9c4e6491b02032942d07
SHA512 282acbdd53d4a9be006bd1aed05322279b379ad80361912432e89337f8633a6ed9ec1d46c2a6779ac56b5da41f27c4d6117630dee8f1a80d2582e568bfce2039
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:xvMsLaOa3lLNngoqRttA7M
TLSH
T196345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdyvqni.exe

Path C:\Temp\i_snlfdyvqni.exe
Size 243KB
SHA256 25fb4a1866997943915954e9473e5f2e7da6f69631b462235cc2c7e32a1ebd4b
MD5 ad4668230bf523a1670a058b7059e7d8
SHA1 0c8d14a588328b010a9a0924a1719ace6d9597a8
SHA512 36d3f9efffa56d4162b7f844170484f28b1eb9bdcf4c366e423a99c734403fdf002716b7f08257d6da5fb52c89135a95b0056bf05cdeb4662ae1770a100a906e
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:vvMsLaOa3lLNngoqRttA7W
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwuo.exe

Path C:\Temp\i_zurmkecwuo.exe
Size 243KB
SHA256 df551727e4910770994adca22cbab81afb423f51129d6ceb7ecb44b6516960de
MD5 eecc7869ed93605019b215b33e521665
SHA1 73e725da709fb79577327914ad67b56160eb4347
SHA512 30a84258a9b7b0a44ea39f9d1b4d10c63dabe98342ef9c26eb81739424e071217c23dc0bff981d2a3a2b4af62ab8c0d60a4acd9bf03de8c9572ba62c451160b6
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:hvMsLaOa3lLNngoqRttA70
TLSH
T176345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrojhbztr.exe

Path C:\Temp\i_zwrojhbztr.exe
Size 243KB
SHA256 492e9f28cbe3bd8db9bc86ef5e9e4601caaee60de01f4994fbe07c52f9b01cf5
MD5 89b2419649b0d110085972944a7137e8
SHA1 aec008bd94a19f0574d2c91d7cc52ec3bea75628
SHA512 fb1bbd92db2fb98dbad94acd09ffe7b3db6a3fc824fb3768a7ac99b1a2ad2c48ef955cce92e15dfd3aa58acfa2ae3bb0a0152fe71f04c4af4c6e4c14dfbf0657
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:MvMsLaOa3lLNngoqRttA7n
TLSH
T1C1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtolgdy.exe

Path C:\Temp\idbvtolgdy.exe
Size 243KB
SHA256 0fa02c9dbc6a58427cecb4320429ad1a03423014a94c693a5253488e12d0036f
MD5 8eb40638af0a4c663dd05d721d38fffa
SHA1 d226033b221c0004114b79b8ee109fa3c13b9323
SHA512 ff8c53a42cfd1f0a9f0b595637829dca1ba0120c147e77aabb36273d066092822c49ef824fee6a126c7618da704d31e957e745954f56c44bb24c659765bdc615
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:TvMsLaOa3lLNngoqRttA7K
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 141KB
SHA256 86bfe176b9c9bcd63ec5e6e5e7474f9db31e85ee97654ea7aaf88f6168c960b2
MD5 2d0b9c9b59e4d09c0204e56f03a33ceb
SHA1 ba22cfa08af05863334e00fcdda7f97d33857ee2
SHA512 fa6a57f379869495bfdeb69c2594cc1e8ee11465f0ce6ab91574a0d44f47f4f25dc1f6d66e53b8ca900fa81d91feeebffdefcb4d107180010077413f67be6ae4
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvpnhf.sys

Path C:\Temp\mkfcxvpnhf.sys
Size 141KB
SHA256 1a99363b3512d9ca28f93488c05cdba00d564cfa1ec239aa681ec3d9ed24a2c3
MD5 d4eccc67cab04829dce39cce26d68a19
SHA1 e6cfe4f6ee98543e7421474a43013050500fb929
SHA512 84c5411be859ab241766f15c974e695df8838d0663f12f8671360f832fb6856727e11b8f2083308442c34ecf99f7c094761931a4374375f4635e5b8cd61299c4
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 531943c2ce311cf52b531e687ccab384ef80d65aee634261eeb07e439139b9dd
MD5 efaf77a0ed309f7ed21c544ae3240676
SHA1 1c633bc0d71584fa73ed59dbe09e9afb30ba95bd
SHA512 a479d512a1927035f8f0c1dfae1498f0e8d864277a2faa4262bfa08843429b4bfd1223688708468284f9c67a4c9f3b4941b27f46b0588e682c96b6a5c45a1fcd
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:pvMsLaOa3lLNngoqRttA78
TLSH
T1EE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojdbvtolge.exe

Path C:\Temp\ojdbvtolge.exe
Size 243KB
SHA256 52721ef17de029b91f172d65dc2aad3006a071318b2505b7b16b33e1cc09e704
MD5 3b9df72eb726e6e3c6eafbf814b90f07
SHA1 7adc31eee0800393d87ec860902fad2fe749b225
SHA512 f48e0458344e21c175849e03b3e98faacf682d40a954c1bf417f4ab1becc67a34c2980cc7fa75d5eaecb4e2bf3ee7003007b68c01b7be0107dd95f6dc57c1512
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:9vMsLaOa3lLNngoqRttA74
TLSH
T119345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.sys

Path C:\Temp\qnigaysqki.sys
Size 141KB
SHA256 2d63167f0b2413450442497a9abc72fb0e96384b8e89c1994e40be474eb532fc
MD5 6e4495b1067ae99dbfc85c4e45bdea90
SHA1 c73368e723bc63b2bf9fae0d8cc56fecd5eae6b8
SHA512 a720954c3a682cda3adb1091924725b1385fffacb008864ab2f8697f1733f1d6a254aeca8202aaea69aedb2f9e657acca18f652a64e5551ad2fdc36543948b4f
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdyvqni.exe

Path C:\Temp\snlfdyvqni.exe
Size 243KB
SHA256 43063cb4251cc15ed03f1398a46ee0e4917c7e235fe4f4c401cc985006f8a01c
MD5 bf9369fce5ddb7ddf95edca4b4594a9a
SHA1 f8c9d608d511678bff390fdac1d18998d9c6a05d
SHA512 43b1bbcdda3fb79bbe887a12ceceee7b1ede99ae079d91f79461c4c1f031e57442de06ab0b0ca693545ce57ee3eafd140cd090996879c49b944051b4d0fb1ed2
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:uvMsLaOa3lLNngoqRttA7l
TLSH
T171345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoj.sys

Path C:\Temp\tolgeywqoj.sys
Size 141KB
SHA256 45feb029acd1901dac3986eaaccb3fdb98f7170252541f9b7667b75388162925
MD5 f7458924601919fe1c00c8f9c0d0b35e
SHA1 8e66305b0ff8b579fbe453245e41cd3ee1410dc4
SHA512 1e301f6cc258363735b8c2819959afc5241e569f535cc167a7e0a1e025fda1a3149726232288ee7c2c2beb7b024b2830420079e8873215a3accad1b165c829ff
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.exe

Path C:\Temp\zurmkecwuo.exe
Size 243KB
SHA256 f029d212c9feea9ce4ce4ccd6725c63b9b99ccf67cc2f2746c39aebf18983c94
MD5 1eb10805918dc72db947b9c65bea4662
SHA1 fdb531b305dbd65b8728e295d14a3a3ea2e4685d
SHA512 99f51c10cee2b784d1b8c6316a98086f6ed448458d3a61a153fca876c08a92d7a06f95bd0375c34285e0e440d6314f75aee030c7a1cade86ad3f03a088a0e50b
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:jvMsLaOa3lLNngoqRttA7C
TLSH
T197345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojhbztr.exe

Path C:\Temp\zwrojhbztr.exe
Size 243KB
SHA256 dcded4748812cf9c660caa201504a192ce4b088160db53e332638a7fd56785be
MD5 5954693a8ee28d2d35d610b53e44a182
SHA1 b6fba3eeb4bb65b29ebbaad54488e74c0db310e9
SHA512 a384873c97e56360c6d40eb642024788a1ea4dbfb84fb9399f843df29fbbece54acdd54aa56b9710e421a981c019f9a6d92a2dbb61fdba04d41bd31442cd2b25
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:vvMsLaOa3lLNngoqRttA7G
TLSH
T1F5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-108-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1528-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2212-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2544-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3132-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3624-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3780-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3828-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4236-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4512-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5288-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads