3b0a12c222281f88123a3e655b9c4f7d7c703e526f56791a9c9b0861b8285fbc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe
Size 243KB
Sample260803-zagrssxdlc
SHA256 3b0a12c222281f88123a3e655b9c4f7d7c703e526f56791a9c9b0861b8285fbc
MD5 d7c592150c31b114cb76b834d36ad466
SHA1 44571d1c3883bfc7b98f0f579aa852062c52e5bf
SHA512 3b8e199f9e1b0bdee4d2340280a8a0c75b26251aee2945dccc6ef0e6aef53542ad346a31274854ae82608ac844da64641ea5fb886a9740b9d258bb5456bcd097
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:vvMsLaOa3lLNngoqRttA7S
TLSH
T1A7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3304	CP.exe
692	hcxupnhczu.exe
1448	CP.exe
2996	CP.exe
4980	i_hcxupnhczu.exe
4396	czusmkecwu.sys
3352	CP.exe
3032	mhezxrpjhc.exe
4352	CP.exe
3856	CP.exe
1476	i_mhezxrpjhc.exe
5104	pjhbzurmje.sys
516	CP.exe
1676	ecwuomhezm.exe
2308	CP.exe
636	CP.exe
976	i_ecwuomhezm.exe
2272	ywrojhbztr.sys
1428	CP.exe
1396	rmgeywqojg.exe
2900	CP.exe
3156	CP.exe
4812	i_rmgeywqojg.exe
532	ljdbvtolge.sys
4172	CP.exe
3376	dywqojgbyt.exe
4796	CP.exe
568	CP.exe
1580	i_dywqojgbyt.exe
1004	geywqoigtq.sys
3024	CP.exe
1268	qlfdyvqoig.exe
3028	CP.exe
1864	CP.exe
2004	i_qlfdyvqoig.exe
868	qlidbvtnlf.sys
1552	CP.exe
1784	fdxvifaysq.exe
260	CP.exe
3392	CP.exe
2760	i_fdxvifaysq.exe
3496	cavsnlfdxv.sys
3256	CP.exe
4616	vpkfdxvpni.exe
4840	CP.exe
3708	CP.exe
4596	i_vpkfdxvpni.exe
4416	smkfcxvpnh.sys
1400	CP.exe
3452	hfzxspkhca.exe
4372	CP.exe
5076	CP.exe
3876	i_hfzxspkhca.exe
3872	mkfcxmhfzx.sys
2368	CP.exe
3456	xrmkfzxrpj.exe
3288	CP.exe
4940	CP.exe
2976	i_xrmkfzxrpj.exe
3228	bzurmkecwu.sys
4536	CP.exe
1756	upbztrmjec.exe
4844	CP.exe
1200	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcxupnhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrmkfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lavtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrmkfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lavtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcxupnhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4468	ipconfig.exe
4824	ipconfig.exe
1028	ipconfig.exe
3920	ipconfig.exe
3844	ipconfig.exe
1812	ipconfig.exe
4552	ipconfig.exe
4636	ipconfig.exe
4580	ipconfig.exe
1856	ipconfig.exe
2908	ipconfig.exe
4164	ipconfig.exe
4912	ipconfig.exe
1696	ipconfig.exe
4012	ipconfig.exe
4328	ipconfig.exe
2708	ipconfig.exe
2236	ipconfig.exe
1480	ipconfig.exe
4860	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc000000000200000000001066000000010000200000004e2ee9edf953a4c96eb15eb5e1f6f189115de58c437ed682423432a80867251d000000000e8000000002000020000000456127422385333b3076574ae951e665ac6c41e596ca75a5fe76f2b47c8a9792200000001b982af61ddfef22175f29722d60d01cdeb5ff8c06ff13e972a81480af603677400000008c0ae253db9e47403f2d36661444d83b513366922164d368254467319fa7241622a7cb0a7cc0094cfe8d65da9f59477c08661945facb0918d4b1e5f783c5cc14	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6086c3698f23dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc000000000200000000001066000000010000200000007e941cc9b30beeccaf7a615b95f7eef2d857ab30d561aa1c959953f150b7ad84000000000e8000000002000020000000f5649104875acd554c5a9cfcf52fab370f261cde579d755b886abb4fcf87be3020000000a9c163d1d2b5c8863b0f052d30c7ee1bac8980356c8663fc9fa8075ee9aad6484000000008fb8b56c1d9bfdc5c0f3d0a78e3a808053407dff096dce323372a26e59de416ce5201dfc2a1e5ce9953fa1e71f817d259cc8d164ff81fe6d9d042f71fa1ae61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cbbe698f23dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "120571914"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269767"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492554017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{32A248F4-8F7A-11F1-9D43-5AB93EA64185} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "126352862"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	i_hcxupnhczu.exe
Token: SeDebugPrivilege	1476	i_mhezxrpjhc.exe
Token: SeDebugPrivilege	976	i_ecwuomhezm.exe
Token: SeDebugPrivilege	4812	i_rmgeywqojg.exe
Token: SeDebugPrivilege	1580	i_dywqojgbyt.exe
Token: SeDebugPrivilege	2004	i_qlfdyvqoig.exe
Token: SeDebugPrivilege	2760	i_fdxvifaysq.exe
Token: SeDebugPrivilege	4596	i_vpkfdxvpni.exe
Token: SeDebugPrivilege	3876	i_hfzxspkhca.exe
Token: SeDebugPrivilege	2976	i_xrmkfzxrpj.exe
Token: SeDebugPrivilege	4700	i_upbztrmjec.exe
Token: SeDebugPrivilege	4720	i_jecwuojebw.exe
Token: SeDebugPrivilege	1692	i_ytolgeywqo.exe
Token: SeDebugPrivilege	4028	i_lgdywqoigb.exe
Token: SeDebugPrivilege	2004	i_lavtnlfdxv.exe
Token: SeDebugPrivilege	2216	i_fdxvqnigay.exe
Token: SeDebugPrivilege	400	i_xvpnhfaxsn.exe
Token: SeDebugPrivilege	1808	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	2372	i_pjhurmkecw.exe
Token: SeDebugPrivilege	1384	i_ecwuomgezw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2856	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	84
PID 2856 wrote to memory of 2768	2856	iexplore.exe	85
PID 4260 wrote to memory of 3304	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	86
PID 692 wrote to memory of 1448	692	hcxupnhczu.exe	89
PID 4260 wrote to memory of 2996	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	92
PID 4260 wrote to memory of 3352	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	96
PID 3032 wrote to memory of 4352	3032	mhezxrpjhc.exe	98
PID 4260 wrote to memory of 3856	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	101
PID 4260 wrote to memory of 516	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	105
PID 1676 wrote to memory of 2308	1676	ecwuomhezm.exe	107
PID 4260 wrote to memory of 636	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	110
PID 4260 wrote to memory of 1428	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	114
PID 1396 wrote to memory of 2900	1396	rmgeywqojg.exe	116
PID 4260 wrote to memory of 3156	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	119
PID 4260 wrote to memory of 4172	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	126
PID 3376 wrote to memory of 4796	3376	dywqojgbyt.exe	128
PID 4260 wrote to memory of 568	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	131
PID 4260 wrote to memory of 3024	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	137
PID 1268 wrote to memory of 3028	1268	qlfdyvqoig.exe	139
PID 4260 wrote to memory of 1864	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	143
PID 4260 wrote to memory of 1552	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	151
PID 1784 wrote to memory of 260	1784	fdxvifaysq.exe	153
PID 4260 wrote to memory of 3392	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	156
PID 4260 wrote to memory of 3256	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	160
PID 4616 wrote to memory of 4840	4616	vpkfdxvpni.exe	162
PID 4260 wrote to memory of 3708	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	165
PID 4260 wrote to memory of 1400	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	170
PID 3452 wrote to memory of 4372	3452	hfzxspkhca.exe	172
PID 4260 wrote to memory of 5076	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	175
PID 4260 wrote to memory of 2368	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	179
PID 3456 wrote to memory of 3288	3456	xrmkfzxrpj.exe	181
PID 4260 wrote to memory of 4940	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	184
PID 4260 wrote to memory of 4536	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	188
PID 1756 wrote to memory of 4844	1756	upbztrmjec.exe	190
PID 4260 wrote to memory of 1200	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	193
PID 4260 wrote to memory of 2256	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	197
PID 1208 wrote to memory of 2268	1208	jecwuojebw.exe	199
PID 4260 wrote to memory of 880	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	202
PID 4260 wrote to memory of 4876	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	206
PID 4544 wrote to memory of 744	4544	ytolgeywqo.exe	208
PID 4260 wrote to memory of 1872	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	211
PID 4260 wrote to memory of 3260	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	215
PID 4056 wrote to memory of 4688	4056	lgdywqoigb.exe	217
PID 4260 wrote to memory of 3872	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	220
PID 4260 wrote to memory of 2660	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	224
PID 1696 wrote to memory of 3548	1696	lavtnlfdxv.exe	226
PID 4260 wrote to memory of 1020	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	229
PID 4260 wrote to memory of 3432	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	233
PID 1768 wrote to memory of 3492	1768	fdxvqnigay.exe	235
PID 4260 wrote to memory of 452	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	238
PID 4260 wrote to memory of 1744	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	242
PID 3756 wrote to memory of 4560	3756	xvpnhfaxsn.exe	244
PID 4260 wrote to memory of 3696	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	247
PID 4260 wrote to memory of 2484	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	251
PID 756 wrote to memory of 4972	756	pmhfzxrpjh.exe	253
PID 4260 wrote to memory of 4928	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	256
PID 4260 wrote to memory of 2092	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	260
PID 3128 wrote to memory of 2124	3128	pjhurmkecw.exe	262
PID 4260 wrote to memory of 3764	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	265
PID 4260 wrote to memory of 4680	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	269
PID 2232 wrote to memory of 3356	2232	ecwuomgezw.exe	271
PID 4260 wrote to memory of 4196	4260	2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d7c592150c31b114cb76b834d36ad466_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcxupnhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3304
- - C:\Temp\hcxupnhczu.exe
    C:\Temp\hcxupnhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcxupnhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\i_hcxupnhczu.exe
    C:\Temp\i_hcxupnhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\mhezxrpjhc.exe
    C:\Temp\mhezxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\i_mhezxrpjhc.exe
    C:\Temp\i_mhezxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:516
- - C:\Temp\ecwuomhezm.exe
    C:\Temp\ecwuomhezm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:636
- - C:\Temp\i_ecwuomhezm.exe
    C:\Temp\i_ecwuomhezm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmgeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Temp\rmgeywqojg.exe
    C:\Temp\rmgeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmgeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3156
- - C:\Temp\i_rmgeywqojg.exe
    C:\Temp\i_rmgeywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqojgbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Temp\dywqojgbyt.exe
    C:\Temp\dywqojgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqojgbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:568
- - C:\Temp\i_dywqojgbyt.exe
    C:\Temp\i_dywqojgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\qlfdyvqoig.exe
    C:\Temp\qlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1864
- - C:\Temp\i_qlfdyvqoig.exe
    C:\Temp\i_qlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\fdxvifaysq.exe
    C:\Temp\fdxvifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\i_fdxvifaysq.exe
    C:\Temp\i_fdxvifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpkfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3256
- - C:\Temp\vpkfdxvpni.exe
    C:\Temp\vpkfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpkfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3708
- - C:\Temp\i_vpkfdxvpni.exe
    C:\Temp\i_vpkfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrmkfzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Temp\xrmkfzxrpj.exe
    C:\Temp\xrmkfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrmkfzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Temp\i_xrmkfzxrpj.exe
    C:\Temp\i_xrmkfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upbztrmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4536
- - C:\Temp\upbztrmjec.exe
    C:\Temp\upbztrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upbztrmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1200
- - C:\Temp\i_upbztrmjec.exe
    C:\Temp\i_upbztrmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuojebw.exe ups_run
  2⤵
  PID:2256
- - C:\Temp\jecwuojebw.exe
    C:\Temp\jecwuojebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuojebw.exe ups_ins
  2⤵
  PID:880
- - C:\Temp\i_jecwuojebw.exe
    C:\Temp\i_jecwuojebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytolgeywqo.exe ups_run
  2⤵
  PID:4876
- - C:\Temp\ytolgeywqo.exe
    C:\Temp\ytolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytolgeywqo.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_ytolgeywqo.exe
    C:\Temp\i_ytolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoigb.exe ups_run
  2⤵
  PID:3260
- - C:\Temp\lgdywqoigb.exe
    C:\Temp\lgdywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoigb.exe ups_ins
  2⤵
  PID:3872
- - C:\Temp\i_lgdywqoigb.exe
    C:\Temp\i_lgdywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lavtnlfdxv.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\lavtnlfdxv.exe
    C:\Temp\lavtnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lavtnlfdxv.exe ups_ins
  2⤵
  PID:1020
- - C:\Temp\i_lavtnlfdxv.exe
    C:\Temp\i_lavtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  PID:3432
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  PID:452
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsn.exe ups_run
  2⤵
  PID:1744
- - C:\Temp\xvpnhfaxsn.exe
    C:\Temp\xvpnhfaxsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsn.exe ups_ins
  2⤵
  PID:3696
- - C:\Temp\i_xvpnhfaxsn.exe
    C:\Temp\i_xvpnhfaxsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  PID:4928
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhurmkecw.exe ups_run
  2⤵
  PID:2092
- - C:\Temp\pjhurmkecw.exe
    C:\Temp\pjhurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhurmkecw.exe ups_ins
  2⤵
  PID:3764
- - C:\Temp\i_pjhurmkecw.exe
    C:\Temp\i_pjhurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  PID:4680
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  PID:4196
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1384

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\pjhbzurmje.sys
C:\Temp\pjhbzurmje.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
- Executes dropped EXE
PID:2272

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
- Executes dropped EXE
PID:532

C:\Temp\geywqoigtq.sys
C:\Temp\geywqoigtq.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
- Executes dropped EXE
PID:868

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\mkfcxmhfzx.sys
C:\Temp\mkfcxmhfzx.sys
1⤵
- Executes dropped EXE
PID:3872

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:3228

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
PID:3316

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
PID:1616

C:\Temp\bytjdbvtnl.sys
C:\Temp\bytjdbvtnl.sys
1⤵
PID:4928

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
PID:392

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:732

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:1952

C:\Temp\icausmcxup.sys
C:\Temp\icausmcxup.sys
1⤵
PID:2000

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:4608

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.sys

Path C:\Temp\cavsnlfdxv.sys
Size 141KB
SHA256 2a6c457c71654967b054724eb70b21ca36ffd86a748d7e300bdbf0f5ebb99768
MD5 402d34b3afd6b14741e034061bc77c50
SHA1 58510a39a6a3aa536b50f75ba023ed9901efd20d
SHA512 e385e9520d626ac2e8048fda22907b8ab7720265613bc49217bfea524eb835adc1d1220212b458f00a0b6e4b73645c0b52febb045f8fd96602ecfec822381f54
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwu.sys

Path C:\Temp\czusmkecwu.sys
Size 141KB
SHA256 f452e4812e79aca23f05aea5cb0f63a5fafab1f93bc33f21004f9f7766b1d60e
MD5 10983224d41f1746e1d9b73528bbe32f
SHA1 b72b5bcb527d00f559ece3e81891c863ae46e17f
SHA512 af1923a263ff8948c428e2fbfe7ca66928072873d03bd399440f77ce69f97612b114242ea68b1aedd71550e7b70ffc29d964baf978fe2b3d52f1a6de57547a06
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqojgbyt.exe

Path C:\Temp\dywqojgbyt.exe
Size 243KB
SHA256 67b4f639eac5d19ea2ce010cac77281cf49c267160c8cbc9ab02c53f8b1a9b27
MD5 6423c51afc55df62bb2ec5e2ef509f7e
SHA1 87522c43e7112d30f6ea1e59f95ab4cd53a428b3
SHA512 5e941dd95711b586a794fae5da5ff03382a19d809cd54315c5b98f245fba565d5b7e88aa443f4699603c539baefd2519c19e29a68aa3883e0d7946e93b6b1424
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:QvMsLaOa3lLNngoqRttA7n
TLSH
T191345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezm.exe

Path C:\Temp\ecwuomhezm.exe
Size 243KB
SHA256 80c58b2225feead217e4b145dd72cd46f94136b10af7a1cff08c99956792aa74
MD5 bd79afe2aa03dbbd26f43bd5438bc4e2
SHA1 fea3a23ef5794603a0c48b7832f38a04bab584ac
SHA512 b510e3c4e52a3b7fa7b83a95bbb26be003213fff073d225890b8b69c2b83d82fa61829759ac6306a07eb80d5a7a0456acb8d851a1ea5c0a543d1cb4ae6898c95
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:ZvMsLaOa3lLNngoqRttA74
TLSH
T156345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvifaysq.exe

Path C:\Temp\fdxvifaysq.exe
Size 243KB
SHA256 957db69cfb200619387b579b51d5fd96c557732d030e95799b959fd922658550
MD5 9a570941294512f7b02e8c60d16408b2
SHA1 bee26f77c9d8d52d75a577a7d8fb016e1182a72f
SHA512 5711b2dab8aba578f00bf7cc8e52903d2bbb3e146bec1bc4a0973000367ecd970d164732e705a588ebcffc6305900e8fbd52100d3486fc92f4e2c3241d8cac99
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:YvMsLaOa3lLNngoqRttA7/
TLSH
T198345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigtq.sys

Path C:\Temp\geywqoigtq.sys
Size 141KB
SHA256 b20b0dab221e34477a9e0d8ce1afec98f6616d2f851965acb2b83c3e28078db6
MD5 d7a0e5a905681169c04faf5590802247
SHA1 718397be3a06b1238e4b198e13249d4f364c67bb
SHA512 f103ca86fb08fc33b90bde51b235c5df4adab645446b7f32cc741e30f36340d267f486ed993033e7c905cca27a46f1368981b67d4bc651bbf5d9f234c854830d
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcxupnhczu.exe

Path C:\Temp\hcxupnhczu.exe
Size 243KB
SHA256 5859f74ca477ee289d75f68ded450a4d54741160983c419c63b0f01cb144f1e2
MD5 23e0b3661f51e3e7ae36af311ec4a7af
SHA1 01011be4febd106624122eb08a49e0e4a3d2af71
SHA512 305789fa3d3fc1bf88867b0a11349f275a933bb767fee1649791eb73255d69958de4a2c8135d60a7c36fbc59624331cc48ba8ac1bd579abaf2f9e8667b07168a
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:bvMsLaOa3lLNngoqRttA7i
TLSH
T19C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqojgbyt.exe

Path C:\Temp\i_dywqojgbyt.exe
Size 243KB
SHA256 33ced37b2fc935e5b0aabfd4c8b679af609d7a5308340b9a2e92a0f9b9e11912
MD5 7cc64237d87ee22297ccd75539108030
SHA1 b87e1b40439e96411a1bfb638095738415b6464f
SHA512 3f9eec5db3ca96e4a65fbd42d662ef621251f02257ebdb2716e62ea4ce0c96e1c87a703ab1ec39cf2528fa12af0f06d58e47adcc551b51b72432840af0da9a72
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:yvMsLaOa3lLNngoqRttA7l
TLSH
T1EC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomhezm.exe

Path C:\Temp\i_ecwuomhezm.exe
Size 243KB
SHA256 742939bc239b8d0f14f5537ca1095d3de1bfbca80aa0ae519fba6e690671eafd
MD5 3f01d43c7bb47f393c1c2261cd668312
SHA1 3c0e2f81b8c22380e4701d24d7947ab31fd0ff4a
SHA512 7dda64f3d28646859fc6c5f0c55469020085c118f30647ba40ebbb4f7dbe10a92c24778335c5eeb2bc7c5295fe8e73de563a9d8f7e94e2c8c9e28bc99314da46
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:wvMsLaOa3lLNngoqRttA7X
TLSH
T187345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvifaysq.exe

Path C:\Temp\i_fdxvifaysq.exe
Size 243KB
SHA256 8c23c6fa117f77a2fe8ec2cf688e2d42c18c61daac79bb2c047031ab05fb05b2
MD5 92055d55d7992a14cd742f23f871ab5a
SHA1 257a5442b822d9f2b067d3421449b96530b412f2
SHA512 794b843f9fa19a5ac95eb079016bb13b360ba6e9980f8e5dfc08bd597e2870a3d43754d38065085018e96c4207817f07f73e9966cce448f12bf0be85b44fff94
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:bvMsLaOa3lLNngoqRttA7S
TLSH
T101345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcxupnhczu.exe

Path C:\Temp\i_hcxupnhczu.exe
Size 243KB
SHA256 d1c59bfba7b4f4a237bf2dbb2469ecd1a4371331e287eca9a514b2513422f20d
MD5 62d9881e4ecd85b9a111d511db813c29
SHA1 38ad737974b40f1643e82ff3363ac95d78554ede
SHA512 2b937185b3d6c94114c87fd24ed03448a8ffa510c7886025b6cf6615a284ec0bcaf34b41c47a8111014cd3086b6240b46137b480850e0335eab2c6fe78d375a6
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:9vMsLaOa3lLNngoqRttA7s
TLSH
T1D8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpjhc.exe

Path C:\Temp\i_mhezxrpjhc.exe
Size 243KB
SHA256 cd9ef712333a8658dc4bd711f83f6a43101468a19bab2795cabd3d39665e1469
MD5 87b30ea3609e2ee207049bc1dc6f999a
SHA1 ba6da430b8d36255b16a2170fcae1a229d6b893e
SHA512 ee3b08c558e14c67d0431b3dd3e1a54a8311afdec0715be02d472f5dcdd5250c5bac5e322df788c898b9df55eb5c25854923afa1837d359c445bc22e191242e9
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:zvMsLaOa3lLNngoqRttA7y
TLSH
T1BE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlfdyvqoig.exe

Path C:\Temp\i_qlfdyvqoig.exe
Size 243KB
SHA256 6a680e0f017b5a9b37e708b7c0ffbbfc67ee54e8f2dd13bb1ac1cc8adf435335
MD5 5a9b1aa1207eb0e1bff915f377e653a7
SHA1 68df0ea06508e9be7e957d185d107e8449b22d36
SHA512 04c7a09fb5f8592adc10d3e4fc79e01cf82cd2a02b556cc8e424c1c81d45278d3296bb4db21619d1ad023b228da192721e2eb1b0e3a0fc7fcf0aba12c7b5606a
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:SvMsLaOa3lLNngoqRttA7l
TLSH
T193345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmgeywqojg.exe

Path C:\Temp\i_rmgeywqojg.exe
Size 243KB
SHA256 a46dac367f72e4fa386495b726cac590f509173b2dccf355220eeeeef9ec494c
MD5 27c6f91bbca1904b6423ceb1a03f52a7
SHA1 128ea54d3331af3425f492fe7434afe2be50a21e
SHA512 647ac05aaa6d780a76e9e1096abd55a5e870747c5efa751509397d95cd37ec1ecb9f9239b31061d6a5d246f9535a2dbe2f8b2d3cf4aa52196a2ee091f56adadf
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:YvMsLaOa3lLNngoqRttA7f
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.sys

Path C:\Temp\ljdbvtolge.sys
Size 141KB
SHA256 8052482a647179589826374851c0fdcd7e245e6b09ae49b3799c7898b35990c1
MD5 ffa5682aadb0756aaee02e248f66fb2e
SHA1 62d2f01b4f647c99ac07cf33bad41caf1c071ce5
SHA512 d63c950a9d03756e975f8c728dbc6cbb04d56e971ffd32e30aa1d00b9e7dbc24bb89312324977cb9a05ea36dfa0390f1a995370885969f61c69a7e98f852163f
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhc.exe

Path C:\Temp\mhezxrpjhc.exe
Size 243KB
SHA256 001fcc9608908c56a5f143697a1dc8536bb32204225e8288ec563c09a25a72fd
MD5 1e2b5235295dcbd3279c684d4eaa5894
SHA1 45f84b8ea1fb9d04eba6215c45a29d74e18ebad4
SHA512 0639779a0087c32f6266465c1c12837a6076e57a21b46c165c026bc617bf5775378b241d21f0506a4617dfd70a9a199706da23dfd38deff9a93bc61134488375
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:AvMsLaOa3lLNngoqRttA7f
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmje.sys

Path C:\Temp\pjhbzurmje.sys
Size 141KB
SHA256 d8189cfe0460550674597b99026e0177d4b0d0fbc5cfc738223eae8a723adff2
MD5 896c0e854ec9ad94d7bf0c16302c520f
SHA1 a89ca6a468367970dfaa384f3097e7aeb555b864
SHA512 c0af64a4a2664d4ae11d539526f96135df54a642bbdac0d0c3b39b1bba243fc1bad59db21cf7ed62a5f81208f7dde4f7e9da99ebee09cbe7439a7970d1fd8460
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlfdyvqoig.exe

Path C:\Temp\qlfdyvqoig.exe
Size 243KB
SHA256 164860fdb72921193d7bbc5cfb13ae2e40e6774107847e693d1aa13c335fd4a3
MD5 b5c55584cfab479bca157ecf9c7ed490
SHA1 1d5f6ce3ba3f63b8c379d62d704f8a2da6a5164c
SHA512 4020d5716d99a84455b0126d5600b86b322ede1c66e415f12fad18c0df0c4989f9f52b5a6007b288685531d26a329abe1354fdc9c297e0f08678e650d494b9f3
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:6vMsLaOa3lLNngoqRttA7B
TLSH
T110345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlf.sys

Path C:\Temp\qlidbvtnlf.sys
Size 141KB
SHA256 90a75e90d968d8c15a78e95afb363d91ebdf9f63902a49171ae26d22c48d5350
MD5 a16b88b8bc388565a044d6c1d5732463
SHA1 2e9475d6444f6b35ad5c399d05011ee4c644c86d
SHA512 db5212daafbc9b039b5f9a4b3662b3bc7298ebd0aebdc00613006d975afb71ba6bfec9d53e83d94444795d67c67ad31efcf3d5ac08d62f5f42e4d2f172017d41
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgeywqojg.exe

Path C:\Temp\rmgeywqojg.exe
Size 243KB
SHA256 623054430ed9ce426693dbd31c4a0aa8271d267ddfa2ddc0d2d755421db82429
MD5 dce298b1733ff4596e9a2bc064fb0c5e
SHA1 7a1281d9bffd6162a9960bef2a2ee299dd9017f8
SHA512 dfa3816f80735497c484649617c3981c255d4140a008aa85403a01ae7dad7998de1f46b99f5b597d31bdb00a38ee7eb40a9e476344105e82b67b66eb3e3560a1
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:IvMsLaOa3lLNngoqRttA7D
TLSH
T1A2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpkfdxvpni.exe

Path C:\Temp\vpkfdxvpni.exe
Size 243KB
SHA256 fc295ed11ccfd2979228c8666a4601324edf8c7d89465a92ab23f04b9ae78cb1
MD5 951a6a22b94717533240e62626b66b8f
SHA1 d63c2eef6a81ccb64ea64517a3c697f070ac0355
SHA512 1bf19beb3ec6982b21e0dde6a654808cc52bc101aa2026ed67c2b36f44a3bd12c7276018a4d749d37502e03c638e4a5d84e8d55bb1ea781a996ba6ce91784085
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:svMsLaOa3lLNngoqRttA7P
TLSH
T100345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztr.sys

Path C:\Temp\ywrojhbztr.sys
Size 141KB
SHA256 57763136a9fe7e69023287da0a8376f50cbf86bacc1d59d193f53894ff173102
MD5 f0ba71ce574a192670bfba1d0aab21e8
SHA1 4ce953b426b662d9af69cefca1526e651a4d8ffe
SHA512 fffe554f3f8da3d723bb1d049806601136b3a0348e2100e8e3b2dc565d09a8751265ba357780c1dd192fd4f4bc8cdefca821e4e4a21d3fdbf2c78adfe967895d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 241c927e31298f19db62f83279dac84445deeac048d8c1fad744a993d8ba83c6
MD5 9aa3effc211fcccf562f80b4f68f378a
SHA1 44d604c45e6849928a3cb90efb86953b3f71f057
SHA512 fe87aa44e62868c1c0fce6cebe13054d852da51a5cc62da3d2a44efec96a30f00c713d8d8a5beeaf51bcf98f8d51eb9c337329995401729233a1331fc07300d0
TLSH
T19EF0D4871079D874A5D395DC186D866E7820A5F310F80611943C5AF424037EE5B07827
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 464f1d52d61dac8ec7f9aa1b7d07005f4ca871a65f1a00558fb0726c611aa9b5
MD5 4f51cf9460114d7f8653cc64c68487ee
SHA1 b0a92e7df169466c6ce3282433917ae48f54dfee
SHA512 87ddb097b19da5f6fa0770640688a304c6ce648162474e58e2c0363eee55109aa24ff2c296c62fa5e02a38e7eb924079e97a4a90982d50f6007ad6e8dfb0b40d
TLSH
T1FCE0C03411F6821EF9F4F4388BD47825855EF036252C92F42EC8DB0CB303900AC12E25
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\76M6ZWYJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/532-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/732-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/868-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1004-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1616-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2000-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3316-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3496-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3872-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4396-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4928-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads