754aa00aa0cd4e967970dc04627f11374b43c2ca2efc9f0ebd0cd993e7eabbec

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
Size 243KB
Sample260809-sb2d9szgla
SHA256 754aa00aa0cd4e967970dc04627f11374b43c2ca2efc9f0ebd0cd993e7eabbec
MD5 09765b084adb153e15b779ed9ecd1eee
SHA1 9cf829f8dcfc21d28234f8a1caf52a202f8b15cf
SHA512 bc027ad191dc4418b7cab7f76871d69955eec4a87396685d6247d85204e77fed50406ebeb02bd42a0e21b0bcce2cee08d0fc578a3998882b7d241174bf0a0f6a
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:fvMsLaOa3lLNngoqRttA7e
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2872	CP.exe
3960	kwupmhezxr.exe
4492	CP.exe
4332	CP.exe
2740	i_kwupmhezxr.exe
1964	omhezxrpjh.sys
1324	CP.exe
1332	hczurmhezx.exe
1204	CP.exe
1292	CP.exe
2856	i_hczurmhezx.exe
2248	uomgezwroj.sys
4536	CP.exe
2656	jdbwtomgey.exe
4720	CP.exe
1140	CP.exe
2180	i_jdbwtomgey.exe
4840	bvtolgeywq.sys
1312	CP.exe
2584	tojgbytrlj.exe
3780	CP.exe
4168	CP.exe
3920	i_tojgbytrlj.exe
3500	vtolgeywqo.sys
800	CP.exe
4132	dbvtnlfdyv.exe
4684	CP.exe
2740	CP.exe
1788	i_dbvtnlfdyv.exe
2124	dyvqoigayt.sys
3772	CP.exe
3492	snlfdxvqni.exe
1724	CP.exe
4380	CP.exe
4616	i_snlfdxvqni.exe
1492	ifaxsqkica.sys
2200	CP.exe
4784	avsnlfdxvp.exe
3020	CP.exe
4056	CP.exe
3744	i_avsnlfdxvp.exe
2180	sqkfcxvpnh.sys
1836	CP.exe
3888	hcausmkecx.exe
4580	CP.exe
4068	CP.exe
1916	i_hcausmkecx.exe
3232	kfcxupnhfz.sys
904	CP.exe
3312	rmkecwupmh.exe
3228	CP.exe
4484	CP.exe
4596	i_rmkecwupmh.exe
1016	zusmkecwup.sys
4516	CP.exe
4652	pjhbzurmke.exe
2124	CP.exe
2344	CP.exe
3640	i_pjhbzurmke.exe
920	jhbztrmjeb.sys
3604	CP.exe
1568	bwuomgezwr.exe
1492	CP.exe
4576	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqofdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqofdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1176	ipconfig.exe
4320	ipconfig.exe
2856	ipconfig.exe
2624	ipconfig.exe
3324	ipconfig.exe
4624	ipconfig.exe
3276	ipconfig.exe
4672	ipconfig.exe
3284	ipconfig.exe
4716	ipconfig.exe
2604	ipconfig.exe
3676	ipconfig.exe
5024	ipconfig.exe
3992	ipconfig.exe
3992	ipconfig.exe
5008	ipconfig.exe
2188	ipconfig.exe
3512	ipconfig.exe
4692	ipconfig.exe
1488	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa5016000000000200000000001066000000010000200000008d498cd0c650acb56234d12a482025cbb386f8d2b48ee3df34184044f09b978d000000000e80000000020000200000000fd72bf7b10bc7f17ff07169e974312f55675e652c7d4864e6541ba00f65859820000000e578b71545d22f6e3162ba66cbf8aa36afbd1361b41569ee31d84457b6c4280a40000000fdb2521e6ec0ce317adafba813321c1f36d8676640c8f70b5cc1fed2d98c0f506e606fbe2afd607863e834d8696aa12c816af82136e0ef590af5a4ed2777b081	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270927"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493052450"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2588461721"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103825f11728dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B3E75869-9402-11F1-B03F-C24FA7D2CAFF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270927"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2445649255"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa501600000000020000000000106600000001000020000000e522375306d5448e623bdb76171fdabae870c53c62a4a65b02379cced39d55c1000000000e8000000002000020000000e9859430225fe604274c47fdbe45ddc4ba28f2f50c97586a91d586e7e8a4ecbe20000000f9001d1110a2d983e88b587631b41792dfb52603c941c346595ba40dda9233c6400000000f1b52bd422ad57cb5f5afe135f8d7abe71eca6095a049fd2b8e9e28aad752152aafcadff51970cd40596574f9b4ce4f11b207f99948ed2f0f9eac007eb68f82	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00642cf11728dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	i_kwupmhezxr.exe
Token: SeDebugPrivilege	2856	i_hczurmhezx.exe
Token: SeDebugPrivilege	2180	i_jdbwtomgey.exe
Token: SeDebugPrivilege	3920	i_tojgbytrlj.exe
Token: SeDebugPrivilege	1788	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4616	i_snlfdxvqni.exe
Token: SeDebugPrivilege	3744	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	1916	i_hcausmkecx.exe
Token: SeDebugPrivilege	4596	i_rmkecwupmh.exe
Token: SeDebugPrivilege	3640	i_pjhbzurmke.exe
Token: SeDebugPrivilege	3296	i_bwuomgezwr.exe
Token: SeDebugPrivilege	1212	i_lgeywqoigb.exe
Token: SeDebugPrivilege	1196	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	2264	i_ywqofdyvqo.exe
Token: SeDebugPrivilege	3936	i_pnifaysqki.exe
Token: SeDebugPrivilege	3472	i_fzxspkicau.exe
Token: SeDebugPrivilege	888	i_ausmkecxup.exe
Token: SeDebugPrivilege	2492	i_rpjhczurmk.exe
Token: SeDebugPrivilege	2176	i_ecwuomhezw.exe
Token: SeDebugPrivilege	440	i_trljdbwtom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4660	iexplore.exe
4660	iexplore.exe
4188	IEXPLORE.EXE
4188	IEXPLORE.EXE
4188	IEXPLORE.EXE
4188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4660	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	85
PID 4660 wrote to memory of 4188	4660	iexplore.exe	86
PID 1980 wrote to memory of 2872	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	88
PID 3960 wrote to memory of 4492	3960	kwupmhezxr.exe	91
PID 1980 wrote to memory of 4332	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	94
PID 1980 wrote to memory of 1324	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	102
PID 1332 wrote to memory of 1204	1332	hczurmhezx.exe	104
PID 1980 wrote to memory of 1292	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	108
PID 1980 wrote to memory of 4536	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	114
PID 2656 wrote to memory of 4720	2656	jdbwtomgey.exe	116
PID 1980 wrote to memory of 1140	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	119
PID 1980 wrote to memory of 1312	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	123
PID 2584 wrote to memory of 3780	2584	tojgbytrlj.exe	125
PID 1980 wrote to memory of 4168	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	128
PID 1980 wrote to memory of 800	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	133
PID 4132 wrote to memory of 4684	4132	dbvtnlfdyv.exe	135
PID 1980 wrote to memory of 2740	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	138
PID 1980 wrote to memory of 3772	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	142
PID 3492 wrote to memory of 1724	3492	snlfdxvqni.exe	144
PID 1980 wrote to memory of 4380	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	147
PID 1980 wrote to memory of 2200	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	151
PID 4784 wrote to memory of 3020	4784	avsnlfdxvp.exe	153
PID 1980 wrote to memory of 4056	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	156
PID 1980 wrote to memory of 1836	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	160
PID 3888 wrote to memory of 4580	3888	hcausmkecx.exe	162
PID 1980 wrote to memory of 4068	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	165
PID 1980 wrote to memory of 904	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	169
PID 3312 wrote to memory of 3228	3312	rmkecwupmh.exe	171
PID 1980 wrote to memory of 4484	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	174
PID 1980 wrote to memory of 4516	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	178
PID 4652 wrote to memory of 2124	4652	pjhbzurmke.exe	180
PID 1980 wrote to memory of 2344	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	183
PID 1980 wrote to memory of 3604	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	188
PID 1568 wrote to memory of 1492	1568	bwuomgezwr.exe	190
PID 1980 wrote to memory of 4576	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	194
PID 1980 wrote to memory of 1300	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	198
PID 2596 wrote to memory of 3200	2596	lgeywqoigb.exe	200
PID 1980 wrote to memory of 1168	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	203
PID 1980 wrote to memory of 552	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	207
PID 3128 wrote to memory of 1320	3128	ytqljdbvtn.exe	209
PID 1980 wrote to memory of 3004	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	212
PID 1980 wrote to memory of 1400	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	216
PID 1592 wrote to memory of 5044	1592	ywqofdyvqo.exe	218
PID 1980 wrote to memory of 2588	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	221
PID 1980 wrote to memory of 3592	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	225
PID 4552 wrote to memory of 1704	4552	pnifaysqki.exe	227
PID 1980 wrote to memory of 3328	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	230
PID 1980 wrote to memory of 2140	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	234
PID 4060 wrote to memory of 4560	4060	fzxspkicau.exe	236
PID 1980 wrote to memory of 2156	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	239
PID 1980 wrote to memory of 2624	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	243
PID 4128 wrote to memory of 176	4128	ausmkecxup.exe	245
PID 1980 wrote to memory of 5100	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	248
PID 1980 wrote to memory of 4012	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	252
PID 1328 wrote to memory of 4328	1328	rpjhczurmk.exe	254
PID 1980 wrote to memory of 4200	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	257
PID 1980 wrote to memory of 680	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	261
PID 4324 wrote to memory of 5028	4324	ecwuomhezw.exe	263
PID 1980 wrote to memory of 4756	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	266
PID 1980 wrote to memory of 808	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	270
PID 4804 wrote to memory of 920	4804	trljdbwtom.exe	272
PID 1980 wrote to memory of 3508	1980	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	275

C:\Users\Admin\AppData\Local\Temp\2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4660 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kwupmhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2872
- - C:\Temp\kwupmhezxr.exe
    C:\Temp\kwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kwupmhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\i_kwupmhezxr.exe
    C:\Temp\i_kwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\hczurmhezx.exe
    C:\Temp\hczurmhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\i_hczurmhezx.exe
    C:\Temp\i_hczurmhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4536
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1140
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tojgbytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Temp\tojgbytrlj.exe
    C:\Temp\tojgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tojgbytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\i_tojgbytrlj.exe
    C:\Temp\i_tojgbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2740
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\snlfdxvqni.exe
    C:\Temp\snlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\i_snlfdxvqni.exe
    C:\Temp\i_snlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Temp\avsnlfdxvp.exe
    C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4056
- - C:\Temp\i_avsnlfdxvp.exe
    C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1836
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4068
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:904
- - C:\Temp\rmkecwupmh.exe
    C:\Temp\rmkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_rmkecwupmh.exe
    C:\Temp\i_rmkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\pjhbzurmke.exe
    C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\i_pjhbzurmke.exe
    C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3604
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  PID:1300
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  PID:1168
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  PID:552
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  PID:3004
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqofdyvqo.exe ups_run
  2⤵
  PID:1400
- - C:\Temp\ywqofdyvqo.exe
    C:\Temp\ywqofdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqofdyvqo.exe ups_ins
  2⤵
  PID:2588
- - C:\Temp\i_ywqofdyvqo.exe
    C:\Temp\i_ywqofdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  PID:3592
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  PID:3328
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  PID:2140
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  PID:2156
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:2624
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:5100
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurmk.exe ups_run
  2⤵
  PID:4012
- - C:\Temp\rpjhczurmk.exe
    C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurmk.exe ups_ins
  2⤵
  PID:4200
- - C:\Temp\i_rpjhczurmk.exe
    C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezw.exe ups_run
  2⤵
  PID:680
- - C:\Temp\ecwuomhezw.exe
    C:\Temp\ecwuomhezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezw.exe ups_ins
  2⤵
  PID:4756
- - C:\Temp\i_ecwuomhezw.exe
    C:\Temp\i_ecwuomhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  PID:808
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  PID:3508
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:440

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:1964

C:\Temp\uomgezwroj.sys
C:\Temp\uomgezwroj.sys
1⤵
- Executes dropped EXE
PID:2248

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\vtolgeywqo.sys
C:\Temp\vtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\dyvqoigayt.sys
C:\Temp\dyvqoigayt.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\sqkfcxvpnh.sys
C:\Temp\sqkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:2180

C:\Temp\kfcxupnhfz.sys
C:\Temp\kfcxupnhfz.sys
1⤵
- Executes dropped EXE
PID:3232

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:1016

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
PID:3460

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:1488

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
PID:4700

C:\Temp\avsnlfdxvq.sys
C:\Temp\avsnlfdxvq.sys
1⤵
PID:3640

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:4208

C:\Temp\pnhfaxsqki.sys
C:\Temp\pnhfaxsqki.sys
1⤵
PID:3980

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:2892

C:\Temp\rmhezwrpjh.sys
C:\Temp\rmhezwrpjh.sys
1⤵
PID:2056

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdxvp.exe

Path C:\Temp\avsnlfdxvp.exe
Size 243KB
SHA256 a2c98d8c3da930e401788bfae76c5e9d0a88b540afc4f04b5d9d910485fc9a22
MD5 656c130aee772b130c04865fb189ecb8
SHA1 14965fce78b49dc3680f2eff49a4909aa405af01
SHA512 df65811ec88b055ab344bfb462a6b53e08184724279dff2a41ccb76be740115030f5cd294cfd883c5274f103c5ee1574dddb38128b066c7beb6cdc89c4b6bb2b
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:lvMsLaOa3lLNngoqRttA7s
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 141KB
SHA256 ade2914138eb3db3fbfcf139f14baa77e055a8fd1c931c45d9c6b7c3c894ab7c
MD5 64d9e5f724445608ea309eef8ecd13d6
SHA1 3583178029c73c56cf7e4386d83da80a8c4ca75f
SHA512 58f8b724abd1fbadcfaae3fefe33a2b21711a9d0d28ff6e42a0054129931b6a9f1dea26d9a0f7541548c0fede642c17e46839652445580b86c9503cd73cae2da
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 243KB
SHA256 30c84310afa4223c0a37e4764987138d473351ba8470d5fa666060d945fb4c8f
MD5 5a65d8728557458594be5f612f90448b
SHA1 f91ea91246972a4a283dd7786aa673a1feb25cc3
SHA512 752c4577b766234b630cc7be268b8160e4375e12790f411af31db732e3e58be86c14159e6b9689c07ea3fcb784845f064117bdeaba58fdf78102f79ecbed08df
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:OvMsLaOa3lLNngoqRttA7x
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigayt.sys

Path C:\Temp\dyvqoigayt.sys
Size 141KB
SHA256 230f218aaf5ae49233e2364fe01c0468020c3eed86aad313887f510df649711c
MD5 c11969b73cdecb3e383d9e5141fd5803
SHA1 0a0f3f405b131b34685e03c7bf39f98554052781
SHA512 01c5e15b2b0ed75fc7e31f843fa80c0c970c909f19acbc3e94be870ffaf31388871a061993f2c7fb455ee416855716671dd39d989fa27e87df9bc2190c736b6f
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.exe

Path C:\Temp\hcausmkecx.exe
Size 243KB
SHA256 02fe19989f0707098a05fea3b5196baadbb0e327095ca975f03436564c939b5e
MD5 66116ea5394e8a177cdbe92e0f8b18db
SHA1 34e38e399288a8e478016509d06f728d2433c55c
SHA512 7cc6ba196349e95d3c4843a8f89c0cf027fe5c339e2dd54cbe1d11b2e6befde5d25c3d646fd495d4f6825183fc289347cb3819238ca0d58c2b59bcf13740c28e
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:ovMsLaOa3lLNngoqRttA7D
TLSH
T125345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmhezx.exe

Path C:\Temp\hczurmhezx.exe
Size 243KB
SHA256 fe3ca53c8b192211041e12d74029b602ab201e034a5b6ac940f4a057b2585bd3
MD5 e38df880b35b7770089247b6af3aefaa
SHA1 a2a83dcd7753f556e28266a2c0968a0e41bf2920
SHA512 e8c802686c5971db83a08cbad39f4495c91290116dda3c8b29013adfe9e1715a6230e4fe94ef590beb05dc15b2919d688a8c7018b802811db733aafa4b5dbb8c
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:SvMsLaOa3lLNngoqRttA7Z
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdxvp.exe

Path C:\Temp\i_avsnlfdxvp.exe
Size 243KB
SHA256 edea4f3e3742f9455151eacb8793883050e9b4b99ac306da6aa01a2f3b3bd828
MD5 c5bec247411c1c1df3269fcb37c20790
SHA1 00dbe97c353fe904b51e12b66e2e12723992e3c0
SHA512 81eac0b389c8f22fd2af07c79991347ad46f9201e6ebfe81a0ced907a9736f711cd61710d2ab85df767543f3c706bbb2c9d45958452c6e0c30cf716a0cefef06
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:1vMsLaOa3lLNngoqRttA7s
TLSH
T162345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 243KB
SHA256 69c76e9d08bbb073d5954edccff6b842e496cfe0203665f604f3004958012fd9
MD5 72c604ee9c717d69f0bc3da2444dabf8
SHA1 ddc86838cc303c845b4e3104a75efc0302644c99
SHA512 04a1e30e13b0d36d38739f585b45dfe01fe3f7b3bbba4313e74bbc475ddb729c5a4a9909202c2a37c5d1e931056c4e36b9b792c989a6b6532aa8f223c60ec41c
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:ZvMsLaOa3lLNngoqRttA7w
TLSH
T117345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcausmkecx.exe

Path C:\Temp\i_hcausmkecx.exe
Size 243KB
SHA256 6eff616fff2b5e54096ed240fcaa063735eabc6ebf857b33e17e3ba2f8787da9
MD5 c48156d2ba8158bea330e125202fe8e1
SHA1 66d744a2306b7647348836e3116587ca1096a9b5
SHA512 b431d769c018e9349096dff559eea565d98ade935687d6a2c1cf4d908c55eef36b13efcdf5264b9e5247f27d2b70a37613ed569760aa66d1bb917f87dfb8eef7
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:PvMsLaOa3lLNngoqRttA7q
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczurmhezx.exe

Path C:\Temp\i_hczurmhezx.exe
Size 243KB
SHA256 6b17d6337d91f9a0a992fd025fc9ce09f3fdb7f9f7f14bae338c3882d04a2135
MD5 ab35d3b72998b550142bfbfae6914c42
SHA1 9c0bce244aa66f4ab864cb6df33ee656c0d6fd67
SHA512 a5f67ba041412b015570f82600b981c2e97648d90273dcef76d57c33f6d2f8f08e2a3fae9b7f6ef033db4e7b0f00bb30d418aecb182fb7db85ca8ec59c300cc3
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:RvMsLaOa3lLNngoqRttA7Y
TLSH
T108345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwtomgey.exe

Path C:\Temp\i_jdbwtomgey.exe
Size 243KB
SHA256 dd567d62894f5be9a6a9886dcea58e165e0b748341b17222941512ac6cd0c8f0
MD5 d0b692b7939284a892bcd130863d5589
SHA1 29838d25c31f4b1d554a8cafcc145326198b6f6f
SHA512 8f8017a4f79c2bb170521d5755f4084a2adb4fae7cb30d9dcc2e6d346ee641009e67324f09159b8de84d27717f049e6f72660728b0a168dee2d5c1ef31b1c316
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:BvMsLaOa3lLNngoqRttA7Q
TLSH
T19E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kwupmhezxr.exe

Path C:\Temp\i_kwupmhezxr.exe
Size 243KB
SHA256 312231d757ec62bc48043ce1301b430fd75cf6749c8bfc8134aa2e7b464a9ef6
MD5 4351b62a9265599343bfd59bef734104
SHA1 6424c7dc9b773c2c1c99f4702b601b09442aa432
SHA512 c4786fc299656344e9d3490145bd2eaf72ade2870d8fe6b94ac47173143439a20637531df75878aa6432351d7a57ce720b8ea6a50702c6396e5be92823628f1c
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:mvMsLaOa3lLNngoqRttA71
TLSH
T1C9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvqni.exe

Path C:\Temp\i_snlfdxvqni.exe
Size 243KB
SHA256 87a8c08910329ba063f17ccccfd7d430fcfa1a28105daed517978b55d1d64c7c
MD5 91da098dc602773183998fc5de59f4ed
SHA1 e5b20ee3e5bb6e801c8574aa68c314bdb423c39e
SHA512 c6fd65e1ecd52b28d4e573ca7ffbf1540654fc2dda2ef988429181bc27fb5dca4d9fcd8418d6bf66415d1fb6218731bb576c1402386612df5745b8a08ced650f
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:7vMsLaOa3lLNngoqRttA7e
TLSH
T19B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tojgbytrlj.exe

Path C:\Temp\i_tojgbytrlj.exe
Size 243KB
SHA256 c6d4b7998024206e6abd9d9a61aa8da7ab874bed7963dc114ee2dcd7517012b0
MD5 c470a6ef650b9f98e192219d5c24421a
SHA1 caa24b0b4bff4ce3a4332bc045db26b17d8ab2e2
SHA512 8dbffd7d82fc7a77e8ae19123c58bb1b47124d8745172a572a67a793fb7d6b3c77d818ee8e58ae67d44b3f3cb9ce2bc9c4e38e5fadf8cc6a4b96c3e5b3822be1
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:MvMsLaOa3lLNngoqRttA7b
TLSH
T106345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.sys

Path C:\Temp\ifaxsqkica.sys
Size 141KB
SHA256 92aa2e90299dceb558f80ae5f77bb82ee75203b347c876a9cb03ff728c99fcf1
MD5 4486c24a6392b9ab4e007dbfec8d54e1
SHA1 25937470d763e7fc0b2b055f03f217b3accf7a93
SHA512 758a8a194b116549d3fc346a6013872187aef3cf1d72d0334bca59d7a604aef7c1298f1ee5d5510ebb91fcd9c17f935dd6d6072c632acb1eca5d5599f9f3cbe8
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.exe

Path C:\Temp\jdbwtomgey.exe
Size 243KB
SHA256 d87e59ca038e2c602909e18124a3fa3309693d5312a7797864689e40b8e47c1f
MD5 54858f8e2dc4518b8cbd24c4d41c2346
SHA1 1c44c6b1f1a5686f18b9ca455798a2c61d980223
SHA512 1660b14b3a66595c091f20f26c433c921c5d284c0b7e7a0e22893e71d6779ab81b4c13e23a5e806bbe58553a91bad4ee8ca6ef16e8687933b08fb24ffdd07ebc
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:uvMsLaOa3lLNngoqRttA7x
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwupmhezxr.exe

Path C:\Temp\kwupmhezxr.exe
Size 243KB
SHA256 50f54b123ad465ffc4b762eaf6e754dec977335c08ab60a67583072c1f3f0063
MD5 622ff418014270431cf6f71cdf027da0
SHA1 5394bc170e4d16297dc2bc5646d958816d7c46bd
SHA512 c938f383f5a13423891ea080e040f4cd0de2230cf56a92d07de4974cb45d6682d6b05f146595f3a9eb7bb498e0dd7e54f4136ef30dc2ca4c9f09fc2707799aaf
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:TvMsLaOa3lLNngoqRttA7u
TLSH
T1C5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 c442f86476fb9d2e4ba0e866bc2209cf34fa17523ddb162b3b0c73db7399ba98
MD5 171ef7e63b31553632c47bf50fa0ad47
SHA1 390192f84e2fca3335a4736db455010a03b24cc3
SHA512 4792a033c8216d1c0793da17ca1bd1f1406e65c3f00e1c79ce0e9d38c071b08284f510da2a70f871555695e6f145230e8b6a84520b416e08adfc230ed2e4f692
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvqni.exe

Path C:\Temp\snlfdxvqni.exe
Size 243KB
SHA256 c22651d0b1f442dd114b7e49d28750274f0503214816ad1bcf9722552912b45b
MD5 d8d2a7d3a00dc174517585f1bbadbf73
SHA1 f733ab75383155ee14ae881b3cae8b08d7512c4a
SHA512 1950c1763f339e0a41c5734c511dcc9912740d1dc6a82a2cee222514bb446b863b288d93047080f7da664f55dfcabe861c54c0e3fa043d383cfecba35c7bc5c3
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:OvMsLaOa3lLNngoqRttA7J
TLSH
T1B5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkfcxvpnh.sys

Path C:\Temp\sqkfcxvpnh.sys
Size 141KB
SHA256 7a83fd42994d60b6c8a9fcf682aba8109a65194877b7e5a0271abc8a0c26a9e6
MD5 a0df0831fdf8642d7e816459f70f5876
SHA1 9f492d74d65abb80e74e798b05362a518e17fb48
SHA512 0e8adba3ee607235f25acc1dc821f04e5e17092fc2bf3a4e4f0d26275a90901c584294c49473162b03956d1297b349fe3b30ef3ef4bf853192f47851466678bf
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tojgbytrlj.exe

Path C:\Temp\tojgbytrlj.exe
Size 243KB
SHA256 6f3cf7d00969662c3af7fd577c58b445064be3f26b21e6f30978bc475519efb7
MD5 87836c9e18a814cbdc30d1e6cdbebf6f
SHA1 9880c7c025a63484ada51ec3e3b60cc68e9bfce3
SHA512 1753cee6bf6be59c2d252febbd9a2691552e34b2417ca58485af0a70d8657f84021858892028d64d4227534fb8129325ca9125a1caa919f94953a8f221cc76ab
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:ZvMsLaOa3lLNngoqRttA7I
TLSH
T1A7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwroj.sys

Path C:\Temp\uomgezwroj.sys
Size 141KB
SHA256 4d54ff5e572483eec2e0d0f1ef12a51094a80e01a3efb8b54ba838004a09add4
MD5 239ba637d9a3d58d2660c0f9c5dc3030
SHA1 1647c0d890a9bf0f4f1b9cf4b1ae0b294a1e4950
SHA512 2b1928f54975b0aba134e6e0297c283cc6f8a69cc6ead2bfdf3010e71404da1aadc5d4ac67556735f69af4317739e84ac32930d1e86261f2942808b2a1df307d
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqo.sys

Path C:\Temp\vtolgeywqo.sys
Size 141KB
SHA256 6d409feb8476a226bc2310d27562fd50621b0be5accc74a39460d82d70ed9620
MD5 5b80ac06934b3ad52e9b654151e86c0e
SHA1 502728e976949dec7325a46dd26d5a374556624a
SHA512 24c43e863fb495c518e71b2f63b3e196a9408d58f2bbbdf8f8481e5d7a8ddae99cab9b0f5a17bfbdcce54bc4a1fda02ceac3ee454c1c69a7fe5bdfb683b11cff
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8GAU4O3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1016-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1488-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1964-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2056-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-62-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2180-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2180-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2248-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2892-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3232-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3460-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3640-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3980-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4700-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads