862a0590866f3f53113af18620b2dc63cb21be619ed80d3ce93d47d3e27c2c30

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
Size 243KB
Sample260813-2jrdpszdpg
SHA256 862a0590866f3f53113af18620b2dc63cb21be619ed80d3ce93d47d3e27c2c30
MD5 752cd3ce59addf977f937664fda4b0aa
SHA1 ca171a40f8c194959ae962eb2f50d15e73d81282
SHA512 1e35a89b26682a9889f7ebfc21816801f25ad1fdd77a100f70099700300fef1484aa42d19ef1a5742200e6e82b3fbcf581785b10b6a891195509625aacae3d9b
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:qvMsLaOa3lLNngoqRttA7B
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3740	CP.exe
1940	wuomhezwrp.exe
3836	CP.exe
5084	CP.exe
2060	i_wuomhezwrp.exe
1812	uomgezwroj.sys
4608	CP.exe
3452	jeywrojhbz.exe
692	CP.exe
4016	CP.exe
4384	i_jeywrojhbz.exe
3076	dbvtolgeyw.sys
2128	CP.exe
3172	wqojgbytrl.exe
1876	CP.exe
4704	CP.exe
2000	i_wqojgbytrl.exe
448	bvtnlgdywq.sys
1576	CP.exe
2968	lgaytqlidb.exe
4512	CP.exe
4220	CP.exe
2480	i_lgaytqlidb.exe
820	qlidavtnlf.sys
2080	CP.exe
1896	fdyvqoigay.exe
1108	CP.exe
2444	CP.exe
4088	i_fdyvqoigay.exe
4364	xvqnifaysq.sys
4820	CP.exe
3152	nhfaxsqkic.exe
2884	CP.exe
1220	CP.exe
1212	i_nhfaxsqkic.exe
5000	kicausnkfc.sys
4720	CP.exe
716	cxspkhcaus.exe
3180	CP.exe
5004	CP.exe
2624	i_cxspkhcaus.exe
2140	fzxrpkhcau.sys
4540	CP.exe
1396	jhczurmkec.exe
4992	CP.exe
1852	CP.exe
764	i_jhczurmkec.exe
400	usmkecwupm.sys
4684	CP.exe
5016	mhbzurmkec.exe
1628	CP.exe
4372	CP.exe
3340	i_mhbzurmkec.exe
3004	cwuomgezwr.sys
5020	CP.exe
816	rljebwuomg.exe
3516	CP.exe
1552	CP.exe
2164	i_rljebwuomg.exe
2944	ojgbztrljd.sys
3196	CP.exe
3336	wtomgeywqo.exe
2032	CP.exe
3832	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqlgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqlgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaytqlidb.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5000	ipconfig.exe
2072	ipconfig.exe
1468	ipconfig.exe
2904	ipconfig.exe
4296	ipconfig.exe
1708	ipconfig.exe
1312	ipconfig.exe
2368	ipconfig.exe
4456	ipconfig.exe
3928	ipconfig.exe
3760	ipconfig.exe
2316	ipconfig.exe
5108	ipconfig.exe
4796	ipconfig.exe
4308	ipconfig.exe
1700	ipconfig.exe
3592	ipconfig.exe
3356	ipconfig.exe
4592	ipconfig.exe
2284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271796"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7F9F831A-9767-11F1-9F3C-761C4632812C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1417223309"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208accb67c2bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000691180e858ae114f9f80788aa94d17f5000000000200000000001066000000010000200000006f77b3867b12fe722d7232f312f21f365fd501f3f64759aa3fc615a54e724d2a000000000e80000000020000200000008d0b18778996f1ba63a7f9c829b88d7fb27e67802d2be3ad736305ee92a4db0620000000d6b785aa2e1af0f4681cf8647f48b2723b79ebcdb37024cb041e6848cdf5d00b40000000993ec88ca8285c5aadeda4a37579f83d676abb407e5fa1cd2ccf144532d91ae5dcc44186b23d52a9f229bb588310b4b8b40ec2c30c7688c056ecdfa3338868cf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493425661"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271796"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000691180e858ae114f9f80788aa94d17f5000000000200000000001066000000010000200000006611721656a9c57b224c23bacadf1edd970c5e2c998f9ce688cefc5743abb324000000000e80000000020000200000007cf5757355add1c2d2a70163a8c1e8c6772d4f88a2bff073daed47ab4f60790520000000f0b3f7b304c1c74d9426959bece1af63b9cbb1d9da369333d893d8e49a943a9740000000d447346b333fc13e339ac3d47bed0c7b103a1c3f81ac0fceee970b61a0a1aec12aeecb9ad0d1d050ad29eedf36bfe0baaaf5af171935405b1a4b36e62a29b949	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1412535906"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b6d3b67c2bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	i_wuomhezwrp.exe
Token: SeDebugPrivilege	4384	i_jeywrojhbz.exe
Token: SeDebugPrivilege	2000	i_wqojgbytrl.exe
Token: SeDebugPrivilege	2480	i_lgaytqlidb.exe
Token: SeDebugPrivilege	4088	i_fdyvqoigay.exe
Token: SeDebugPrivilege	1212	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	2624	i_cxspkhcaus.exe
Token: SeDebugPrivilege	764	i_jhczurmkec.exe
Token: SeDebugPrivilege	3340	i_mhbzurmkec.exe
Token: SeDebugPrivilege	2164	i_rljebwuomg.exe
Token: SeDebugPrivilege	4640	i_wtomgeywqo.exe
Token: SeDebugPrivilege	1632	i_dyvqlgaytq.exe
Token: SeDebugPrivilege	4980	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	1756	i_nlfdxvpnif.exe
Token: SeDebugPrivilege	2644	i_icausnkfdx.exe
Token: SeDebugPrivilege	4932	i_xrpjhczusm.exe
Token: SeDebugPrivilege	4144	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	4736	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	4384	i_jebwrojgbz.exe
Token: SeDebugPrivilege	2688	i_dywqoigbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4660	iexplore.exe
4660	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4660	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	87
PID 4660 wrote to memory of 1984	4660	iexplore.exe	88
PID 5040 wrote to memory of 3740	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	89
PID 1940 wrote to memory of 3836	1940	wuomhezwrp.exe	92
PID 5040 wrote to memory of 5084	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	95
PID 5040 wrote to memory of 4608	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	100
PID 3452 wrote to memory of 692	3452	jeywrojhbz.exe	102
PID 5040 wrote to memory of 4016	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	105
PID 5040 wrote to memory of 2128	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	114
PID 3172 wrote to memory of 1876	3172	wqojgbytrl.exe	116
PID 5040 wrote to memory of 4704	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	122
PID 5040 wrote to memory of 1576	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	126
PID 2968 wrote to memory of 4512	2968	lgaytqlidb.exe	128
PID 5040 wrote to memory of 4220	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	131
PID 5040 wrote to memory of 2080	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	137
PID 1896 wrote to memory of 1108	1896	fdyvqoigay.exe	139
PID 5040 wrote to memory of 2444	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	142
PID 5040 wrote to memory of 4820	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	146
PID 3152 wrote to memory of 2884	3152	nhfaxsqkic.exe	148
PID 5040 wrote to memory of 1220	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	151
PID 5040 wrote to memory of 4720	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	155
PID 716 wrote to memory of 3180	716	cxspkhcaus.exe	157
PID 5040 wrote to memory of 5004	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	160
PID 5040 wrote to memory of 4540	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	164
PID 1396 wrote to memory of 4992	1396	jhczurmkec.exe	166
PID 5040 wrote to memory of 1852	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	169
PID 5040 wrote to memory of 4684	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	173
PID 5016 wrote to memory of 1628	5016	mhbzurmkec.exe	175
PID 5040 wrote to memory of 4372	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	178
PID 5040 wrote to memory of 5020	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	182
PID 816 wrote to memory of 3516	816	rljebwuomg.exe	184
PID 5040 wrote to memory of 1552	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	188
PID 5040 wrote to memory of 3196	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	192
PID 3336 wrote to memory of 2032	3336	wtomgeywqo.exe	194
PID 5040 wrote to memory of 3832	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	197
PID 5040 wrote to memory of 2120	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	201
PID 972 wrote to memory of 5012	972	dyvqlgaytq.exe	203
PID 5040 wrote to memory of 3300	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	206
PID 5040 wrote to memory of 2036	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	210
PID 3500 wrote to memory of 3324	3500	bvtnlfdyvq.exe	212
PID 5040 wrote to memory of 4208	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	215
PID 5040 wrote to memory of 3992	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	219
PID 820 wrote to memory of 2852	820	nlfdxvpnif.exe	221
PID 5040 wrote to memory of 4148	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	224
PID 5040 wrote to memory of 1828	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	228
PID 1996 wrote to memory of 1800	1996	icausnkfdx.exe	230
PID 5040 wrote to memory of 3420	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	233
PID 5040 wrote to memory of 4772	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	239
PID 4204 wrote to memory of 2232	4204	xrpjhczusm.exe	241
PID 5040 wrote to memory of 4760	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	244
PID 5040 wrote to memory of 4392	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	248
PID 1716 wrote to memory of 2988	1716	zxrpkhcaus.exe	250
PID 5040 wrote to memory of 5028	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	253
PID 5040 wrote to memory of 3040	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	257
PID 1700 wrote to memory of 1636	1700	rpjhbzurmk.exe	259
PID 5040 wrote to memory of 884	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	262
PID 5040 wrote to memory of 4200	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	266
PID 3496 wrote to memory of 2148	3496	jebwrojgbz.exe	268
PID 5040 wrote to memory of 1836	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	271
PID 5040 wrote to memory of 2948	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	275
PID 3076 wrote to memory of 4996	3076	dywqoigbyt.exe	277
PID 5040 wrote to memory of 4488	5040	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	280

C:\Users\Admin\AppData\Local\Temp\2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4660 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3740
- - C:\Temp\wuomhezwrp.exe
    C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5084
- - C:\Temp\i_wuomhezwrp.exe
    C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\jeywrojhbz.exe
    C:\Temp\jeywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4016
- - C:\Temp\i_jeywrojhbz.exe
    C:\Temp\i_jeywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2128
- - C:\Temp\wqojgbytrl.exe
    C:\Temp\wqojgbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\i_wqojgbytrl.exe
    C:\Temp\i_wqojgbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaytqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1576
- - C:\Temp\lgaytqlidb.exe
    C:\Temp\lgaytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaytqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\i_lgaytqlidb.exe
    C:\Temp\i_lgaytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2080
- - C:\Temp\fdyvqoigay.exe
    C:\Temp\fdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2444
- - C:\Temp\i_fdyvqoigay.exe
    C:\Temp\i_fdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxspkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4720
- - C:\Temp\cxspkhcaus.exe
    C:\Temp\cxspkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxspkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5004
- - C:\Temp\i_cxspkhcaus.exe
    C:\Temp\i_cxspkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\jhczurmkec.exe
    C:\Temp\jhczurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1852
- - C:\Temp\i_jhczurmkec.exe
    C:\Temp\i_jhczurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\mhbzurmkec.exe
    C:\Temp\mhbzurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4372
- - C:\Temp\i_mhbzurmkec.exe
    C:\Temp\i_mhbzurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5020
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\wtomgeywqo.exe
    C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3832
- - C:\Temp\i_wtomgeywqo.exe
    C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqlgaytq.exe ups_run
  2⤵
  PID:2120
- - C:\Temp\dyvqlgaytq.exe
    C:\Temp\dyvqlgaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqlgaytq.exe ups_ins
  2⤵
  PID:3300
- - C:\Temp\i_dyvqlgaytq.exe
    C:\Temp\i_dyvqlgaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlfdyvq.exe ups_run
  2⤵
  PID:2036
- - C:\Temp\bvtnlfdyvq.exe
    C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
  2⤵
  PID:4208
- - C:\Temp\i_bvtnlfdyvq.exe
    C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run
  2⤵
  PID:3992
- - C:\Temp\nlfdxvpnif.exe
    C:\Temp\nlfdxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
  2⤵
  PID:4148
- - C:\Temp\i_nlfdxvpnif.exe
    C:\Temp\i_nlfdxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run
  2⤵
  PID:1828
- - C:\Temp\icausnkfdx.exe
    C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins
  2⤵
  PID:3420
- - C:\Temp\i_icausnkfdx.exe
    C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  PID:4772
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhcaus.exe ups_run
  2⤵
  PID:4392
- - C:\Temp\zxrpkhcaus.exe
    C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
  2⤵
  PID:5028
- - C:\Temp\i_zxrpkhcaus.exe
    C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  PID:3040
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  PID:884
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwrojgbz.exe ups_run
  2⤵
  PID:4200
- - C:\Temp\jebwrojgbz.exe
    C:\Temp\jebwrojgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwrojgbz.exe ups_ins
  2⤵
  PID:1836
- - C:\Temp\i_jebwrojgbz.exe
    C:\Temp\i_jebwrojgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run
  2⤵
  PID:2948
- - C:\Temp\dywqoigbyt.exe
    C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins
  2⤵
  PID:4488
- - C:\Temp\i_dywqoigbyt.exe
    C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2688

C:\Temp\uomgezwroj.sys
C:\Temp\uomgezwroj.sys
1⤵
- Executes dropped EXE
PID:1812

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:3076

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:448

C:\Temp\qlidavtnlf.sys
C:\Temp\qlidavtnlf.sys
1⤵
- Executes dropped EXE
PID:820

C:\Temp\xvqnifaysq.sys
C:\Temp\xvqnifaysq.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:2140

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:400

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:3004

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
PID:432

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:4352

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:4136

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:2368

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
PID:2620

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
PID:1120

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:3240

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
PID:4088

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.sys

Path C:\Temp\bvtnlgdywq.sys
Size 141KB
SHA256 42ce10c907f46a786a7aa7c8e41a25f78b55bf051bc15eefe3402ef6e39fb3c1
MD5 77bc116423b464a6226b559674aecd65
SHA1 e5601337bfd1d8717f7c6462cc67e64614f0b825
SHA512 28615de7f2950d0f67b44ad41c579d3ece832ae3f263b8547dad336166db4d0fbc9e18f87990c106b06d8501a2804a4029c9c4dcd8e8b718ccadfe51c7389582
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxspkhcaus.exe

Path C:\Temp\cxspkhcaus.exe
Size 243KB
SHA256 d7c7d072bc8d2e7d2821b0d9f497f11aa0ce0de8e0c62640bc0122730353317b
MD5 350982d2f3be9dc8a1ffbe9389ed20cf
SHA1 f3d24a14f1a2351e5d214aaa39617793fae971d1
SHA512 c30e1d222c49e50ba737a5c8fe8ae3541cee66bb413e88b14b5335081f7ae75efcb98216d7e19f2737286901ae95bb37dfc3b6640b49b78e390c9a70dcb6bb2e
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:lvMsLaOa3lLNngoqRttA7k
TLSH
T13C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.sys

Path C:\Temp\dbvtolgeyw.sys
Size 141KB
SHA256 3fc623f0a6c0d4122e28a3df1d31401142469c4b911fe2e5b59d60f4ba161248
MD5 e2aeca69037318df2108254516cb4745
SHA1 369e7e6de030e9ee2891f646c59d422e5c049ada
SHA512 a6d8ca1fa237db12f080f9a2504c74aa453f1b062a7f88fc8f9ecd001406bc9648bccb4b5642c9e45a51ac7b30bcb3ee9a29eff7d6e65a06f8207165c7767bc1
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.exe

Path C:\Temp\fdyvqoigay.exe
Size 243KB
SHA256 5592905f13c8bab18ec6788f41f6dc26aeea318e57ebd7d9fcf3fa6698d4f321
MD5 34e771c14b11a70ea7cee2cd4287e970
SHA1 5d1db11b07b155e775eec0a75abc5fd3b6788fb1
SHA512 86d13e56842078027f2f7af42cf78d627f8612b4023202715129574d4dd7c7c4aff5b1346200af590451ed29e720d28f2ff55f84f8e14ec38a1b6f36c7c7570f
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:9vMsLaOa3lLNngoqRttA7k
TLSH
T1F5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcau.sys

Path C:\Temp\fzxrpkhcau.sys
Size 141KB
SHA256 55f6aadaf11c12c4d2b4253a17f1aba2779e5ef74efeec25ff84b28229889536
MD5 40aa62083d80ed85a099b347d2b0d0bd
SHA1 2585bde840f8a9cbd92679a991959042d754b212
SHA512 4d043539767af4447be2bb925f614423356cbdeff74918423ad4782099a94d497f5fa12fedee394f10241d59d4a2adc583723977830ca312b630b26544db4170
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T103E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxspkhcaus.exe

Path C:\Temp\i_cxspkhcaus.exe
Size 243KB
SHA256 1f1a277dfdd9b6fa7a3aad22b3176584fe711560d4d6b20aa2b6f686c06ef788
MD5 8b1069c83f5e5b51ff489f10873ed20d
SHA1 ad5dc8e9cedfcb1d8c5ef6d4107cd15e25a49e5a
SHA512 0a3558e9d9f932a5865558e9942c3e9ce68a638e3c90f7bf3d60f1dedd7a87aa9951bd883d27a94c67c84863ed5e3d474f5a5f9c8cc2e7964953a1288519e422
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:NvMsLaOa3lLNngoqRttA7k
TLSH
T148345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdyvqoigay.exe

Path C:\Temp\i_fdyvqoigay.exe
Size 243KB
SHA256 207a861e4a2552d3e16c558994c7b988696599149f52c0b66f491a4c21e34cfb
MD5 b3313ff4fcc03c43ba216f9c157008ea
SHA1 82c812c31724101006aa00d724a84e5fc6460903
SHA512 d6d4a4308338be8f4ea92640d93005ab949c52ed90459c50a417b18c9add66e62a5d9073d4784d3e10cb54a7a07b1525e95d27800e0d511025afc4035a8280d6
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:KvMsLaOa3lLNngoqRttA7d
TLSH
T1DA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jeywrojhbz.exe

Path C:\Temp\i_jeywrojhbz.exe
Size 243KB
SHA256 3a69bc3e0cd11110b3c0d6ee9c31c0aaefa1d97615cb7baba1eb5c8dfe12326d
MD5 8bf54667750679e8e699fe46f22e6a8f
SHA1 206782ae9fe0a54a549dc60790c8b214fc9ee164
SHA512 5d8739f65e9c7bd55be980178e43f6d07c933e1922cf790eba37bda0ade2d43a39c1d895237e69bd9fc759488c9b9dac087e64b0a4acf979cfbc7a876cbb6101
SSDEEP 3072:JCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:0vMsLaOa3lLNngoqRttA7X
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgaytqlidb.exe

Path C:\Temp\i_lgaytqlidb.exe
Size 243KB
SHA256 7db3782ae34d7e682f042615af8722a4caa964e5b38dc30ff4ffc79b48847f15
MD5 d8aa6661e5a1e2be47517cfa16b5b8ba
SHA1 6af8791bf166a6099cdc28e4e56109ae25dde690
SHA512 4e41554aa206a13955d605d2f7ff5db8945784b21139857bb96cdc6d2bad8377417154066e48eae2ed61d6fa4ba4ba643aee7e277f3d9c0279e17aac92160293
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:xvMsLaOa3lLNngoqRttA7Y
TLSH
T11B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxsqkic.exe

Path C:\Temp\i_nhfaxsqkic.exe
Size 243KB
SHA256 00455a371edc3d2d7646f790edd1714277ac00d98d5e648cb9d07dba7746d1eb
MD5 a6b56afcbb59d6b724c43bc47b27355d
SHA1 332c0fc14e2c71770b55293502e6fc561515c972
SHA512 2cba21697643f1b636ef7443a518bb6ff44c1631ec79f995b55f68eeab14fb2d5cb9bd0c521f875c6c6eb576e4f2cec8dd6abddfc8836328abb997ad1324c98a
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:7vMsLaOa3lLNngoqRttA7O
TLSH
T193345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbytrl.exe

Path C:\Temp\i_wqojgbytrl.exe
Size 243KB
SHA256 3f5e5acf8a874514054055fa269fa2013288b9c2790884c9e8e838c572b62505
MD5 6e28d52afac61e4ee8a574c0bfa2857d
SHA1 21b85ab5387cddff1c417f4d22db43fe86ad1d97
SHA512 3121ec173f06a5be4319acbd201ce3ec0ef1b66dedc8174f7a5a0493beaf76f22ab3e464480458f729883a30dd64de7fc799f464880fc18c298d396f7da8a68d
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:fvMsLaOa3lLNngoqRttA7O
TLSH
T14C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomhezwrp.exe

Path C:\Temp\i_wuomhezwrp.exe
Size 243KB
SHA256 6a2b7412d76cac9be6dbbdfbabcc2059a71583a9f9b50b7ae902e24562db8b76
MD5 b9972d2c9b2c460dd1fc83f6bbfc5ff6
SHA1 5f02470194613e609d0b73b6bb563556ffd33e49
SHA512 57bef25266744fc12976479f458d17b0772d541b8e8904d22d64168aaf997718451fbc06621387ec31690560a48f0177e165313fa2cc8cea5b98b11873ca6d19
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:MvMsLaOa3lLNngoqRttA7v
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeywrojhbz.exe

Path C:\Temp\jeywrojhbz.exe
Size 243KB
SHA256 e374a365e597fcf2b596aada855ea0d6b89bfc5e82c459f56b689fca7479c02c
MD5 2c4e5bce11ed0251966c9959e09045dc
SHA1 25338747020456db9d7bc98cf6cb59d2acf1fe0b
SHA512 a55f9fa8f3cfe37dde55aa975c6e6225cd5aa41f9e5c1560d1a89f8e602dd9c80abfb6d16c40ecdf1b2e0de73e075878722b2fa23f8ddb631fd9c47f40e991a5
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:tvMsLaOa3lLNngoqRttA7o
TLSH
T15B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczurmkec.exe

Path C:\Temp\jhczurmkec.exe
Size 243KB
SHA256 37149a7961595b9e1f99b5aa2b3c3b8e8584442bdf933194f2858fbaf784577f
MD5 701209190143241011aa6c659385c1dc
SHA1 965cf5a853286481a46fd934b2d6a3f3af90a4e3
SHA512 ffaea61158ffa09e2f1cfbbe070b6725e4da5114462d36ff588c4e3f34d87ce2c816316c82c6d50b89e39e4369bb0c763bc692fa26633f8be78cde7a438adb4d
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:OvMsLaOa3lLNngoqRttA7h
TLSH
T1ED345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfc.sys

Path C:\Temp\kicausnkfc.sys
Size 141KB
SHA256 34116994a4be02d9cf0dc532fd401362a9c5fe6cf4b774f546abb5e67ad5a8a8
MD5 ea63e3cbace0a90772fc087adaf89f46
SHA1 cf3ac09c8f46afbc920c97a99b848570c0c6d865
SHA512 8491f258b5c535514562f795627e23b5855e1405765bdb397f55dd0f83c2cc034e6bdaa16d683a1a724ec8e0f4b76dda8ccabcd7f682a425dbb32d8a9cc7887b
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaytqlidb.exe

Path C:\Temp\lgaytqlidb.exe
Size 243KB
SHA256 0b49d74c88923030d567c98ebbcc9fcedf294e487041d071054591b4e57f2ceb
MD5 50424b13c702a0f83b0ec8a7ffdccbe1
SHA1 228b44f5176ae0b1c9b887b9f0106188b87f16e5
SHA512 a25c91c0239e8b4fb9322d50b979f558320752209b75f0f3a62256d64fae0c29975745ac8f27cbf5b3b08a6baff50ff1fc6f22b7ca188e0efcbab8a3d2e91bbd
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:AvMsLaOa3lLNngoqRttA7r
TLSH
T1F5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxsqkic.exe

Path C:\Temp\nhfaxsqkic.exe
Size 243KB
SHA256 2091f8a96bba567e1aeed4e89b8e1ab7a14f01803c979083dfee0674d794cbc0
MD5 d368054b8bbbced03462e3b2148ac6a2
SHA1 0300d120be343ffa96fc2d1117e3335197023fb4
SHA512 00ba5748c1a81bdbae3a456e3804ace2cdd0011fa8907725114823e0432f8884897f1dbb0396425c1c78c4293995568bb54011b169ffb5e3c8c91a610a4de030
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:RvMsLaOa3lLNngoqRttA7o
TLSH
T13E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidavtnlf.sys

Path C:\Temp\qlidavtnlf.sys
Size 141KB
SHA256 a89aacdb7dcbdf2b495228f5cb97f182c8a618b4140a431b4a05ae8e5a3d92f2
MD5 1bfec49d3b363adf8f2a8116b22a3e82
SHA1 6f051f9265ad6e43cfc99c23c491d48f714ef681
SHA512 b9adbd62490ca353f38c1b25ce00b84d7a57a0bcb3e85d5b953fae38a4a3ae9954ca24d7f371bc088c6eb3fb0a34fbfcd7cfe0279e524232578ba28e291688a8
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B9E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwroj.sys

Path C:\Temp\uomgezwroj.sys
Size 141KB
SHA256 840e7a22ef946b01949b8c439ddb9b49efa48f44c3b47a51ca54d7b22e5a9d3f
MD5 d50c56db5abd0463cc5158d036a01c72
SHA1 cba15d411851232bdb2cff87c488e62005c6d986
SHA512 680e8cfc8343b0740a2ab4130a31d2350ec0b4d3b42006015c85b8a2550780726846836c3cbcbfd377c01be06ef0f108c710257680568ed0398e63ec76bfbe7d
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbytrl.exe

Path C:\Temp\wqojgbytrl.exe
Size 243KB
SHA256 2e4de14ef825ba995232972d476a386d9a88381aca01cede64cf7f9519af455c
MD5 d15b20198e3e60c012acc658a2ba220c
SHA1 8b003d01c891ce3fe94da44e33b67720e772fe60
SHA512 965766527eca0ee522ccd08789226119dc2c4d8fdcff58bd02d360fff8e27c6203bfb666ffdd9f14d17f57b16c97d2a5939e7bfec60462f39837fceb0d261a7b
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:dvMsLaOa3lLNngoqRttA7M
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwrp.exe

Path C:\Temp\wuomhezwrp.exe
Size 243KB
SHA256 7a253251c8873a1217b28a308cc2b1a6024e903cd1c4d0bed437e2ec14393269
MD5 deaffd69675dbd3985b009d57236c660
SHA1 c7cc8e8c49609c1f10ac337b19af8667db2192d3
SHA512 3bbdef86c7782ca6d67babc80ae9caee96b2530c86bbc48cf6e3451fb53338c5307c959d0bb55fb9ae098da038214fcefcfcdce51320a956b7f8bdf7624f448c
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:pvMsLaOa3lLNngoqRttA7E
TLSH
T10D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnifaysq.sys

Path C:\Temp\xvqnifaysq.sys
Size 141KB
SHA256 8fe94d02ae5ec382a9d736fd03f90b4f818994209f33d49ab63236e14e7ee3aa
MD5 be338a25a5d15bb04c16be93500518b7
SHA1 566a921f04b9db9a7cfdf41cc75a072b87ee333a
SHA512 2d8e8b4295a6e7b74371d649376d626b2988c42710dd6a491fe9508765d418ad9026d2938f26fa1c034f1ad6263dbff87aedab5ac830c63b4b4d764454ff1577
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 5dd94b6e0f0764c8e4259c55588c099aa6ef35bda1018834e6088e98d898d636
MD5 04ed5e38005370f960f3625321825e6f
SHA1 d9d52f46c2622b0f2ce5ec29c903e204dfb88f95
SHA512 1927edea62a70b781a438f656bd9cff3e49f14b99d8e850d1eceb8c97291f560ce3da37dd05fbff0c0e072c64a5eef804de91ced887fb4a2add046a480b98b6b
TLSH
T1A9F0D49380F896601C5184ED345D06BD3030D27264A71025E03D85618D1137DD75AA35
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 17760fdeefe315e0e57550bb6b2436ffb49c024a51b34ca0052ade47e92ac9cf
MD5 f364cbd16128ecdab1048ccd6769c160
SHA1 b51b6799652ac4e4f214ecfca3859cb2f08a5422
SHA512 bea2e19d70e24a8ae7a648c9fbb92e285071b097c1eb217531a1355e6d13532e199582d1534d4bbbb5156234e1dfde0013cb818d7d85077551c8a630eb5afaed
TLSH
T1E3E0C02421FA511FF5E5E4364BDA7421559AF026063993B429C49B04B70E600AC03D2D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/432-115-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/448-39-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/820-56-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1120-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1812-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1812-27-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2140-94-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2620-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2944-111-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3076-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3240-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4088-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4364-70-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4528-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-82-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads