221ccd2331a238dbb67c4881d97ba18baf415b17ec391b640de12806bfab2048

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe
Size 243KB
Sample260804-dj4f9st1a1
SHA256 221ccd2331a238dbb67c4881d97ba18baf415b17ec391b640de12806bfab2048
MD5 397699c6129c10b68091cf00ee4bb4eb
SHA1 9f1896a4be8660fd9502e3055079f74fadc4aaec
SHA512 0166a265b148ef4acb520e10f1a1078daedd17dc273160036a5a15c5b165076b6cba4ce817d0b8d31bbffe413ff1ba131813a9cd623f423e19517393b7f32099
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:dvMsLaOa3lLNngoqRttA7Y
TLSH
T158345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3188	CP.exe
4508	wrojgbztrl.exe
4560	CP.exe
2372	CP.exe
4000	i_wrojgbztrl.exe
4068	qljdbvtolg.sys
2416	CP.exe
804	geywqoigby.exe
2440	CP.exe
3420	CP.exe
1140	i_geywqoigby.exe
3116	gdywqoigay.sys
3356	CP.exe
4272	vtnlfdyvqo.exe
3168	CP.exe
4960	CP.exe
3524	i_vtnlfdyvqo.exe
1984	avtnlfdxvi.sys
1768	CP.exe
1252	igaysqkida.exe
4896	CP.exe
1844	CP.exe
2216	i_igaysqkida.exe
4620	qkicavsnlf.sys
460	CP.exe
1156	faxsqkausm.exe
3264	CP.exe
4360	CP.exe
2560	i_faxsqkausm.exe
1176	zxrpkhcaus.sys
3376	CP.exe
2088	spkicausmk.exe
4652	CP.exe
4000	CP.exe
4836	i_spkicausmk.exe
3812	rpkhcausmk.sys
2064	CP.exe
1132	kezxrpjhcz.exe
1328	CP.exe
2852	CP.exe
5080	i_kezxrpjhcz.exe
1824	mkecwupezw.sys
680	CP.exe
3152	wrmjebwuom.exe
2192	CP.exe
452	CP.exe
4116	i_wrmjebwuom.exe
4660	trmjecwuom.sys
1404	CP.exe
2552	jhtrljdbwt.exe
4840	CP.exe
4900	CP.exe
4152	i_jhtrljdbwt.exe
2560	dbwtomgeyw.sys
1988	CP.exe
1512	wrljdbvtol.exe
1032	CP.exe
1660	CP.exe
720	i_wrljdbvtol.exe
3736	vtolgdywqo.sys
3756	CP.exe
632	oigaytqljd.exe
1592	CP.exe
1672	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwjgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwjgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomhe.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3788	ipconfig.exe
3292	ipconfig.exe
3244	ipconfig.exe
3056	ipconfig.exe
4760	ipconfig.exe
2012	ipconfig.exe
1660	ipconfig.exe
4684	ipconfig.exe
992	ipconfig.exe
3456	ipconfig.exe
884	ipconfig.exe
556	ipconfig.exe
3456	ipconfig.exe
3336	ipconfig.exe
988	ipconfig.exe
1604	ipconfig.exe
4848	ipconfig.exe
888	ipconfig.exe
4760	ipconfig.exe
2112	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492577570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{08BC3286-8FB1-11F1-B03F-D2B4DCFC1B56} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa5016000000000200000000001066000000010000200000006916a104fc4e9be3fe5765b77f52a9d8b3579bdc93eead24308a92bb9d6bde97000000000e8000000002000020000000f1951d20b12e78df7771b020d9fda072a6b725dc321622e3a4312b7e979a9339200000006591344c8c864434ba39092a4d5fb8ae4c5dab0689e4539a6edfdbc29d753a21400000004345ef307e495edd54def2d3cb0251d895b63cd787a4dfba401e7da17b0bda24a1b7344f31a6d5a682cac9569da21b4c694d58a0b817b6d8bd2335bdfd081ce0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa501600000000020000000000106600000001000020000000742cbb411a92e717fa69d459c85be5257e78c159da1fee97328e980d312a5bf3000000000e800000000200002000000018ff7a05a4667aa95c9902c217d54b93f701bd55efe9fdaadebb4fc43a48d75b20000000ef22665b28673177431bebc366ec45ae86bca5afa33a9f2b21789d9d510c923e400000002fed76f86790338a31322b2cfea0bfc0625ed2fb3bdd7ccf3e0be1092aad770638af89aabd798012ec34550f8f3b97401c7565a5834a8e6093fbc736a5363e70	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05be43fc623dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c087eb3fc623dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	i_wrojgbztrl.exe
Token: SeDebugPrivilege	1140	i_geywqoigby.exe
Token: SeDebugPrivilege	3524	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	2216	i_igaysqkida.exe
Token: SeDebugPrivilege	2560	i_faxsqkausm.exe
Token: SeDebugPrivilege	4836	i_spkicausmk.exe
Token: SeDebugPrivilege	5080	i_kezxrpjhcz.exe
Token: SeDebugPrivilege	4116	i_wrmjebwuom.exe
Token: SeDebugPrivilege	4152	i_jhtrljdbwt.exe
Token: SeDebugPrivilege	720	i_wrljdbvtol.exe
Token: SeDebugPrivilege	4788	i_oigaytqljd.exe
Token: SeDebugPrivilege	1816	i_fdyvqnigay.exe
Token: SeDebugPrivilege	436	i_faqkicausn.exe
Token: SeDebugPrivilege	2260	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	2140	i_smkecwupmh.exe
Token: SeDebugPrivilege	4860	i_mjecwuomhe.exe
Token: SeDebugPrivilege	768	i_omgezwjgbz.exe
Token: SeDebugPrivilege	3848	i_gbztrljebw.exe
Token: SeDebugPrivilege	3816	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	3572	i_qlidbvtnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3976	iexplore.exe
3976	iexplore.exe
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3976	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	85
PID 3976 wrote to memory of 392	3976	iexplore.exe	86
PID 2420 wrote to memory of 3188	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	87
PID 4508 wrote to memory of 4560	4508	wrojgbztrl.exe	90
PID 2420 wrote to memory of 2372	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	93
PID 2420 wrote to memory of 2416	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	99
PID 804 wrote to memory of 2440	804	geywqoigby.exe	101
PID 2420 wrote to memory of 3420	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	104
PID 2420 wrote to memory of 3356	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	108
PID 4272 wrote to memory of 3168	4272	vtnlfdyvqo.exe	110
PID 2420 wrote to memory of 4960	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	113
PID 2420 wrote to memory of 1768	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	117
PID 1252 wrote to memory of 4896	1252	igaysqkida.exe	119
PID 2420 wrote to memory of 1844	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	122
PID 2420 wrote to memory of 460	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	128
PID 1156 wrote to memory of 3264	1156	faxsqkausm.exe	130
PID 2420 wrote to memory of 4360	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	133
PID 2420 wrote to memory of 3376	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	137
PID 2088 wrote to memory of 4652	2088	spkicausmk.exe	139
PID 2420 wrote to memory of 4000	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	142
PID 2420 wrote to memory of 2064	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	149
PID 1132 wrote to memory of 1328	1132	kezxrpjhcz.exe	151
PID 2420 wrote to memory of 2852	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	155
PID 2420 wrote to memory of 680	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	161
PID 3152 wrote to memory of 2192	3152	wrmjebwuom.exe	163
PID 2420 wrote to memory of 452	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	166
PID 2420 wrote to memory of 1404	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	170
PID 2552 wrote to memory of 4840	2552	jhtrljdbwt.exe	172
PID 2420 wrote to memory of 4900	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	175
PID 2420 wrote to memory of 1988	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	179
PID 1512 wrote to memory of 1032	1512	wrljdbvtol.exe	181
PID 2420 wrote to memory of 1660	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	184
PID 2420 wrote to memory of 3756	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	188
PID 632 wrote to memory of 1592	632	oigaytqljd.exe	190
PID 2420 wrote to memory of 1672	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	193
PID 2420 wrote to memory of 4952	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	197
PID 3332 wrote to memory of 4792	3332	fdyvqnigay.exe	199
PID 2420 wrote to memory of 2124	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	202
PID 2420 wrote to memory of 1980	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	206
PID 924 wrote to memory of 4824	924	faqkicausn.exe	208
PID 2420 wrote to memory of 3228	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	211
PID 2420 wrote to memory of 1808	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	215
PID 2740 wrote to memory of 4704	2740	ausmkfcxvp.exe	217
PID 2420 wrote to memory of 1176	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	220
PID 2420 wrote to memory of 720	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	222
PID 4632 wrote to memory of 3020	4632	smkecwupmh.exe	224
PID 2420 wrote to memory of 2164	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	227
PID 2420 wrote to memory of 3388	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	231
PID 3908 wrote to memory of 3256	3908	mjecwuomhe.exe	233
PID 2420 wrote to memory of 4872	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	236
PID 2420 wrote to memory of 212	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	240
PID 3396 wrote to memory of 4668	3396	omgezwjgbz.exe	242
PID 2420 wrote to memory of 4292	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	245
PID 2420 wrote to memory of 4964	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	249
PID 4576 wrote to memory of 2808	4576	gbztrljebw.exe	251
PID 2420 wrote to memory of 1656	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	254
PID 2420 wrote to memory of 4692	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	258
PID 656 wrote to memory of 2160	656	bvtnlgdywq.exe	260
PID 2420 wrote to memory of 4944	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	263
PID 2420 wrote to memory of 3812	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	267
PID 4024 wrote to memory of 2484	4024	qlidbvtnlf.exe	269
PID 2420 wrote to memory of 4780	2420	2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_397699c6129c10b68091cf00ee4bb4eb_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3976 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3188
- - C:\Temp\wrojgbztrl.exe
    C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2372
- - C:\Temp\i_wrojgbztrl.exe
    C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2416
- - C:\Temp\geywqoigby.exe
    C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Temp\i_geywqoigby.exe
    C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1768
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:460
- - C:\Temp\faxsqkausm.exe
    C:\Temp\faxsqkausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\i_faxsqkausm.exe
    C:\Temp\i_faxsqkausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4000
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kezxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Temp\kezxrpjhcz.exe
    C:\Temp\kezxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kezxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Temp\i_kezxrpjhcz.exe
    C:\Temp\i_kezxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrmjebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:680
- - C:\Temp\wrmjebwuom.exe
    C:\Temp\wrmjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrmjebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:452
- - C:\Temp\i_wrmjebwuom.exe
    C:\Temp\i_wrmjebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhtrljdbwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Temp\jhtrljdbwt.exe
    C:\Temp\jhtrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhtrljdbwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Temp\i_jhtrljdbwt.exe
    C:\Temp\i_jhtrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\wrljdbvtol.exe
    C:\Temp\wrljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\i_wrljdbvtol.exe
    C:\Temp\i_wrljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3756
- - C:\Temp\oigaytqljd.exe
    C:\Temp\oigaytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1672
- - C:\Temp\i_oigaytqljd.exe
    C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdyvqnigay.exe ups_run
  2⤵
  PID:4952
- - C:\Temp\fdyvqnigay.exe
    C:\Temp\fdyvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdyvqnigay.exe ups_ins
  2⤵
  PID:2124
- - C:\Temp\i_fdyvqnigay.exe
    C:\Temp\i_fdyvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faqkicausn.exe ups_run
  2⤵
  PID:1980
- - C:\Temp\faqkicausn.exe
    C:\Temp\faqkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faqkicausn.exe ups_ins
  2⤵
  PID:3228
- - C:\Temp\i_faqkicausn.exe
    C:\Temp\i_faqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run
  2⤵
  PID:1808
- - C:\Temp\ausmkfcxvp.exe
    C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
  2⤵
  PID:1176
- - C:\Temp\i_ausmkfcxvp.exe
    C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  PID:720
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  PID:2164
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  PID:3388
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomhe.exe ups_ins
  2⤵
  PID:4872
- - C:\Temp\i_mjecwuomhe.exe
    C:\Temp\i_mjecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwjgbz.exe ups_run
  2⤵
  PID:212
- - C:\Temp\omgezwjgbz.exe
    C:\Temp\omgezwjgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwjgbz.exe ups_ins
  2⤵
  PID:4292
- - C:\Temp\i_omgezwjgbz.exe
    C:\Temp\i_omgezwjgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljebw.exe ups_run
  2⤵
  PID:4964
- - C:\Temp\gbztrljebw.exe
    C:\Temp\gbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljebw.exe ups_ins
  2⤵
  PID:1656
- - C:\Temp\i_gbztrljebw.exe
    C:\Temp\i_gbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run
  2⤵
  PID:4692
- - C:\Temp\bvtnlgdywq.exe
    C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
  2⤵
  PID:4944
- - C:\Temp\i_bvtnlgdywq.exe
    C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run
  2⤵
  PID:3812
- - C:\Temp\qlidbvtnlf.exe
    C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
  2⤵
  PID:4780
- - C:\Temp\i_qlidbvtnlf.exe
    C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3572

C:\Temp\qljdbvtolg.sys
C:\Temp\qljdbvtolg.sys
1⤵
- Executes dropped EXE
PID:4068

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Temp\avtnlfdxvi.sys
C:\Temp\avtnlfdxvi.sys
1⤵
- Executes dropped EXE
PID:1984

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\zxrpkhcaus.sys
C:\Temp\zxrpkhcaus.sys
1⤵
- Executes dropped EXE
PID:1176

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
- Executes dropped EXE
PID:3812

C:\Temp\mkecwupezw.sys
C:\Temp\mkecwupezw.sys
1⤵
- Executes dropped EXE
PID:1824

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4660

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:2560

C:\Temp\vtolgdywqo.sys
C:\Temp\vtolgdywqo.sys
1⤵
- Executes dropped EXE
PID:3736

C:\Temp\vtnlxvqnif.sys
C:\Temp\vtnlxvqnif.sys
1⤵
PID:220

C:\Temp\nlfdxvqnig.sys
C:\Temp\nlfdxvqnig.sys
1⤵
PID:560

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
PID:656

C:\Temp\fzxrpjhurm.sys
C:\Temp\fzxrpjhurm.sys
1⤵
PID:1604

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
PID:100

C:\Temp\omgeywrojh.sys
C:\Temp\omgeywrojh.sys
1⤵
PID:4940

C:\Temp\igbytrljdb.sys
C:\Temp\igbytrljdb.sys
1⤵
PID:2604

C:\Temp\gdywqoigbq.sys
C:\Temp\gdywqoigbq.sys
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvi.sys

Path C:\Temp\avtnlfdxvi.sys
Size 141KB
SHA256 b1632bcaf4c27dcc3bbc4ce16dbde856e9cece13397d2373f9177d9779698412
MD5 8df723fea1c5365b9000d89ebb23f6eb
SHA1 f73ac1101e066a88ba8501b78eb94527215eee4d
SHA512 045e035ca11591b64896fb63cfa5dcd75913b1df73c7c3c0f1f1e1eea8c712554aec12e965930c5dec8bd7a0f87d92a9650de7d16bed959f07380cfb292d9fa7
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkausm.exe

Path C:\Temp\faxsqkausm.exe
Size 243KB
SHA256 32d2ae6f16d9a85ecce38236984cc3bb3328cc02fd9af34f00edc7ba51a8d76f
MD5 a07140c4b9d4e328bf0c7988527a969c
SHA1 c137f8baebd13a93caea17c678f7e235366e8798
SHA512 e36f8a98c82b976d218c28cb41c350d2bf6af027453ae917dd28566c70bf9f5db0728d1a48ef32b90cccf27b6cedc9ff3c709eb4e481095f1e87fde2b7770af5
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:kvMsLaOa3lLNngoqRttA7j
TLSH
T144345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.sys

Path C:\Temp\gdywqoigay.sys
Size 141KB
SHA256 a4d11fd656b62bfe08877a14281aed4bedcdd146bf53ce35b3e6961cb2cfec81
MD5 e17035cf11fa08c9c1982990586b51ac
SHA1 ddabc503acd35a4f2e85d08e71f802cbac03dd3b
SHA512 0bd76eb0fba0dcbf92c9a4261c7f4b325da0a59df15edc79e5521154c8a6cbf3a8de815872bf9f0a9a100f660d6f4b7208d99c8967572fc311dd486d39e237bf
SSDEEP 3072:GYa3rV3dZPFvOAngoRUAFa1nxayHdXkb:ta3lLNngoqRt
TLSH
T14EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 243KB
SHA256 cdb4198619f1fcae92c178991556055259995aebef0b8d6d87615e793b14a480
MD5 44978adb8196c15948182a4241f66d18
SHA1 3bbebd881f689c3f31e94cd7560f057dbf0e0c79
SHA512 06a2bc61538ef6f99b970f46302ae91904b3de4a473ece74ec85dff6f2499c683b4ff1f0a0406ec9916f40aa7006dfe6be7895b5893f88e30267c584b3604b1a
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:BvMsLaOa3lLNngoqRttA7A
TLSH
T1FB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkausm.exe

Path C:\Temp\i_faxsqkausm.exe
Size 243KB
SHA256 958ed872784607736db504e3eb6d06f1899999a5811e22bb40363315ea65a743
MD5 9efaa24b99cdace9930840d5d78b31d7
SHA1 779480fd5fe3cb834e31632d033fae890f948099
SHA512 eb44b70885aad5feefb05877835c12fcee36239cebbb0bc56d6a16841249a272004fb641f14d89a1d2ac24e1944ed9af5e85e0cbf0c8f1a427fe7cad1cf8928d
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:3vMsLaOa3lLNngoqRttA76
TLSH
T1EE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 243KB
SHA256 55f51da4a808175a94e398001001f0ef80a6071f54adf5f4112ef1de2ca8dfaf
MD5 8693fdbd47e0a76234dc543ea672d0ab
SHA1 d9292fc9e806b15e31ece727e9cad7f7123150cd
SHA512 adab44b9f6b020963111552f6e3371e63d5eb2330be328d76291ded845c58ddaf0c2dc4d5d44b28051f24db0c3a48ba5e8f1e94f6d8902a831b8627061a2a2e2
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:QvMsLaOa3lLNngoqRttA7H
TLSH
T100345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkida.exe

Path C:\Temp\i_igaysqkida.exe
Size 243KB
SHA256 7b0258591b55d553eb4cf3cae6b3cd21f30d6edc749738649d5d2bc955499692
MD5 b37e38955ba4ce3555fac6eefcdad89e
SHA1 c05b81975ad12d30bb693d739aa91d8ab7d47fdc
SHA512 6996394743145ee969c0a32d74056b3508dfdd304d0bd8f3b588bd6990ac4728e841614ebb2a06f2841cd5fa6710be4980200a5a07c2cd700dce25c705a0a38a
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:kvMsLaOa3lLNngoqRttA7D
TLSH
T1DE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kezxrpjhcz.exe

Path C:\Temp\i_kezxrpjhcz.exe
Size 243KB
SHA256 4a5d903d127640cc2423515c92709d7255deaf6378e7a0fe0baf2b69515a9cd6
MD5 0e4d129788c24fdddbd7db13757749a6
SHA1 9fee280000c684e53a63a828e1989dd94d0b3b8b
SHA512 4db15ddb6d938416df9361709a3f5b46d46f04e3e55a44c0f9dc7811946bdb9f45742c1dddc13d66fac2861c4d26628dbe9679abada21883354679e0e53b4005
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:UvMsLaOa3lLNngoqRttA7T
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausmk.exe

Path C:\Temp\i_spkicausmk.exe
Size 243KB
SHA256 ddcaf06e96c32ec5d2203b28c8f765d72ebd98cb1134ce3213d04021b87c6fd0
MD5 ecc48fde8b80ea94d30dcec714d76aa8
SHA1 2d17ebdce4c93c6729728b665703f0aab33d8db7
SHA512 c739abd7ff136a94fde01fed57897b6112a7913b6275bdce6c7b95a5f3d620ad69e6c775ecd0ac3f2a84536bfb53acecadf4152b5edab2f2dba621a83f11c9dc
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:CvMsLaOa3lLNngoqRttA7x
TLSH
T1E9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqo.exe

Path C:\Temp\i_vtnlfdyvqo.exe
Size 243KB
SHA256 4cbac6ca2f7ca07623adf5a089d6f02f15298f628b95a5181949bba18d30a2fe
MD5 58aadf93233ee378d219734a98e61cd6
SHA1 42d4d8adad92ec974e1a6dc91f7de18325e43124
SHA512 a6457efe33d2ee29439cc27e4f8ef8ac4cd6fc6bf0fbeab9c7a28039df6a87bbd3ad11f885f8de13db9c74eb29e60b5d9fb7748d7ca034c12b950192e7ffbb75
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:/vMsLaOa3lLNngoqRttA7i
TLSH
T11B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrmjebwuom.exe

Path C:\Temp\i_wrmjebwuom.exe
Size 243KB
SHA256 119f95aefff8d49a02c8fd440521ed5e5dc50c48716cdbd069d6aa9217d16f40
MD5 c51e7fceeeedb5c1aba7c0f761f54a19
SHA1 e2ea6cd233b54008283049910c6eed6bfedcc1f7
SHA512 52e1c85fdf3303af8b54abc06b0b357dbc9244f2c23bbd291642e0ee4a4b0c035a815581b44b0b40414abb20dd4ef0ac294b5849c864572af5408eacf70b4dd9
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:mvMsLaOa3lLNngoqRttA7R
TLSH
T19D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgbztrl.exe

Path C:\Temp\i_wrojgbztrl.exe
Size 243KB
SHA256 fc1a48295e3ab175283e2a5be819277e431b8dbefb53f2c273c26f157dfd1f0e
MD5 ae94465d81d85a6400efbb6ec5e90598
SHA1 b661a3c664248a5e179c59bc4597eaa0d37929f1
SHA512 ec717effca374a53ceeac8a4e0da7fd9f7d23613feee752cf0e3706608c644b94b48fd5972efd4c3b63519c9271d5264cfd0f18bee20615ab5998c0f05781705
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:dvMsLaOa3lLNngoqRttA7M
TLSH
T190345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.exe

Path C:\Temp\igaysqkida.exe
Size 243KB
SHA256 bf0ba835dc026f527d660e4ab66568bfb124458446783a1765e7bfe381958aba
MD5 ab091085af25758da91a39b4697b166e
SHA1 0762ee443e600e9fa95b6827a790f960928e1d79
SHA512 f400616f8807973651a57cf56ff659a35f765dc5c3bc5f0c9bbe8c4b3fee3050faee33069d69edfbde50cf53115434e1103b9e974e61773f91f827b2536d4c07
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:4vMsLaOa3lLNngoqRttA7T
TLSH
T1CD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kezxrpjhcz.exe

Path C:\Temp\kezxrpjhcz.exe
Size 243KB
SHA256 e2bb83da6c19fd37f5bb685e6397e49ff06e391f053359f7720450a2933611c2
MD5 5082624d78a75692a24a8a68c90bf5f5
SHA1 af7ccc7bd89dd5448eedf318215202e76d4f5b64
SHA512 f66cc686dd0f1005c3b01bdaf9cbb9d14e25e2b68b40329e7ab7efbf5caf4ace729f3bc794610d0a60ccafc83aea5af554dd1d9c4a3083015b3312501786dd9c
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:4vMsLaOa3lLNngoqRttA77
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupezw.sys

Path C:\Temp\mkecwupezw.sys
Size 141KB
SHA256 4b4ebdd47b6ef22a753956ba7e07fa408c93e2fa9afb0acf6b57e5cc385d80e7
MD5 f2263c9ef163304c945b79bc8e515731
SHA1 b4d415a2f942ff7ecb72af22333bbd6cb0f969cb
SHA512 c67243e64006cc6a2853f81f46edcbc42be735a5fdcf9eb259f440b43839a51ea39778167613aff61357319bd63fecf74f140e891e816d959b77825584fe2bf9
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19BE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.sys

Path C:\Temp\qkicavsnlf.sys
Size 141KB
SHA256 406b8dc7cb0e5e31c48880c43b0b6e0decd7c5974318b2d5a362195b119bbf01
MD5 845d42856786f0a9206ff79f37991e7d
SHA1 6270ad075c6fb59592b7a5555122a133d76df49a
SHA512 96657d3425290bae25f9b754d1f1f9006cea9c3d9348cfc2ee66c20f7b1aaecc0f11b312988c04505a5b3a95d5aaf8053f715b38d913d556539566666c3fc11a
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T157E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtolg.sys

Path C:\Temp\qljdbvtolg.sys
Size 141KB
SHA256 2cfa91dbf99ba12572d2721edc8b68db08a3cf6daa65c342b969f9763552bde2
MD5 22a60449ad3ea5259bf9cb4d3d056630
SHA1 4997d5a09ae3af7b19936b090f6348cf4160c1d9
SHA512 53e9c627e5eea9de05f74408e16ab76935776213fcec64a05b2b996b4e4f9ddfc458bd2489d068540eace8919f5893e382e249c6ec0f72e8aa8fb4e30084b466
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhcausmk.sys

Path C:\Temp\rpkhcausmk.sys
Size 141KB
SHA256 3fed73a0ff0fdcd27fc9cf9985116cbb0bbf8e7748a3ac9eff44e13b9b60ae57
MD5 8a97af7f27a1168664da22ca2deb07c9
SHA1 9ea3820678fe5f5d84bf5986dbcdd98cf90e9e4e
SHA512 5f90250a49c17cc42e3d949fea9da3717001b3ec66ec95d43477d4942a459883b747bb1ae19301acd95cb79f2a441fabf8a2f825155b8a482c6a1018d86bf9b7
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T174E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 243KB
SHA256 54f914e006900cdfc7808721dac0ad03b0cffd82fa3bcf2af7ea8f4b6260fea7
MD5 3f5a1c7d464be9dbc024779c810d7c0d
SHA1 dae64359239c260e2c7fb49c925cdece0b0101b0
SHA512 c870829d601d4bf9536888ea6d72d69b46f2400b311ad33c3edd09a6a677b8c2eeba1873fce5c4c527f95abc2148220c5bbc39a236788d6b8087497ec1e6ce0d
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:svMsLaOa3lLNngoqRttA7D
TLSH
T1D5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.exe

Path C:\Temp\vtnlfdyvqo.exe
Size 243KB
SHA256 5aa3b5849b33820c3cf4330791f7f87b43d41f4a3289e85334f5045c84ec4b16
MD5 f37992b3c385574f474898e5dc7e13fb
SHA1 a0d81336ad215d62a3d22b0f035b552c076c8c2e
SHA512 b7e00c61272f9cd49fb718f0c4cccf488b0cd57a90b93d5f284da3b9d7c60eb95d90b939a39acfdabba230989433ef99248085f37b727b33e9437ba507bb38ec
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:QvMsLaOa3lLNngoqRttA7H
TLSH
T14A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrmjebwuom.exe

Path C:\Temp\wrmjebwuom.exe
Size 243KB
SHA256 3a66726bcff438368d53ca7ab57e95ec506e8ddc4feeb0640749b883416dbd4f
MD5 e26e4ffc1d2a2ac70c7062aa02719adf
SHA1 a1910821cface3f90e925a15abe5ac21ee9f5257
SHA512 33b0456cdd4930a3696a19a17007bad3f0b339ee305d7a3681405d69347453e570488a57e67e8664c8044f6437dcc3cb8af3e752facc641a23677c9534678044
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:fvMsLaOa3lLNngoqRttA7y
TLSH
T1CD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbztrl.exe

Path C:\Temp\wrojgbztrl.exe
Size 243KB
SHA256 7aa5c5e13d45f03cc5789a000ae458adf534e1c0d0e0d8fba2071ac7c5899995
MD5 15613271e0e532f83d43bcb2b9b8c341
SHA1 f93b785f2d4f9f7e468dbfe225031e1c18052587
SHA512 bfc8d72ce2cd37e468ebf3333f71b8dfba25948b3221bd34f70a111b8f1d65007b5e9ed705b8244ba1afd4096d1acdb4fb7862a03cae6573a4cb9023c2910803
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:rvMsLaOa3lLNngoqRttA7+
TLSH
T107345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcaus.sys

Path C:\Temp\zxrpkhcaus.sys
Size 141KB
SHA256 45794b2e93035d7ac396a6b6cd97528a5b73e53478f53ac38347760f5f1b6957
MD5 cfbce785eb6ef9caf24d39c659533e2b
SHA1 1a8ca7b4a9b05836ea52ecdc2fae44e5d4af8fc7
SHA512 bf0436232cacc869b9165d508755bc5a71c16d899e5edaac3979aadfb361d923b95880b223809e33fcff545fb314de3c041b159563fc7cb7ff8be51195d21d79
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8GAU4O3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/220-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/560-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/656-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1176-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1604-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1824-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1984-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2560-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3736-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-89-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4068-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-100-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads