409f107359d49f6dea8d9428a37b7f9682f89bd2d1604631ac02644bfd55a28e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-nemytseq8v
SHA256 409f107359d49f6dea8d9428a37b7f9682f89bd2d1604631ac02644bfd55a28e
MD5 a9423b0c3163e2f19f94d2fd15358cf6
SHA1 26e1e0a495cf9b841562576b5b05eb12d587ed92
SHA512 080984ae4e542d34bb77b5f0b5cf6c83607c98e766136e856a93728778ac7d81707a596ae4ba9721e0c5c40d0a602fd348d979edad32d3f0c62b36a5a36f7719
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:8vMsLaOa3lLNngoqRttA7X
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3516	CP.exe
3760	mgezwrljey.exe
512	CP.exe
2840	CP.exe
1968	i_mgezwrljey.exe
2320	jebwtomgey.sys
4656	CP.exe
956	ywqojgbztr.exe
4244	CP.exe
2916	CP.exe
456	i_ywqojgbztr.exe
4480	wqojgbztrl.sys
4664	CP.exe
4824	lgdywqoigb.exe
3704	CP.exe
4260	CP.exe
2608	i_lgdywqoigb.exe
4160	gaytqljdbv.sys
2156	CP.exe
2180	vtnlfdyvqo.exe
5000	CP.exe
1260	CP.exe
3996	i_vtnlfdyvqo.exe
4240	aysqlidbvt.sys
1364	CP.exe
1668	ifaysqkicx.exe
2248	CP.exe
3456	CP.exe
3264	i_ifaysqkicx.exe
1188	kicausnkfd.sys
2624	CP.exe
976	cavsnlfdxv.exe
116	CP.exe
2508	CP.exe
1628	i_cavsnlfdxv.exe
4636	ausmkecxup.sys
3020	CP.exe
4696	pnhfzxspki.exe
4016	CP.exe
4144	CP.exe
4932	i_pnhfzxspki.exe
4720	hfzxrpjhcz.sys
3588	CP.exe
2428	zurmkecwup.exe
4528	CP.exe
4820	CP.exe
2196	i_zurmkecwup.exe
1492	cwupmhfzxr.sys
4436	CP.exe
1572	jhbztrmjec.exe
1452	CP.exe
4600	CP.exe
1680	i_jhbztrmjec.exe
3032	omgezwrpjh.sys
4712	CP.exe
3600	hbzrojgbzt.exe
3416	CP.exe
556	CP.exe
4152	i_hbzrojgbzt.exe
5092	geywrojgbz.sys
1512	CP.exe
4736	ztrljdbwto.exe
1232	CP.exe
5064	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgavtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgavtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavp.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1180	ipconfig.exe
4760	ipconfig.exe
724	ipconfig.exe
3652	ipconfig.exe
816	ipconfig.exe
4176	ipconfig.exe
1672	ipconfig.exe
1968	ipconfig.exe
3264	ipconfig.exe
3600	ipconfig.exe
224	ipconfig.exe
772	ipconfig.exe
2576	ipconfig.exe
4236	ipconfig.exe
3192	ipconfig.exe
4028	ipconfig.exe
4048	ipconfig.exe
1436	ipconfig.exe
176	ipconfig.exe
4156	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1820277241"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1965589698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269086"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e5cdcee620dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef82000000000200000000001066000000010000200000002ce4a66e3f317474152424610a92a129099e764eef5662b593026a8f7871d39f000000000e8000000002000020000000948870a7c81926466e8ce925375c2481b57bd16a0c2597d3802ac78fec2968ce2000000012d10bb42352f6108e9618dfdc36561610fd1b7d8fd12329a66397909f3bdaaf4000000053d186c5f0b7e6c8af3aa41e88a612c15f2e827875aea2390f865ec6183459abc5f16ec8e035038175cc93082703fbbbad8afb94b0c45318b7784a1a74c2fbad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a0d2cee620dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{978B65CD-8CD1-11F1-B40A-D2B4DCFC1B56} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef8200000000020000000000106600000001000020000000d29db071e39a7c4e58df903518151dc0313b6b32acadcd27a68eeffa047277c4000000000e8000000002000020000000df48af7b2c84aca2a5f304fed8dab392323dcb881ccbcbc58e2cd843c07cc89120000000014506176ccc210050c7ec8d6fd7331fa416e59698bdf4ccf40cf4d5a0d5fba740000000e11929667ad1fc6b3d5b8477675ecbfe3b9666729d8bac1b126b13df03e87d36472bd56c5235c421fff2da023f1435ce6ee75c486bf2e5c1d368779ec4c49255	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492261699"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269086"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	i_mgezwrljey.exe
Token: SeDebugPrivilege	456	i_ywqojgbztr.exe
Token: SeDebugPrivilege	2608	i_lgdywqoigb.exe
Token: SeDebugPrivilege	3996	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	3264	i_ifaysqkicx.exe
Token: SeDebugPrivilege	1628	i_cavsnlfdxv.exe
Token: SeDebugPrivilege	4932	i_pnhfzxspki.exe
Token: SeDebugPrivilege	2196	i_zurmkecwup.exe
Token: SeDebugPrivilege	1680	i_jhbztrmjec.exe
Token: SeDebugPrivilege	4152	i_hbzrojgbzt.exe
Token: SeDebugPrivilege	1012	i_ztrljdbwto.exe
Token: SeDebugPrivilege	2200	i_oigbytniga.exe
Token: SeDebugPrivilege	4392	i_aysqkicavs.exe
Token: SeDebugPrivilege	380	i_aysqkidavp.exe
Token: SeDebugPrivilege	4976	i_pkicausmkf.exe
Token: SeDebugPrivilege	4972	i_hczusmkecw.exe
Token: SeDebugPrivilege	2260	i_zurmkecwup.exe
Token: SeDebugPrivilege	2660	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	3044	i_rljebwuomg.exe
Token: SeDebugPrivilege	2056	i_lgavtolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4056	iexplore.exe
4056	iexplore.exe
4052	IEXPLORE.EXE
4052	IEXPLORE.EXE
4052	IEXPLORE.EXE
4052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4056	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	85
PID 4056 wrote to memory of 4052	4056	iexplore.exe	86
PID 2324 wrote to memory of 3516	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	87
PID 3760 wrote to memory of 512	3760	mgezwrljey.exe	90
PID 2324 wrote to memory of 2840	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	93
PID 2324 wrote to memory of 4656	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	97
PID 956 wrote to memory of 4244	956	ywqojgbztr.exe	99
PID 2324 wrote to memory of 2916	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	102
PID 2324 wrote to memory of 4664	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	111
PID 4824 wrote to memory of 3704	4824	lgdywqoigb.exe	113
PID 2324 wrote to memory of 4260	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	116
PID 2324 wrote to memory of 2156	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	122
PID 2180 wrote to memory of 5000	2180	vtnlfdyvqo.exe	124
PID 2324 wrote to memory of 1260	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	127
PID 2324 wrote to memory of 1364	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	132
PID 1668 wrote to memory of 2248	1668	ifaysqkicx.exe	134
PID 2324 wrote to memory of 3456	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	137
PID 2324 wrote to memory of 2624	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	141
PID 976 wrote to memory of 116	976	cavsnlfdxv.exe	143
PID 2324 wrote to memory of 2508	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	146
PID 2324 wrote to memory of 3020	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	150
PID 4696 wrote to memory of 4016	4696	pnhfzxspki.exe	152
PID 2324 wrote to memory of 4144	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	155
PID 2324 wrote to memory of 3588	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	159
PID 2428 wrote to memory of 4528	2428	zurmkecwup.exe	161
PID 2324 wrote to memory of 4820	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	164
PID 2324 wrote to memory of 4436	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	168
PID 1572 wrote to memory of 1452	1572	jhbztrmjec.exe	170
PID 2324 wrote to memory of 4600	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	173
PID 2324 wrote to memory of 4712	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	177
PID 3600 wrote to memory of 3416	3600	hbzrojgbzt.exe	179
PID 2324 wrote to memory of 556	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	182
PID 2324 wrote to memory of 1512	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	186
PID 4736 wrote to memory of 1232	4736	ztrljdbwto.exe	188
PID 2324 wrote to memory of 5064	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	191
PID 2324 wrote to memory of 1428	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	195
PID 5008 wrote to memory of 4720	5008	oigbytniga.exe	197
PID 2324 wrote to memory of 4248	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	200
PID 2324 wrote to memory of 3724	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	204
PID 4132 wrote to memory of 4228	4132	aysqkicavs.exe	206
PID 2324 wrote to memory of 3056	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	209
PID 2324 wrote to memory of 2188	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	214
PID 1944 wrote to memory of 1684	1944	aysqkidavp.exe	216
PID 2324 wrote to memory of 4276	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	219
PID 2324 wrote to memory of 880	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	224
PID 2984 wrote to memory of 1116	2984	pkicausmkf.exe	226
PID 2324 wrote to memory of 4380	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	229
PID 2324 wrote to memory of 1636	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	233
PID 4892 wrote to memory of 3640	4892	hczusmkecw.exe	235
PID 2324 wrote to memory of 1300	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	238
PID 2324 wrote to memory of 1272	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	242
PID 1240 wrote to memory of 2120	1240	zurmkecwup.exe	244
PID 2324 wrote to memory of 3924	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	247
PID 2324 wrote to memory of 4268	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	251
PID 2152 wrote to memory of 776	2152	zwrpjhbztr.exe	253
PID 2324 wrote to memory of 3796	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	256
PID 2324 wrote to memory of 3268	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	260
PID 1716 wrote to memory of 4744	1716	rljebwuomg.exe	262
PID 2324 wrote to memory of 1468	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	265
PID 2324 wrote to memory of 5032	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	269
PID 876 wrote to memory of 4564	876	lgavtolgey.exe	271
PID 2324 wrote to memory of 5028	2324	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4056 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrljey.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3516
- - C:\Temp\mgezwrljey.exe
    C:\Temp\mgezwrljey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrljey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\i_mgezwrljey.exe
    C:\Temp\i_mgezwrljey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4656
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\lgdywqoigb.exe
    C:\Temp\lgdywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\i_lgdywqoigb.exe
    C:\Temp\i_lgdywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkicx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\ifaysqkicx.exe
    C:\Temp\ifaysqkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkicx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3456
- - C:\Temp\i_ifaysqkicx.exe
    C:\Temp\i_ifaysqkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Temp\cavsnlfdxv.exe
    C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\i_cavsnlfdxv.exe
    C:\Temp\i_cavsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3020
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3588
- - C:\Temp\zurmkecwup.exe
    C:\Temp\zurmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\i_zurmkecwup.exe
    C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\jhbztrmjec.exe
    C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\i_jhbztrmjec.exe
    C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzrojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\hbzrojgbzt.exe
    C:\Temp\hbzrojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzrojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:556
- - C:\Temp\i_hbzrojgbzt.exe
    C:\Temp\i_hbzrojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytniga.exe ups_run
  2⤵
  PID:1428
- - C:\Temp\oigbytniga.exe
    C:\Temp\oigbytniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytniga.exe ups_ins
  2⤵
  PID:4248
- - C:\Temp\i_oigbytniga.exe
    C:\Temp\i_oigbytniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  PID:3724
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  PID:3056
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavp.exe ups_run
  2⤵
  PID:2188
- - C:\Temp\aysqkidavp.exe
    C:\Temp\aysqkidavp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavp.exe ups_ins
  2⤵
  PID:4276
- - C:\Temp\i_aysqkidavp.exe
    C:\Temp\i_aysqkidavp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  PID:880
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  PID:4380
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run
  2⤵
  PID:1636
- - C:\Temp\hczusmkecw.exe
    C:\Temp\hczusmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins
  2⤵
  PID:1300
- - C:\Temp\i_hczusmkecw.exe
    C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run
  2⤵
  PID:1272
- - C:\Temp\zurmkecwup.exe
    C:\Temp\zurmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins
  2⤵
  PID:3924
- - C:\Temp\i_zurmkecwup.exe
    C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  PID:4268
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  PID:3796
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  PID:3268
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  PID:1468
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgavtolgey.exe ups_run
  2⤵
  PID:5032
- - C:\Temp\lgavtolgey.exe
    C:\Temp\lgavtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgavtolgey.exe ups_ins
  2⤵
  PID:5028
- - C:\Temp\i_lgavtolgey.exe
    C:\Temp\i_lgavtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056

C:\Temp\jebwtomgey.sys
C:\Temp\jebwtomgey.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:4636

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
- Executes dropped EXE
PID:3032

C:\Temp\geywrojgbz.sys
C:\Temp\geywrojgbz.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:2236

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:2444

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
PID:2308

C:\Temp\axsqkfdxvp.sys
C:\Temp\axsqkfdxvp.sys
1⤵
PID:4716

C:\Temp\snhfzxrpkh.sys
C:\Temp\snhfzxrpkh.sys
1⤵
PID:2340

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
PID:4912

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:4760

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
PID:4284

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxup.sys

Path C:\Temp\ausmkecxup.sys
Size 141KB
SHA256 b70a96d07bae9fc40d1475f55bc02165730a0c308f46cc379dd018a1151cf78e
MD5 20ead6867f9d5d63999bc0969e01b148
SHA1 1f83c8dc2758956310f53c320e40a274c7649d2d
SHA512 19f481044044f30a92ad8f4abf2ddf466ed7d1333d45f0492bf98cf3eaeb28a47db17280755595d63d39cea4465a425bebdd957d78f7db6d513f0a0d5b5c76d5
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvt.sys

Path C:\Temp\aysqlidbvt.sys
Size 141KB
SHA256 9c0ee8a4f8ecca95e93d47c532802042d97438d57a0026be148d3e2bc909a337
MD5 40a1dd1c78c1ab6d9d6a53293631ab3f
SHA1 dfb6ae99438e9ff32205b42266301896a5a13aa7
SHA512 cee5065d576af61ddb253bf0bb8c27f3a0833ddf879e1f828c6456495db6d061cbfdb80aba98f47127853ca6c60210e6f17ec7ce2ebb29c34d4261f2ae9aeeb6
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.exe

Path C:\Temp\cavsnlfdxv.exe
Size 243KB
SHA256 9cd76c9e8f8445cf8a3da707fca9568576419c6b251dab7fab327236ed0d226f
MD5 6d7bf5443d9a541764611f0db751b87d
SHA1 f480027b0d3e932e68092ac7adaf649cfc0bb2aa
SHA512 348e6fb0da853bf77989666b091485d9df97c9ae6c0ad7b0d6bee9f15a654a5e00ad4ce3bd1faf1da06d67a75093b9fd9baccffc106ee9bd5c7393f5a3b252df
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:evMsLaOa3lLNngoqRttA7Z
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.sys

Path C:\Temp\gaytqljdbv.sys
Size 141KB
SHA256 568b809a35977f62bbde753183310f9a47c201fb6ec3542bb623bc3fccc245c8
MD5 6ce19f1cd7edfd124174f2bc7261215d
SHA1 0f68852f7a844209ec17ce9d9f1166f9c0fea3d1
SHA512 756cac10e7c77e66fb7768fde547ba95154c8bec273b0e6d537790e18ecdaf5882001f836876e3ee21a2e9349d5402a57512b3041d9f8183fb704c4b55482bc2
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T180E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhcz.sys

Path C:\Temp\hfzxrpjhcz.sys
Size 141KB
SHA256 e8a7f3a744230a4cf175b26f18305bb9b0eadc764fad16e762366c7421fa7b06
MD5 f97530602774ee26944ceea9268ceec6
SHA1 c794ae135308c36f20fface8c7ddfda5ec3873cc
SHA512 9f7a222384c1cb8a4cbe5959502b6a16be1c1cc21e4ae2a71ecc48e8473600714a40c3fd3c2e84c2952accabce23a8dd1dade3c3af7973b850980291e09a1c92
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavsnlfdxv.exe

Path C:\Temp\i_cavsnlfdxv.exe
Size 243KB
SHA256 50f9bac9b4d84f22f1fb863f407ba90c255d22da9bd340abd4328ea7e5b7482c
MD5 df926ce316d6ead5538d8d177fd5a333
SHA1 74333ac6db79bd59a7ce40d49bc69d573410a269
SHA512 09df363a50fa59b93eb4f379ccbc11d262349edf7ee24dae1410168da98916cc448dadb50fdcbafe4275e6c3a6e1edb7bd27e03b81c7d60945ea46ed71a21ea4
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:pvMsLaOa3lLNngoqRttA7g
TLSH
T183345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkicx.exe

Path C:\Temp\i_ifaysqkicx.exe
Size 243KB
SHA256 cc65128863e18ae3cd18ccdb459ebf0b861613aed6e21f1cc8a7d2c945b6ed4a
MD5 0a135fa09f0b075777863fbd7d9375eb
SHA1 ace13cfd243ae547d72e7f961e36c34f34ae22b7
SHA512 5489dac5a775e1a623adcb492a55f1fdfa1cd83c1df532cb792d6f4e7ec7b8da72f71ad8a0cb5299c698d6b038116ffad240817c850489f52c66e2730523a7d0
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:fvMsLaOa3lLNngoqRttA7+
TLSH
T19E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqoigb.exe

Path C:\Temp\i_lgdywqoigb.exe
Size 243KB
SHA256 796ec3bc15145e5a6cd50f91fcaff73c6b349595a68752c673bfc3ccaed919fd
MD5 5b562412e125e3c082e66e842d2a4af7
SHA1 ee4ae28eb16a25c456d552283e2feb4859f3c957
SHA512 ca6e869828f7bad55c6bbc8af0a933c0b300c7bdbf54bd32eb92f531e06edd6f1f7b406d204c4b9018eccf9b7495b974477bb7f3811672abd52b43fb11ed7658
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:RvMsLaOa3lLNngoqRttA7k
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgezwrljey.exe

Path C:\Temp\i_mgezwrljey.exe
Size 243KB
SHA256 59ae9f00e85ef5784a2ab969dcdea0b7f98ae5062de953e52719e180e8fbf3a5
MD5 12bc0de916ab50a6d70505d320afde4c
SHA1 49fa30ea8727e90445a895675821a94d0748c555
SHA512 53cbe0ea9d8c18b8815475eab8484e9e97ecd206b4f9803646eb390a8b821655ca6e4a5d887d93e7eca5699abac3c74ce405e792a23386c1813da19142f35291
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:ZvMsLaOa3lLNngoqRttA74
TLSH
T1F3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspki.exe

Path C:\Temp\i_pnhfzxspki.exe
Size 243KB
SHA256 238dbe4ce028ec248efa3f5ee0a80e02bf359a1a961e4f29e43a54cbf1fbf1bd
MD5 0062b9a3771553201b75f9e7a42b57f7
SHA1 85e3504d3a704752286a475f1289db3618cca849
SHA512 56fb7d73643abbd5c23f41e4d44ba754ccadbe3169eab85773d2c4e0f1fb604ca77588edeaa82a0fdd6a19642572ec087720aa1c7c62d56afc53ea36c2203e29
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:qvMsLaOa3lLNngoqRttA7Z
TLSH
T175345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqo.exe

Path C:\Temp\i_vtnlfdyvqo.exe
Size 243KB
SHA256 16d2aebd5775e505e527d74db0c776ce8a437ffe87c2df6cd5419fff70a306e8
MD5 7b6f3a2ba36756363bca1497358b2543
SHA1 44cf2d3e1391dfb972de8b389a151beca691a9a7
SHA512 ce6e7dfabcb718cfa6230511ef9c8a039032b017d649bfa1120f1eb9477efc002e03af222fcd177ef133eccbbc1a7fafa0afe5f46c2b40311a9bcb94eb29e4a2
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:HvMsLaOa3lLNngoqRttA76
TLSH
T118345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqojgbztr.exe

Path C:\Temp\i_ywqojgbztr.exe
Size 243KB
SHA256 6231205354c1467a0678d9033c205a4021c504e34de9c66c897208b57a859125
MD5 37af6d008830b283037b1553850689d3
SHA1 e16af9fad47e0a63b4f481472e7be9f3a6851930
SHA512 1375b657bbd1cfb3f21cf00764e35251fae871e2b2ee372f0f94f8844cc6f1fb106cdaba0a4e80715ea58f84a6a07b78a4cd14f90b3207ed5e417a8f19fc1d53
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:WvMsLaOa3lLNngoqRttA7F
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwup.exe

Path C:\Temp\i_zurmkecwup.exe
Size 243KB
SHA256 fc921e61b178b8eb135f0d762a682d9e42e3aadc24bd427bdbcac3f6b6a932a8
MD5 28fbaacae999fe6a1a1ecbe274ca538e
SHA1 bf83799b45e0779fe4c636c5e3c6d2875aa05b53
SHA512 e57edb63f11f7b25d1acc7d64eed81cd48f109e1e67e5b4969ff5c18496c7790b0ffc6cecdce4e62574fd6250674ffd19318f5a761eb95adaa85d34878871b3f
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:LvMsLaOa3lLNngoqRttA7u
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkicx.exe

Path C:\Temp\ifaysqkicx.exe
Size 243KB
SHA256 f488c3f9eded5b8f479ba91a7d6e941f2decdc9a4492b6ea2abc1244c6cc3598
MD5 4216f452ab1cb01d4fc883e6fb54c8bd
SHA1 b2c42482d839ef262b07538655868a996ac7d4ca
SHA512 3861bc0b891ceeea368b63762d487908aacd9d03cd8b31090929f6d75a6e72435fbe0e0afc1a25153a9e703bc8a3f3736b9f94361222706538c585f3202ed61f
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:vvMsLaOa3lLNngoqRttA7q
TLSH
T1EB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwtomgey.sys

Path C:\Temp\jebwtomgey.sys
Size 141KB
SHA256 b3d2c1d336cfc0065c0778e6d14e43fe32044638e46ab497afcd33c618c16a25
MD5 965224adc37172ddbfb5fb3915a67f7f
SHA1 1de98bee201a7e94e716740b1e1553221ddbfc30
SHA512 20f5577458307df0a0e415f5582da3070445394b8eb06fe964ed3d1bc5302ce903531bb819d80480e7c214b794660a6dadc8a739d39c2330e596af4feddc753a
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfd.sys

Path C:\Temp\kicausnkfd.sys
Size 141KB
SHA256 0513a9d5b742f42b4d83f7416459b9f2df9f3b185364f8fcd26e2ad9e3bc3b25
MD5 61734a6391a4b0beb313acc0faa16c9c
SHA1 4f1f2b767a9375e4ec3b3286e1771fc2be4dcb00
SHA512 4572d82e40306d990d705159d6d835e9f964f6846118112a70f59c1ab6667186801b52fb5e672ea8fd403bcc96a3d8c693a9bc3c6599c824df94a27b8e5a273b
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoigb.exe

Path C:\Temp\lgdywqoigb.exe
Size 243KB
SHA256 fa11a14dafeac753c7c160871b5024bfdce2750df3569968b08894492cf6a6ee
MD5 47fc4d30a4e94f5fb84694094793cfdb
SHA1 b76c67036130cf81886287061fbf19b9a8456330
SHA512 ede16f10c369ad58b40c04344e06be243e55b3c2d7e97d1b0be48305c9f9975843c305ff02355a61044103d8d88b7949ee0c7cb88447fa484f40966ed27cb08d
SSDEEP 3072:JCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:0vMsLaOa3lLNngoqRttA7z
TLSH
T103345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrljey.exe

Path C:\Temp\mgezwrljey.exe
Size 243KB
SHA256 74c377ff5adc86869fde6155017a8d598420d2344213eb336aca3682c88a4f92
MD5 0d62fd2cfe24ae53b8c60983ff99d2c0
SHA1 7e6845a4a5172a13de6143ec4e5f1f8a595a6629
SHA512 f5f38b12f3fa727e247c000adfb246669c2324cb15a1a9ede6170a5110d48e55b38e34f1e6ea80a7a1ee64c7fb358fa1fd9102c3d547192fc0edf30b263ffd96
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:KvMsLaOa3lLNngoqRttA7Z
TLSH
T14F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.exe

Path C:\Temp\pnhfzxspki.exe
Size 243KB
SHA256 d8c990fbe4f344f564929440f24a1dfeb8c5a67e105a8765b8a3b0af1ad5fc89
MD5 d01baec821184a90d89c1b556fa731da
SHA1 f00d8bbd4c2427bd8d52388458b82491bfb37420
SHA512 ca67c84ed7c971e86ce11ebe6afee4b7d359449c735e91e5c7cc502b7284a16199737c80eba41ed89bd4f8a83e3781c8ff515f8711dd895890265965b73ed9f2
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:7vMsLaOa3lLNngoqRttA7e
TLSH
T176345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.exe

Path C:\Temp\vtnlfdyvqo.exe
Size 243KB
SHA256 172989ab62b5dab172dfaadd4b3f269e5b7692c9ff60e20dc46e3583c3d3879c
MD5 d1c0d96084c712df99306d3e32557934
SHA1 990a2a91fc27a5ad01a6887eb704fdc2c310bc61
SHA512 20fe61540c7f652729fad644c98aa0cd17361358922fb34d5fd89e09283d8d9357bc9bcd9bb8ecaabeab264be27b2e26c4e5e03366d913f44450239967a6cfcd
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:lvMsLaOa3lLNngoqRttA7Y
TLSH
T1E4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrl.sys

Path C:\Temp\wqojgbztrl.sys
Size 141KB
SHA256 36a165891a60f76ae86fefd2cdbcb3cc9d6fecd496ea08f9fd94a456ef2cbbd0
MD5 73b81ae96140e8ccf02baf554ba72b7d
SHA1 51bde66d4adf083a25b5f538ca0e64eb971130a1
SHA512 f26bfc2c646d37751f592f20c162d202cf8d83150a3be97f277f181d16ce83eb3387ccf1d4f2bec59eeb3daa2e34c1289f25d82885ca4c64f6238fcbe57b4d6d
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.exe

Path C:\Temp\ywqojgbztr.exe
Size 243KB
SHA256 aaf7dc041b053594b4e2f845b39ce052e85a7f2a1037aad62b642c2775cbb83e
MD5 b089e7b6aa7c6f6127154d92d65ccfed
SHA1 b2f7ac8915a12e145e3153cce14a153d8bae3e61
SHA512 8d4ad443f702662770893cdb8b1b717be0b23e73ac2c617fce953439c2cbace4544e3a856f15175cf652c081bb451233cc7a864f194e5753cdc71d3ce125f5a5
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:nvMsLaOa3lLNngoqRttA7i
TLSH
T1A3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwup.exe

Path C:\Temp\zurmkecwup.exe
Size 243KB
SHA256 5375dd2b4d3d322bec66eb3dba1117e272fe5642d72fe0195f32893ef3b7cdcd
MD5 5b0d10a501ad5c367e7e6267bdf24d0d
SHA1 25e2d9c6523933f277fc6bf4a4ace8fc2148b3b1
SHA512 045a293fd6f66a20c16d3bc52e73168b8514d0748cbb9eaafdf4f566905ea31e7ff9d0af9e02da45064f213585dc83cb2ffe53acced85eb3035249a46508990a
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:kvMsLaOa3lLNngoqRttA7/
TLSH
T1FF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2236-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2308-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2340-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-82-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4716-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4716-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4912-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5092-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads