adb0b225db25ad3473c52d97e396f249a01f55d08730c7cec775d1906019c31c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-vebdcsdf25
SHA256 adb0b225db25ad3473c52d97e396f249a01f55d08730c7cec775d1906019c31c
MD5 be311864b2d5233f144a39be6bab0039
SHA1 ddb49ad6684807999427e2b3ed731c36cf420cb1
SHA512 73543d323725d2762e1cabf0b2da1c897b187c35f549b264ec93809284a7ad0721fab06a2f756c77ee1325473993b572caa37d26b997847ee68e870ae93fbfe0
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:JvMsLaOa3lLNngoqRttA7Q
TLSH
T1C3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2640	CP.exe
888	fzxspkhcau.exe
3804	CP.exe
2312	CP.exe
4784	i_fzxspkhcau.exe
4468	xrmkecwuom.sys
1784	CP.exe
3752	jhbzurmkec.exe
5116	CP.exe
4696	CP.exe
3360	i_jhbzurmkec.exe
1616	omhezxrpjh.sys
4516	CP.exe
892	ztrljebwuo.exe
2324	CP.exe
868	CP.exe
4636	i_ztrljebwuo.exe
1400	bwtomgeywq.sys
1244	CP.exe
2944	uomgeywrob.exe
5024	CP.exe
4960	CP.exe
408	i_uomgeywrob.exe
4580	olgdywqoig.sys
3784	CP.exe
4708	geywqoigby.exe
4476	CP.exe
432	CP.exe
1988	i_geywqoigby.exe
4768	dywqoigayt.sys
2344	CP.exe
4688	sqlfdyvqoi.exe
3748	CP.exe
1744	CP.exe
4644	i_sqlfdyvqoi.exe
1832	avtnlfdxvi.sys
3376	CP.exe
3800	ifaxsqkica.exe
216	CP.exe
2100	CP.exe
4880	i_ifaxsqkica.exe
2932	nifaysqkic.sys
4332	CP.exe
1232	cxvpnausmk.exe
4024	CP.exe
2292	CP.exe
2056	i_cxvpnausmk.exe
1260	ausmkfcxvp.sys
556	CP.exe
3900	pkhcausmke.exe
752	CP.exe
3452	CP.exe
3936	i_pkhcausmke.exe
1852	pkhcausmke.sys
2208	CP.exe
1252	ezxrpjhczu.exe
4596	CP.exe
3808	CP.exe
972	i_ezxrpjhczu.exe
4504	mkecwupezw.sys
3472	CP.exe
1432	wrpjhbztrm.exe
4728	CP.exe
2864	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljetolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxumhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywrob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwugbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywrob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljetolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxumhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwugbz.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4784	ipconfig.exe
1124	ipconfig.exe
4452	ipconfig.exe
4204	ipconfig.exe
1096	ipconfig.exe
116	ipconfig.exe
5112	ipconfig.exe
436	ipconfig.exe
4308	ipconfig.exe
2252	ipconfig.exe
3084	ipconfig.exe
4784	ipconfig.exe
2444	ipconfig.exe
4808	ipconfig.exe
2056	ipconfig.exe
1688	ipconfig.exe
3876	ipconfig.exe
4752	ipconfig.exe
4672	ipconfig.exe
2468	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa5016000000000200000000001066000000010000200000000a4eda936eee8873dc68d0570100748784df8c33db0117b428c893a3d8f7d4fb000000000e80000000020000200000007fb366b7ac23c1dafbb8bd93db6e337908948981bf15d7c43bdb778e9fd2253f20000000a39599d8b1d773395a243c4feb6f94484e7e00cd517d18484f7fbe6f41054f77400000009256fd92ee4ea0ae31a8a68c2df9436225e738dc14fc523903f90d1ea0fb0ff1dd2a295eb66b41365b5d02edd3b188422d2a84632fd9a694a153d169b761afaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{638419D9-8D00-11F1-B03F-761C4632812C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa5016000000000200000000001066000000010000200000003f691ed05d18462deb6ef552632bb2fa839ce9ddc12e44c4c7563043e192c427000000000e8000000002000020000000c8363d289bc3a8546fd457890eebeac3c8167e0a6e5594bd5abaa048168b376320000000001f93dfe58c4f5acfb46ca20a2b475eacd3fcc47c29b4dc4662b5242ec0354b40000000ef7b71ac0e14df257ad0fdbe4495e4dee5fdead0488e1ecaa5dc42e97dfb8b8d0e6c5bc46d5a21da19ddea73779275cee1dbb377bed000d99952bfd8c6a90240	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "949891059"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269133"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804be39a1521dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7077ea9a1521dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492281821"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	i_fzxspkhcau.exe
Token: SeDebugPrivilege	3360	i_jhbzurmkec.exe
Token: SeDebugPrivilege	4636	i_ztrljebwuo.exe
Token: SeDebugPrivilege	408	i_uomgeywrob.exe
Token: SeDebugPrivilege	1988	i_geywqoigby.exe
Token: SeDebugPrivilege	4644	i_sqlfdyvqoi.exe
Token: SeDebugPrivilege	4880	i_ifaxsqkica.exe
Token: SeDebugPrivilege	2056	i_cxvpnausmk.exe
Token: SeDebugPrivilege	3936	i_pkhcausmke.exe
Token: SeDebugPrivilege	972	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	220	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	1888	i_rljetolgey.exe
Token: SeDebugPrivilege	4980	i_idbwtomgey.exe
Token: SeDebugPrivilege	4472	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	2088	i_sqkidavqni.exe
Token: SeDebugPrivilege	4444	i_snkfdxnhfa.exe
Token: SeDebugPrivilege	3944	i_kicausmkfc.exe
Token: SeDebugPrivilege	3024	i_cxumhfzxrp.exe
Token: SeDebugPrivilege	1060	i_rmjecwuomh.exe
Token: SeDebugPrivilege	4108	i_rmjecwugbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5036	iexplore.exe
5036	iexplore.exe
3124	IEXPLORE.EXE
3124	IEXPLORE.EXE
3124	IEXPLORE.EXE
3124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5036	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	85
PID 5036 wrote to memory of 3124	5036	iexplore.exe	86
PID 4956 wrote to memory of 2640	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	87
PID 888 wrote to memory of 3804	888	fzxspkhcau.exe	90
PID 4956 wrote to memory of 2312	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	93
PID 4956 wrote to memory of 1784	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	97
PID 3752 wrote to memory of 5116	3752	jhbzurmkec.exe	99
PID 4956 wrote to memory of 4696	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	102
PID 4956 wrote to memory of 4516	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	106
PID 892 wrote to memory of 2324	892	ztrljebwuo.exe	108
PID 4956 wrote to memory of 868	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	111
PID 4956 wrote to memory of 1244	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	115
PID 2944 wrote to memory of 5024	2944	uomgeywrob.exe	117
PID 4956 wrote to memory of 4960	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	120
PID 4956 wrote to memory of 3784	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	126
PID 4708 wrote to memory of 4476	4708	geywqoigby.exe	128
PID 4956 wrote to memory of 432	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	131
PID 4956 wrote to memory of 2344	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	135
PID 4688 wrote to memory of 3748	4688	sqlfdyvqoi.exe	137
PID 4956 wrote to memory of 1744	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	140
PID 4956 wrote to memory of 3376	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	146
PID 3800 wrote to memory of 216	3800	ifaxsqkica.exe	148
PID 4956 wrote to memory of 2100	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	152
PID 4956 wrote to memory of 4332	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	159
PID 1232 wrote to memory of 4024	1232	cxvpnausmk.exe	161
PID 4956 wrote to memory of 2292	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	164
PID 4956 wrote to memory of 556	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	168
PID 3900 wrote to memory of 752	3900	pkhcausmke.exe	170
PID 4956 wrote to memory of 3452	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	173
PID 4956 wrote to memory of 2208	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	177
PID 1252 wrote to memory of 4596	1252	ezxrpjhczu.exe	179
PID 4956 wrote to memory of 3808	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	182
PID 4956 wrote to memory of 3472	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	186
PID 1432 wrote to memory of 4728	1432	wrpjhbztrm.exe	188
PID 4956 wrote to memory of 2864	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	191
PID 4956 wrote to memory of 956	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	195
PID 640 wrote to memory of 468	640	rljetolgey.exe	197
PID 4956 wrote to memory of 2184	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	200
PID 4956 wrote to memory of 2984	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	204
PID 3388 wrote to memory of 4384	3388	idbwtomgey.exe	206
PID 4956 wrote to memory of 4032	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	209
PID 4956 wrote to memory of 2408	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	214
PID 2704 wrote to memory of 4768	2704	bvtnlfdyvq.exe	216
PID 4956 wrote to memory of 3812	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	219
PID 4956 wrote to memory of 1416	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	223
PID 2464 wrote to memory of 4468	2464	sqkidavqni.exe	225
PID 4956 wrote to memory of 3520	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	228
PID 4956 wrote to memory of 2028	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	232
PID 4460 wrote to memory of 4636	4460	snkfdxnhfa.exe	234
PID 4956 wrote to memory of 2928	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	237
PID 4956 wrote to memory of 628	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	241
PID 4156 wrote to memory of 1540	4156	kicausmkfc.exe	243
PID 4956 wrote to memory of 2192	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	246
PID 4956 wrote to memory of 4240	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	250
PID 1220 wrote to memory of 812	1220	cxumhfzxrp.exe	252
PID 4956 wrote to memory of 3768	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	255
PID 4956 wrote to memory of 1440	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	259
PID 4892 wrote to memory of 3328	4892	rmjecwuomh.exe	261
PID 4956 wrote to memory of 3504	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	264
PID 4956 wrote to memory of 3664	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	268
PID 212 wrote to memory of 2088	212	rmjecwugbz.exe	270
PID 4956 wrote to memory of 3968	4956	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2640
- - C:\Temp\fzxspkhcau.exe
    C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\i_fzxspkhcau.exe
    C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1784
- - C:\Temp\jhbzurmkec.exe
    C:\Temp\jhbzurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Temp\i_jhbzurmkec.exe
    C:\Temp\i_jhbzurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\ztrljebwuo.exe
    C:\Temp\ztrljebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\i_ztrljebwuo.exe
    C:\Temp\i_ztrljebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywrob.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1244
- - C:\Temp\uomgeywrob.exe
    C:\Temp\uomgeywrob.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywrob.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_uomgeywrob.exe
    C:\Temp\i_uomgeywrob.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Temp\geywqoigby.exe
    C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:432
- - C:\Temp\i_geywqoigby.exe
    C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlfdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\sqlfdyvqoi.exe
    C:\Temp\sqlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlfdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Temp\i_sqlfdyvqoi.exe
    C:\Temp\i_sqlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\cxvpnausmk.exe
    C:\Temp\cxvpnausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Temp\i_cxvpnausmk.exe
    C:\Temp\i_cxvpnausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:556
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2208
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2864
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljetolgey.exe ups_run
  2⤵
  PID:956
- - C:\Temp\rljetolgey.exe
    C:\Temp\rljetolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljetolgey.exe ups_ins
  2⤵
  PID:2184
- - C:\Temp\i_rljetolgey.exe
    C:\Temp\i_rljetolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbwtomgey.exe ups_run
  2⤵
  PID:2984
- - C:\Temp\idbwtomgey.exe
    C:\Temp\idbwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbwtomgey.exe ups_ins
  2⤵
  PID:4032
- - C:\Temp\i_idbwtomgey.exe
    C:\Temp\i_idbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlfdyvq.exe ups_run
  2⤵
  PID:2408
- - C:\Temp\bvtnlfdyvq.exe
    C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
  2⤵
  PID:3812
- - C:\Temp\i_bvtnlfdyvq.exe
    C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavqni.exe ups_run
  2⤵
  PID:1416
- - C:\Temp\sqkidavqni.exe
    C:\Temp\sqkidavqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavqni.exe ups_ins
  2⤵
  PID:3520
- - C:\Temp\i_sqkidavqni.exe
    C:\Temp\i_sqkidavqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxnhfa.exe ups_run
  2⤵
  PID:2028
- - C:\Temp\snkfdxnhfa.exe
    C:\Temp\snkfdxnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxnhfa.exe ups_ins
  2⤵
  PID:2928
- - C:\Temp\i_snkfdxnhfa.exe
    C:\Temp\i_snkfdxnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run
  2⤵
  PID:628
- - C:\Temp\kicausmkfc.exe
    C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins
  2⤵
  PID:2192
- - C:\Temp\i_kicausmkfc.exe
    C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxumhfzxrp.exe ups_run
  2⤵
  PID:4240
- - C:\Temp\cxumhfzxrp.exe
    C:\Temp\cxumhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxumhfzxrp.exe ups_ins
  2⤵
  PID:3768
- - C:\Temp\i_cxumhfzxrp.exe
    C:\Temp\i_cxumhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomh.exe ups_run
  2⤵
  PID:1440
- - C:\Temp\rmjecwuomh.exe
    C:\Temp\rmjecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomh.exe ups_ins
  2⤵
  PID:3504
- - C:\Temp\i_rmjecwuomh.exe
    C:\Temp\i_rmjecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwugbz.exe ups_run
  2⤵
  PID:3664
- - C:\Temp\rmjecwugbz.exe
    C:\Temp\rmjecwugbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwugbz.exe ups_ins
  2⤵
  PID:3968
- - C:\Temp\i_rmjecwugbz.exe
    C:\Temp\i_rmjecwugbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4108

C:\Temp\xrmkecwuom.sys
C:\Temp\xrmkecwuom.sys
1⤵
- Executes dropped EXE
PID:4468

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:1616

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
- Executes dropped EXE
PID:1400

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:4580

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\avtnlfdxvi.sys
C:\Temp\avtnlfdxvi.sys
1⤵
- Executes dropped EXE
PID:1832

C:\Temp\nifaysqkic.sys
C:\Temp\nifaysqkic.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\mkecwupezw.sys
C:\Temp\mkecwupezw.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:4936

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
PID:1548

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:2736

C:\Temp\lgdyvqoiys.sys
C:\Temp\lgdyvqoiys.sys
1⤵
PID:864

C:\Temp\dxvqkicavs.sys
C:\Temp\dxvqkicavs.sys
1⤵
PID:400

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:1548

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
PID:804

C:\Temp\hfzxrpjhur.sys
C:\Temp\hfzxrpjhur.sys
1⤵
PID:4044

C:\Temp\zwrpjhbzur.sys
C:\Temp\zwrpjhbzur.sys
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvi.sys

Path C:\Temp\avtnlfdxvi.sys
Size 141KB
SHA256 b1632bcaf4c27dcc3bbc4ce16dbde856e9cece13397d2373f9177d9779698412
MD5 8df723fea1c5365b9000d89ebb23f6eb
SHA1 f73ac1101e066a88ba8501b78eb94527215eee4d
SHA512 045e035ca11591b64896fb63cfa5dcd75913b1df73c7c3c0f1f1e1eea8c712554aec12e965930c5dec8bd7a0f87d92a9650de7d16bed959f07380cfb292d9fa7
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywq.sys

Path C:\Temp\bwtomgeywq.sys
Size 141KB
SHA256 c694bf4c4f6d0d221cea31f15eb3d2cf58dbb5b78ed2d04aed91f3b99ae5cef7
MD5 b33c46ae91fbd9c5c7ee2f6fe7affd69
SHA1 e66e4d3b668baddf3a2a4b8d6d32b08705706c7f
SHA512 d8af2903243572b3255734f565145bcd7c07ab3cd322f8182fcbb107231d00a7fa1690dc197327eba8f690a4b7edd7b855f54d7c412ebc4baf8350b0e156d6a9
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnausmk.exe

Path C:\Temp\cxvpnausmk.exe
Size 243KB
SHA256 d5a68ebf6c3eddd344904d77791069f5a539d45b1a9a5968cad53cc2a9ba9673
MD5 547f8651a12126f355fab46fe56a3706
SHA1 87c2aeb3686fbae690692dbfe795488ad7532e44
SHA512 a657c1e7a2e8c37c0e127a3e23365ca2df73dbf9dfe04f23156765d1e82e06a5f830e135a64009777a8f1d2d9c85ddb91a9e44c10e9e153acf534b96fd258f4d
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:SvMsLaOa3lLNngoqRttA7d
TLSH
T1A2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 141KB
SHA256 2ce478ef49c9c2b2b4dc78dd54a7ab401ff288313f34f2c438a56eb2d2915100
MD5 0d94ac309cdd5c32c073c15f41c84c4e
SHA1 9e007c85c43c57f5b0b1f82fa4adadefdfd73513
SHA512 59a3d535e8991fbfea252720daf8124145257ff5d8d6a524d5b0a6fb62b33f7a449e072a9360d8461d7151c32a4bdb78c23e845eca2b38a312ef11b57b712cb1
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhcau.exe

Path C:\Temp\fzxspkhcau.exe
Size 243KB
SHA256 67c8f64457941783842e56a4e33634c9c8657bb6d0662b1d6e82ebac0eba0ec9
MD5 7dc8404848c44bb349147f30b5a25301
SHA1 c3b0fd5d4317796bb9f012573b3a1e0dab2440c0
SHA512 f3b2317d78129641ef255179f4ed84244c28c908671d78fe68ff31da8f237c3f106a13eeb02ba9617fcc291558e51b6fab1f2f3dea30d0922a1933d4f7dc36f3
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:evMsLaOa3lLNngoqRttA7J
TLSH
T17A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 243KB
SHA256 075c162a36dd482d0b25691e3204f31f1a86ed66c7a459f9f7688da54c2d5a18
MD5 552a247b87986ccf46742f5497f310e3
SHA1 60674fe268df5c0385ac2c7a40a8c90c50c60989
SHA512 9b2281f225aa291e06d7074bb41c7d41d55aa292f0a4c5d2cccdc7d9b371a52a6d05c977cd7ea400317e0907e4d5dacc7d40a2b93aa4f9fad4d1c1e6db1726d3
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:qvMsLaOa3lLNngoqRttA7N
TLSH
T112345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnausmk.exe

Path C:\Temp\i_cxvpnausmk.exe
Size 243KB
SHA256 12a90faa9f7efa01670bf7ae2c229114238c7b7bb56d8182ad0d276261123a50
MD5 b0a13cc059a3ca7a50ad5aa3ce203f81
SHA1 b4aefdb63ec84179769e9f7bc0893548f088d3f3
SHA512 dafc54c1534c33dcd7f6bfaf0f4c21cf23f40d3a3add994d317a08d78219f8fec1b3c38d659cc1e993e40da797b070731459d1b3c67e5baae64b26462275e5f1
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:WvMsLaOa3lLNngoqRttA75
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkhcau.exe

Path C:\Temp\i_fzxspkhcau.exe
Size 243KB
SHA256 d659a0e27c808af0d758de3a2e12550bccd42af1eabecc0095480ca6385ef982
MD5 2eeb43bf06c330f7936d6513563ece32
SHA1 1309115649d1b905d616aadc98b43a8cf1d96a24
SHA512 49b2906aac666833d88f87b25eaec3e989562167ead7a1f979eca1fcdccf70cdff48ede4f9a71649cbbeee9c15fa9bfe565c71007f41879a776114507cefe824
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:evMsLaOa3lLNngoqRttA7x
TLSH
T1F1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 243KB
SHA256 9f12ab0947e04effc75d38fa547ddcf0d006a4ca50fbcdd681b70d959b9492b7
MD5 6c530fc791f5dd2e106836c4cdacf875
SHA1 7e70c326c3fad07d2b97ac0ebb81c344ceaf0221
SHA512 a06673a0b4f6b1fe5cf6206d0ce69e0879d976c214bef7584b5a1daebde2546b8ea11f2df5eba4d1c8162e120fadca400a6cc66d22cf046253dbf9d31e9b724f
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:pvMsLaOa3lLNngoqRttA7k
TLSH
T18F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxsqkica.exe

Path C:\Temp\i_ifaxsqkica.exe
Size 243KB
SHA256 acde60af81b57713cd086d5e2e1293d0e663b76706503a99d67b759c4a46c840
MD5 5eccd896368ab4eb48e04156e20c4540
SHA1 100386919e3db35b865d1e5dddc8e6ebe24d4e3f
SHA512 7317ac18d0afe95fa39404ee81f7eb6c77606f5f4ce9949cda62fa864fa0dbe5f1c23849f6f8d5934ba03e0752b0d4a988c2c1e8b17a8837af1ff6a230630b0f
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:avMsLaOa3lLNngoqRttA7l
TLSH
T179345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzurmkec.exe

Path C:\Temp\i_jhbzurmkec.exe
Size 243KB
SHA256 a0817357a1e7addf888224ff9be387ed61dd239e6d7ce4e53ca7de715edc4338
MD5 ae3e0079b0a066056d3c70d1fa6d5980
SHA1 d134101ae6bf7fc629c1d7b46dd831ed64c58273
SHA512 c893bfaa5298f3523adfa84ae9fe95e27f23ccacd8c3b1ef1269597f0aad417c0cd814757949a1b6d5b386f41c8a209ac20a91e6fcbbf28d604c029b77191c58
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:SvMsLaOa3lLNngoqRttA7l
TLSH
T16F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlfdyvqoi.exe

Path C:\Temp\i_sqlfdyvqoi.exe
Size 243KB
SHA256 f8a8e4008d400e3b6d16618dae174ed7ac44893f2657e0a0b0a175163570a9cb
MD5 88450dd2b4509c90d27008c17eaf4333
SHA1 b8c4797d4dd80f48859dc74feab1b71d2b8b6a70
SHA512 81a2ff98c48a7c1ffa22b7c16b5861c03504565ede11aa96c0fe12f3492d8e2126df18b1ec151fb064300ef0052bf7e8e6765adc3cc12f52dcf7e14fd46efa24
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:DvMsLaOa3lLNngoqRttA76
TLSH
T194345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywrob.exe

Path C:\Temp\i_uomgeywrob.exe
Size 243KB
SHA256 fe29b88d04d506eb8a713e3c0c86f9a75231f95d622f7d823bcca34ff0984328
MD5 7ae2a56cb449878a27870d42a110c289
SHA1 68f96f9570f1dfea0e2aa0c2f1ec8188b8d2e850
SHA512 112fff856cd299e1467b20ab4b5da1cd75e2630c739fa377e425f5af0543c228b2bd1de1e50c853276c5bdff868298f994b7a464d7efb2189a34cae7372cff28
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:nvMsLaOa3lLNngoqRttA7C
TLSH
T132345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljebwuo.exe

Path C:\Temp\i_ztrljebwuo.exe
Size 243KB
SHA256 ce88245b1727246ef3475b348730a13754d1475780193bb3f164d18fec86657e
MD5 6e99f0115adf70334c7bd49a197369e8
SHA1 3773a597015480b900e2cc884f83ae42e2a2d6e4
SHA512 243485322941191116d8b7aad21ed7de768fcaa57746c2878574e6564dafc7b51091c6b66efa9625b8a7b970fa88df54159ffa974da2f78bae964b7c4568241c
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:WvMsLaOa3lLNngoqRttA7J
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.exe

Path C:\Temp\ifaxsqkica.exe
Size 243KB
SHA256 632c07c6fcb45363638e2e2968415cbea3dd8398086f4b3be3bf6a4d67fdbafd
MD5 d2bd01a1ee3d82583944618673ce3019
SHA1 4d337003c2ff170657989925bd7168af51b2d58d
SHA512 3eadc1e41c7c2654ad81972e254b0396af835e926611ad070151f289ef68a9f05acc8681e8d6ab78121dac0b1abc8aca92da793d58b1a87f07b75ea0cc7e71a0
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:rvMsLaOa3lLNngoqRttA7y
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkec.exe

Path C:\Temp\jhbzurmkec.exe
Size 243KB
SHA256 a4c5676f2f109e10461a9205b52d3458c730089db2b1c54beb7ddb0a21fb3c5b
MD5 adba2c07210bfa4e344fca0f75523dcd
SHA1 e303b266329bdc9b8f08837cb3ea690cae211c67
SHA512 e9e816acc9377e994cbb5226a5944bae101443e4f7bfa4f884134887c5ccc99d8707e5a0aa33108aa613a4756122228fd4d6d51c44db37fb942b4c1dbe03162d
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:WvMsLaOa3lLNngoqRttA7x
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkic.sys

Path C:\Temp\nifaysqkic.sys
Size 141KB
SHA256 7b01f9eeecbc3d55547d2324230891f57ef76885c8266b00831ba19845f71b68
MD5 0e0be74ff73611e7f4d06c654ed49940
SHA1 31d693cd31791c84321599f02f731fb599cc53bf
SHA512 0715f8f0d2c81ecc4bc7ba5371f8d4ee57775b4b2c4dafcf8664451fbb89a8c1e9f6380c866e1a7377837e1d87d63ce4c530ccf68934ca565d9a9f5a0619eec1
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T102E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 141KB
SHA256 5577ffb84d592efd4e999afadc6d64316291eee633e167f121aab990d920869f
MD5 4cfee66e28d4c1a88a8ed60b59f1ca96
SHA1 7cbd85e321b98943b0d160e8d908938567f8f4d6
SHA512 ab0a3a1c37bc81c13bc932fcc5ae189dafe687c5411e0709a61d6cd492932bfde5fd0e3a7af581b1a7a9f45751d23e22b3bce34615f5f33be1f314f2815e2531
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 d83907e8fc4e381f7e352d6c390ecf28f9bd3c9c58a8121fbf252693f2e93b92
MD5 d1d0853f2c32d5d4292df8d5e125b205
SHA1 5387920fccb9ae9b6e9524727f4d160e8ee305e6
SHA512 309419d51eb4c09fde00972d60bbfe75203e8deea91b310c54e89c7e863ac264f622239e534e1fd45e43ea8108bc6b90d1a077cb4f73536058932e92bb89fc55
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlfdyvqoi.exe

Path C:\Temp\sqlfdyvqoi.exe
Size 243KB
SHA256 9c84a00f45b1662c0a9bdff3dca2184dcdd5d204e44afe7eae71208f4776b7e3
MD5 cd865e5175a4c07797bd786824ef44b8
SHA1 f0589891f13487e8b51bc6e29c572f67995aa07a
SHA512 e36c57224a3a5ee9e8b2e77cece8174a6e8161a73c60030c2553cc766998912eb7c058a5c2a32735f9eb01192cad3c7eca099e9e14f6480ce7cef5f0da95de28
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:RvMsLaOa3lLNngoqRttA7c
TLSH
T13E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywrob.exe

Path C:\Temp\uomgeywrob.exe
Size 243KB
SHA256 d7e98b41fdc2ff4581bd1e51b19bdcc201977334cabf795e32d17b1eb12bff6a
MD5 382cde5982b0fd7502b9ad1d2beb5e18
SHA1 05959732bd21bf8b324dceea4a93620705e7a319
SHA512 f0857ead423b147a77c184011f4d817c95b28b005c169a11ab64deb5e123ba7ef77e7e5ae0068157f36059fb6d896c4ed4844be8d33090ce8cb660d5aa4fa3a7
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:/vMsLaOa3lLNngoqRttA7i
TLSH
T11D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrmkecwuom.sys

Path C:\Temp\xrmkecwuom.sys
Size 141KB
SHA256 2d2acc348788403598e52eb9d2f50528407d2b5d53242f49169b008919df8348
MD5 5e585023f9023736591dd9a00ae32e9a
SHA1 6916237973bc7048baf80263c86a217e1fe98ed3
SHA512 6b80002976412330ace6412cf6fe86d5c0bdbeab15bd229a074104091590342481cb6a13be7a4cb5f343cc2969fc40a03a887148751787f054e5dd0cc8f2dc5e
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuo.exe

Path C:\Temp\ztrljebwuo.exe
Size 243KB
SHA256 c545cae8640da5c1a9ba918488ebf483c8ada8b084f64a5399da91d97138736a
MD5 8dfca7d89e8d420337ce54d4bbb58102
SHA1 130182a73f84a0a06bc5ec4127054189208ed2da
SHA512 6cfde27bb3dc22f4d73b92931e0f64125e56d28c6af3c4e48a492540d7394fc9afd6578256e721cfb88f721f9000ac606ae45d29d9e41719a922858934e58ab3
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:svMsLaOa3lLNngoqRttA7r
TLSH
T109345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8GAU4O3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/804-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/864-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1260-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1400-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1616-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4580-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4768-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-114-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads