462bf1592e77743abe337a494bc8ca03146deaaa5bcaa0b4fd7fcdd6b63cfb9c

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
Size 243KB
Sample260817-ymmcdayclc
SHA256 462bf1592e77743abe337a494bc8ca03146deaaa5bcaa0b4fd7fcdd6b63cfb9c
MD5 1fee8c43ccc6c326180d53e78fa365ad
SHA1 f3e91ce1f0e54e99062f525068c2b76ce6182cdb
SHA512 c59ce6799a22378464eeddcc3ddae09e317743b363c7c4cff782eb8a131414ec4d2db11d5878b02690123c57654391f3f57a8d908ada7d1f08296f27e9cc48f2
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:SvMsLaOa3lLNngoqRttA7h
TLSH
T163345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1724	CP.exe
3376	rljeywrojg.exe
3520	CP.exe
3936	CP.exe
2912	i_rljeywrojg.exe
2736	ytrljdbwto.sys
308	CP.exe
100	oigbytqlgd.exe
4904	CP.exe
1596	CP.exe
632	i_oigbytqlgd.exe
4472	lgdyvqoiga.sys
4196	CP.exe
2124	avtnlfdyvq.exe
4964	CP.exe
4420	CP.exe
4324	i_avtnlfdyvq.exe
1236	dyvqoigayt.sys
1448	CP.exe
4812	kfdxvqkida.exe
4124	CP.exe
3912	CP.exe
4616	i_kfdxvqkida.exe
2620	nkfdxvpnhf.sys
4836	CP.exe
4608	faxsqkicav.exe
4664	CP.exe
4180	CP.exe
4804	i_faxsqkicav.exe
4436	xspkicausm.sys
2244	CP.exe
64	mkfcxupnhf.exe
3356	CP.exe
2776	CP.exe
3476	i_mkfcxupnhf.exe
1160	jhczusmkec.sys
1772	CP.exe
2216	zxrpjhbzur.exe
4396	CP.exe
3248	CP.exe
3728	i_zxrpjhbzur.exe
4856	ecwuomhezx.sys
3288	CP.exe
3228	pjhbzurmge.exe
2888	CP.exe
3516	CP.exe
3836	i_pjhbzurmge.exe
4504	rmgeywrojh.sys
4784	CP.exe
3976	gbztrmjeuo.exe
3752	CP.exe
3840	CP.exe
1680	i_gbztrmjeuo.exe
4628	bztrljebwt.sys
1592	CP.exe
4368	toigbytrlj.exe
3164	CP.exe
1228	CP.exe
4588	i_toigbytrlj.exe
1132	qlidbvtnlf.sys
4316	CP.exe
4692	gdywqoigay.exe
4924	CP.exe
1236	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrmjeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrmjeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaqkic.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4600	ipconfig.exe
4316	ipconfig.exe
564	ipconfig.exe
3932	ipconfig.exe
176	ipconfig.exe
2976	ipconfig.exe
2372	ipconfig.exe
2052	ipconfig.exe
516	ipconfig.exe
2876	ipconfig.exe
1776	ipconfig.exe
2748	ipconfig.exe
3852	ipconfig.exe
696	ipconfig.exe
2760	ipconfig.exe
3160	ipconfig.exe
4104	ipconfig.exe
2064	ipconfig.exe
3080	ipconfig.exe
4220	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048a572a37dca2843b14acb706ebcae4d00000000020000000000106600000001000020000000ff0242966743d9287a24963c66c48ea2cbdf7fe8819efe6779fb7cbcd2e395c3000000000e8000000002000020000000e592f015c639dfd19128f4de2bfc6dc17b9e069e6889044188a15bd7216557ba200000008df89117294831a272766f57064d65558d5c9a5423d03a6bdc5e3b5fbb8c36c940000000112bb05f460ab69ed34dd2e3a67a0914fed71d23375c15bcb1b7aa2ee9441b3ffd6a9a98cc8039650b3bf0ba5f1663337cdc70cf3d26217e9312c3711ca731df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1585466824"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b036a4a58a2edd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048a572a37dca2843b14acb706ebcae4d00000000020000000000106600000001000020000000914f2cc81fff07b1f975440511a4671be00674ec900a2c58eeb379365ce01303000000000e800000000200002000000028753c8369cc11392756a219b67d459db17fcb3510a3502057d931fe96dc1f00200000008e720287e2eb21c375c03208f02a646e34accaf963976e20e3f4d91a3f0825864000000017d7a9cbf24f54b268678af6b05313e48b911560c485dc92a89d3b4bbf5ca6db01bca918bd11ebf2bfdc8a01a006c55911aea28200cfc0f8d26b8d7fb8da52a4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a062aba58a2edd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31272578"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493761436"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6EB28031-9A75-11F1-B03F-D2B4DCFC1B56} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	i_rljeywrojg.exe
Token: SeDebugPrivilege	632	i_oigbytqlgd.exe
Token: SeDebugPrivilege	4324	i_avtnlfdyvq.exe
Token: SeDebugPrivilege	4616	i_kfdxvqkida.exe
Token: SeDebugPrivilege	4804	i_faxsqkicav.exe
Token: SeDebugPrivilege	3476	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	3728	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	3836	i_pjhbzurmge.exe
Token: SeDebugPrivilege	1680	i_gbztrmjeuo.exe
Token: SeDebugPrivilege	4588	i_toigbytrlj.exe
Token: SeDebugPrivilege	2160	i_gdywqoigay.exe
Token: SeDebugPrivilege	4948	i_sqkidavsnl.exe
Token: SeDebugPrivilege	2432	i_vpnifaqkic.exe
Token: SeDebugPrivilege	628	i_nicausmkfc.exe
Token: SeDebugPrivilege	3604	i_usmkecwupm.exe
Token: SeDebugPrivilege	2284	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	4888	i_jhbztrmjeb.exe
Token: SeDebugPrivilege	4500	i_ytrljdbwto.exe
Token: SeDebugPrivilege	1808	i_ytrljdbvto.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4344	iexplore.exe
4344	iexplore.exe
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4344	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	85
PID 4344 wrote to memory of 392	4344	iexplore.exe	86
PID 4372 wrote to memory of 1724	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	87
PID 3376 wrote to memory of 3520	3376	rljeywrojg.exe	90
PID 4372 wrote to memory of 3936	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	93
PID 4372 wrote to memory of 308	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	99
PID 100 wrote to memory of 4904	100	oigbytqlgd.exe	101
PID 4372 wrote to memory of 1596	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	104
PID 4372 wrote to memory of 4196	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	112
PID 2124 wrote to memory of 4964	2124	avtnlfdyvq.exe	114
PID 4372 wrote to memory of 4420	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	118
PID 4372 wrote to memory of 1448	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	124
PID 4372 wrote to memory of 3912	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	129
PID 4372 wrote to memory of 4836	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	134
PID 4608 wrote to memory of 4664	4608	faxsqkicav.exe	136
PID 4372 wrote to memory of 4180	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	139
PID 4372 wrote to memory of 2244	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	143
PID 64 wrote to memory of 3356	64	mkfcxupnhf.exe	145
PID 4372 wrote to memory of 2776	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	148
PID 4372 wrote to memory of 1772	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	152
PID 2216 wrote to memory of 4396	2216	zxrpjhbzur.exe	154
PID 4372 wrote to memory of 3248	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	157
PID 4372 wrote to memory of 3288	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	161
PID 3228 wrote to memory of 2888	3228	pjhbzurmge.exe	163
PID 4372 wrote to memory of 3516	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	166
PID 4372 wrote to memory of 4784	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	170
PID 3976 wrote to memory of 3752	3976	gbztrmjeuo.exe	172
PID 4372 wrote to memory of 3840	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	175
PID 4372 wrote to memory of 1592	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	179
PID 4368 wrote to memory of 3164	4368	toigbytrlj.exe	181
PID 4372 wrote to memory of 1228	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	184
PID 4372 wrote to memory of 4316	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	189
PID 4692 wrote to memory of 4924	4692	gdywqoigay.exe	191
PID 4372 wrote to memory of 1236	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	194
PID 4372 wrote to memory of 2092	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	198
PID 4900 wrote to memory of 2836	4900	sqkidavsnl.exe	200
PID 4372 wrote to memory of 2712	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	203
PID 4372 wrote to memory of 3920	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	207
PID 4140 wrote to memory of 1680	4140	vpnifaqkic.exe	209
PID 4372 wrote to memory of 2736	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	212
PID 4372 wrote to memory of 4416	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	216
PID 212 wrote to memory of 544	212	nicausmkfc.exe	218
PID 4372 wrote to memory of 3916	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	221
PID 4372 wrote to memory of 1988	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	225
PID 1176 wrote to memory of 2112	1176	usmkecwupm.exe	227
PID 4372 wrote to memory of 1032	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	230
PID 4372 wrote to memory of 4116	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	235
PID 2352 wrote to memory of 336	2352	ezxrpjhczu.exe	237
PID 4372 wrote to memory of 516	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	240
PID 4372 wrote to memory of 3524	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	244
PID 2552 wrote to memory of 4844	2552	jhbztrmjeb.exe	246
PID 4372 wrote to memory of 4620	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	249
PID 4372 wrote to memory of 4628	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	253
PID 2760 wrote to memory of 4756	2760	ytrljdbwto.exe	255
PID 4372 wrote to memory of 740	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	258
PID 4372 wrote to memory of 2140	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	262
PID 1328 wrote to memory of 680	1328	ytrljdbvto.exe	264
PID 4372 wrote to memory of 1456	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	267
PID 4372 wrote to memory of 2340	4372	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	269
PID 4112 wrote to memory of 3572	4112	gaysqkidav.exe	271

C:\Users\Admin\AppData\Local\Temp\2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4344 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljeywrojg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724
- - C:\Temp\rljeywrojg.exe
    C:\Temp\rljeywrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljeywrojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3936
- - C:\Temp\i_rljeywrojg.exe
    C:\Temp\i_rljeywrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytqlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:308
- - C:\Temp\oigbytqlgd.exe
    C:\Temp\oigbytqlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytqlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Temp\i_oigbytqlgd.exe
    C:\Temp\i_oigbytqlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Temp\avtnlfdyvq.exe
    C:\Temp\avtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\i_avtnlfdyvq.exe
    C:\Temp\i_avtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1448
- - C:\Temp\kfdxvqkida.exe
    C:\Temp\kfdxvqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3912
- - C:\Temp\i_kfdxvqkida.exe
    C:\Temp\i_kfdxvqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\faxsqkicav.exe
    C:\Temp\faxsqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Temp\i_faxsqkicav.exe
    C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3248
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3288
- - C:\Temp\pjhbzurmge.exe
    C:\Temp\pjhbzurmge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3516
- - C:\Temp\i_pjhbzurmge.exe
    C:\Temp\i_pjhbzurmge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrmjeuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4784
- - C:\Temp\gbztrmjeuo.exe
    C:\Temp\gbztrmjeuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrmjeuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\i_gbztrmjeuo.exe
    C:\Temp\i_gbztrmjeuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toigbytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1592
- - C:\Temp\toigbytrlj.exe
    C:\Temp\toigbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toigbytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1228
- - C:\Temp\i_toigbytrlj.exe
    C:\Temp\i_toigbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4316
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnl.exe ups_run
  2⤵
  PID:2092
- - C:\Temp\sqkidavsnl.exe
    C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnl.exe ups_ins
  2⤵
  PID:2712
- - C:\Temp\i_sqkidavsnl.exe
    C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaqkic.exe ups_run
  2⤵
  PID:3920
- - C:\Temp\vpnifaqkic.exe
    C:\Temp\vpnifaqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaqkic.exe ups_ins
  2⤵
  PID:2736
- - C:\Temp\i_vpnifaqkic.exe
    C:\Temp\i_vpnifaqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nicausmkfc.exe ups_run
  2⤵
  PID:4416
- - C:\Temp\nicausmkfc.exe
    C:\Temp\nicausmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nicausmkfc.exe ups_ins
  2⤵
  PID:3916
- - C:\Temp\i_nicausmkfc.exe
    C:\Temp\i_nicausmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:1988
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:1032
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  PID:4116
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  PID:516
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run
  2⤵
  PID:3524
- - C:\Temp\jhbztrmjeb.exe
    C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_jhbztrmjeb.exe
    C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbwto.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\ytrljdbwto.exe
    C:\Temp\ytrljdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbwto.exe ups_ins
  2⤵
  PID:740
- - C:\Temp\i_ytrljdbwto.exe
    C:\Temp\i_ytrljdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run
  2⤵
  PID:2140
- - C:\Temp\ytrljdbvto.exe
    C:\Temp\ytrljdbvto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins
  2⤵
  PID:1456
- - C:\Temp\i_ytrljdbvto.exe
    C:\Temp\i_ytrljdbvto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  PID:2340
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776

C:\Temp\ytrljdbwto.sys
C:\Temp\ytrljdbwto.sys
1⤵
- Executes dropped EXE
PID:2736

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Temp\dyvqoigayt.sys
C:\Temp\dyvqoigayt.sys
1⤵
- Executes dropped EXE
PID:1236

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
- Executes dropped EXE
PID:2620

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:4436

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:1160

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Temp\rmgeywrojh.sys
C:\Temp\rmgeywrojh.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\bztrljebwt.sys
C:\Temp\bztrljebwt.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
- Executes dropped EXE
PID:1132

C:\Temp\lgdyvqoiys.sys
C:\Temp\lgdyvqoiys.sys
1⤵
PID:976

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:4188

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:2024

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
PID:3260

C:\Temp\xupmhfrpjh.sys
C:\Temp\xupmhfrpjh.sys
1⤵
PID:4216

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:5032

C:\Temp\jebwtomgey.sys
C:\Temp\jebwtomgey.sys
1⤵
PID:3120

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdyvq.exe

Path C:\Temp\avtnlfdyvq.exe
Size 243KB
SHA256 8cba400c79d1767724620b2c7f760fa3fa98c69f926f626cdc9add7127c31049
MD5 1672d11d03c6f8082439f709c2205b9c
SHA1 29f4d0364e3ca8dc40658beb03200e07fab2373a
SHA512 dce965e3b6c199967bf08e9548aabf7b19e531ecbb03202f15bd26ac8adf96b1a64629f2695efb0704923a0dca1689aa780b6f93dca8826bd0f8c7787a652349
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:TvMsLaOa3lLNngoqRttA7C
TLSH
T13F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigayt.sys

Path C:\Temp\dyvqoigayt.sys
Size 141KB
SHA256 83a207ad713d2fde14fcdb6d3081f8173f7f2907b3ea3f4e221f3afa5893798b
MD5 54414c85d8bcabbb687a0e2cbfce9040
SHA1 59a42c5b9dc7f4c963213bfccc6098111e5bb52b
SHA512 fe71d5654af6b6786d9ffe4a3858e692755d96ac505ddcadc654da08aa445436741e075ff40e67567988e90433dc74a7d48159c24aff59e0744c197258bc1d82
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezx.sys

Path C:\Temp\ecwuomhezx.sys
Size 141KB
SHA256 2f8b2e121c68835cf10b5f1bbf8a36c93419d967af818fc424f493274c9bcfe2
MD5 5334fda01c1f04a3b352f13299d6dbec
SHA1 9647ae29e5b3a64c08a50e3b2569b0522ec9ead2
SHA512 c951d01d956e6d14ec01847c152ade7662570eb26b662f449cbf56bdf1b75ba1817ad9bf7044a0f8e8493b0e23861bcd20aee4e5e58df94a55b99b4295703845
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19DE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicav.exe

Path C:\Temp\faxsqkicav.exe
Size 243KB
SHA256 9ddae12d0f3e60e86be0950b5f070c8d4e50a1e22b63b524a93b316b39340099
MD5 57dac15f70d52893d2b266eccd6aa81f
SHA1 b910b93bbd9e48843301fe47db9d4718c34d4e6d
SHA512 869da6928f67c25bd89373fab879be87b5c9e1a147b88cf71ec3ac07d2ad69efce5d2e466fee428fcd3d15d9552660af8e860c63906e56398563a604da6e6226
SSDEEP 3072:+bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U7:+OvMsLaOa3lLNngoqRttA7U7
TLSH
T1E3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnlfdyvq.exe

Path C:\Temp\i_avtnlfdyvq.exe
Size 243KB
SHA256 5983ffa55a2c2cffbc8d449709b0bb7f84683be4e6cd18a1485abcb8931e2afc
MD5 cdbb51ac852d52148f758171e136a36c
SHA1 1217c2365e5cdcd331da77bf2b71260bfbb2f961
SHA512 1b752f1438ceebc1fce5e32c6ed2871fbd5a2d6383d07a4e1a13f6966d0189ab83a934a6e3cda784dd1268c2ffc9b9c0ff55f0af8f0924dfe3be84658402769e
SSDEEP 3072:/8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V0:3vMsLaOa3lLNngoqRttA76
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkicav.exe

Path C:\Temp\i_faxsqkicav.exe
Size 243KB
SHA256 50f9bac9b4d84f22f1fb863f407ba90c255d22da9bd340abd4328ea7e5b7482c
MD5 df926ce316d6ead5538d8d177fd5a333
SHA1 74333ac6db79bd59a7ce40d49bc69d573410a269
SHA512 09df363a50fa59b93eb4f379ccbc11d262349edf7ee24dae1410168da98916cc448dadb50fdcbafe4275e6c3a6e1edb7bd27e03b81c7d60945ea46ed71a21ea4
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:pvMsLaOa3lLNngoqRttA7g
TLSH
T183345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvqkida.exe

Path C:\Temp\i_kfdxvqkida.exe
Size 243KB
SHA256 f77efd742f8378e1454f457c16ae9748d3d013b44e66b9c5048986bd5b2a4ade
MD5 0ba0c9bf24a6a6a6f995e42bc9f617f8
SHA1 8d14a8d3869fa6e1521131e1413be9fca01324a0
SHA512 086f617b605063084a8d5045bd1c0e39b59bc299ba2aa3870f26f6f4da25c041f0ebcb1619412de8f3373bba29fda17ae90b9a113d03331fa8c50c01abaa2812
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:WvMsLaOa3lLNngoqRttA75
TLSH
T10A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxupnhf.exe

Path C:\Temp\i_mkfcxupnhf.exe
Size 243KB
SHA256 6941014b7ce15125746f608fe15b386e3e13cfd3ec006cdff185fba5c5c5f092
MD5 304f7b475d91a0ed9b8face32d2191f7
SHA1 0bb44e22afd10082cbe1c6a857b3e681c738cef0
SHA512 14ccbbc3540062ec82b0e009a3ffbdd4f859c61557396e96b14e85612ffd1fe5457956f784ce18fb0e6c39247dfbf23bacee577543034e8eda1ebeb298a4d4f1
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:pvMsLaOa3lLNngoqRttA7I
TLSH
T138345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytqlgd.exe

Path C:\Temp\i_oigbytqlgd.exe
Size 243KB
SHA256 2d9dc864957fb7e453712cb7e397d73b1f1042469c1ceef103f46a9d90a173fa
MD5 523d0d408e153b8acde1a5d1bdca6945
SHA1 52312cf47343fcb15e5f3294a8883c5bed38b696
SHA512 bdd887dc66e4c6cf6f067b8831b8443a9b0f96a967d4d87097724ba1a374a495664fbdc061d2aeba1535da61f7b7da84a34768fb3a59e06fe51fce3370f4c2ac
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:9vMsLaOa3lLNngoqRttA7o
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbzurmge.exe

Path C:\Temp\i_pjhbzurmge.exe
Size 243KB
SHA256 e0784216454d54901bc7d88f2087de2baba1b882280929ac2f388ba22a080200
MD5 addd1fe86c83d66c3d99bc0ed05fa72a
SHA1 3a325e707e303e81b0a9597d759699e4ab7e2184
SHA512 cff12389f53cdb0851eec1538addb63e7ed5bcc5b9c1570e55bde1963d06af26375638431440b5c6accc3f8d9e9b33f01ef1b39a326e946eef3dbd010b6da154
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:dvMsLaOa3lLNngoqRttA7c
TLSH
T15F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljeywrojg.exe

Path C:\Temp\i_rljeywrojg.exe
Size 243KB
SHA256 f4067e776e1ec1c6fef413ce1714b8c639b8d5fe30f747fcb92d11a197b83392
MD5 1e8cd6816969371d3a444683aea22ba5
SHA1 6e273cb4b116c7618e6a2c96a0d6afdf73a34069
SHA512 5c826cfa025ddd87bd664a9ab5025315a9a43f850a4c63820b3fa1f54a23450f75c87d72364f80219242f609dba19d22c94f4813fa44b79faec3ee711b751754
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:avMsLaOa3lLNngoqRttA7t
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhbzur.exe

Path C:\Temp\i_zxrpjhbzur.exe
Size 243KB
SHA256 1f953e7ae6dd4fc1d4bc9a89fc83714dbf63c77852f41bb6481dadb110e46f16
MD5 9a8248cf2dc1332a034e5d13fd344c17
SHA1 42c9d61fed7b3e929085a5b8b57e9467c5c61e3c
SHA512 ebfbee1074dfb2cc678a1cc8283ee138aad4b2e2c6a1df3307338ec2356acdd625c17a757747acc490756152563139dcef5f6cbaec6d1c4b6beb5889ab1130dd
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:evMsLaOa3lLNngoqRttA7Z
TLSH
T104345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.sys

Path C:\Temp\jhczusmkec.sys
Size 141KB
SHA256 9d77438d2eeffce7cf7d49c1c9e6c3e2a0875680dc76ccdf84e731e3eac36b13
MD5 ecb096c38f6f60da59a8208c2ee4bc36
SHA1 e49d633eed59c86a6727927e3b01443a6bcaba74
SHA512 6798b4d37fdf1a77d71091d839ef11fd6cd012ef03b2c939a0378ea21b0d2c67ee26b66694248cb6c08df8d2279bdbaee6d1c720cfad4f29f37b3e5aaf7857dc
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvqkida.exe

Path C:\Temp\kfdxvqkida.exe
Size 243KB
SHA256 b8614594e53ede8db4172f495e01cc938b16ad580323e2d09c302bf37449b099
MD5 847fc03d541fb70cabb41cf1cd81976c
SHA1 91d87cc53159ed919fe3b98640e9622b517665ac
SHA512 687bba82ff15c4b2da47047662dcd1bb70655e76a56d4091cb9e24426c9a4e5204c2d80f39d520b601446f5f85dad9bb9fdd59b3c7a2de5eb757b18a4f591d5e
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:MvMsLaOa3lLNngoqRttA7j
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.sys

Path C:\Temp\lgdyvqoiga.sys
Size 141KB
SHA256 3fadb01b21be8b5d4890513c1c4bc3b568c2f79ba9a6ece373549b2eabad5f80
MD5 b03683fa90c49fb7f7fb3d726d45935a
SHA1 a993f50da41cd74d15da6b751de43dfeda147c74
SHA512 aadb04c04218b103d7c8d9c01a04cab1edccc040ae3c39d271288942847968d074a0d87e5ef1daf3764b5239b134832cd9396576ce73097523640c91a387855d
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.exe

Path C:\Temp\mkfcxupnhf.exe
Size 243KB
SHA256 a027b4c8c5e3b61a43464c6d0ff2e15ca4994168a363f75c2b901a279198d775
MD5 028c74936034486b0a454cc1de7da802
SHA1 afab2bb643736961b77b5e52a4078080c90ee401
SHA512 796cde9217e12ef46e29f8250b8ae80e7c895fb62769c34b9796bf91ad1e9e3b08bf4ce88e9480078fbf1576b349ec06548485c590d9eef9c01c280b03283f1e
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:VvMsLaOa3lLNngoqRttA7M
TLSH
T167345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.sys

Path C:\Temp\nkfdxvpnhf.sys
Size 141KB
SHA256 8daf2eed7209b251eda91856852e476c150ac3d989a85e6d1e04bacd3c500fb9
MD5 a56960e4467d79620f4e8cef49050125
SHA1 d5dd653291203e79d09294c31b21d1b2d827b7bf
SHA512 19c0855843c2669f1375fdcc97797eac1d2fdbb1d055fde901dab6b9c817279947fffbf2359cd8d68276f4cd35907f3af9e9eee236876b3e134f7ad1092357c5
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T183E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytqlgd.exe

Path C:\Temp\oigbytqlgd.exe
Size 243KB
SHA256 00fc2c3a66e710015789f52d213b7cd4f63346667f78ef31a4bd064f7189ce01
MD5 693881c333ee3033cb0a11c9e56c4326
SHA1 621774bcc19f7b667b8954b7220586e7c774ffe1
SHA512 1bd5c99b2caacc2750f332e18ae7ac8389f3925f76a69fc0415bc24958c98fc2abade8896cf80b68d660d39b40cfba700440171a6a68b6f3c7752ee0c5cbcbfc
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:fvMsLaOa3lLNngoqRttA7W
TLSH
T1E3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmge.exe

Path C:\Temp\pjhbzurmge.exe
Size 243KB
SHA256 5e2a4eb0b46c8eb8a2c9d062370113362483b724e3a9de12213b86ee0af35a55
MD5 523d6b0e0c44ef3ee3ff39e072c6b8a3
SHA1 1f28be1e73e856dfa484da7a2790049dfee231b4
SHA512 52bdde1124bf3cbcf769dae79f888658a298b0169de57688dab88b20d9f2e20e0af2b43d20d6af42dedeec22e2582571e045932810bd5a10b044e4f9c0f5b0f5
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:tvMsLaOa3lLNngoqRttA7I
TLSH
T1EB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljeywrojg.exe

Path C:\Temp\rljeywrojg.exe
Size 243KB
SHA256 ae57afa38179d6464c332eea7182a2829f68ffc4b1f0d36f182cdab24ec42a7a
MD5 606f1ff5f884292ebce7dbacbeae6432
SHA1 fb0bac716c7ec77bd135db1f90c3bc4f3603e6ae
SHA512 2b18faa16222f5e8f7471e762520321e081b567bdd035c5dc06ce294d927df185f4ecd8a171e428fcbfdcbfd9b77b64733321e901160298be10d0e1fe011c784
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:dvMsLaOa3lLNngoqRttA7Q
TLSH
T168345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgeywrojh.sys

Path C:\Temp\rmgeywrojh.sys
Size 141KB
SHA256 667449ff388bb54bef453291e11464058a01b5ddc4f45302f7a78d7469171b74
MD5 6a72550da2f0c7ac513bfe966affb0e1
SHA1 8d7dcd984f1263da1bee2e0498c763696ceaab94
SHA512 fe4ccd03fa3863bbf814e68d4ec842d9b66b2563ea7d9f9dbc9c5a814354f8b9590416c5e640e9adcd7f419e9ebb94c3c770d5ee9ecf7cea5c5005a82f81ca6e
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.sys

Path C:\Temp\xspkicausm.sys
Size 141KB
SHA256 ef0e839513e6c89896551b81ae820645fb567141dba51c67f49fd1afec0ab5d8
MD5 faab65e6afe9f1c3b26e8aa4c363eeef
SHA1 814d485beeb75ffef177677b07cec6ac7d5029ec
SHA512 fbe1cd3821942e395c48c28351c35fc9c2fb13d6e102dd6c34346f4593e49cd7a3e669c5e16e9e72e60a9874bca4c18934f90eda1741529783810acfae0a27cf
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbwto.sys

Path C:\Temp\ytrljdbwto.sys
Size 141KB
SHA256 310f9d7dd232998116f673e4e5e5b99ea397500156ce1a6cd7a473e01efbe047
MD5 3611d56b66e29904feb1468b0bdfe064
SHA1 3de173c1fb9473050805ceda2ab499ada5eabcb3
SHA512 a993c103800989c90cc7c428e63cbee89f5aed22a401d2b4f3275ec0c9c53e5ce595073d0fe7205b7ce11215298600fe6bd28d9e3edd79e8c21838c1e82ce25f
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.exe

Path C:\Temp\zxrpjhbzur.exe
Size 243KB
SHA256 4b1342f8a784890c839a8a351d823ddbfc0ffe5d9789dbe1f9343e0f93b158ed
MD5 53e4380a5f229773d754d2d7dd5c2119
SHA1 19ea559952d0850b4ba6038f36f7d3c9c3877134
SHA512 f8efcbbbe230cdbd2ef8d313faf173eadc23f6a7c162359b241bead27507a3556628e97d5f477fc20844ca29149cfd6de9da65b102968a1ee28c339aa3f1aa95
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:yvMsLaOa3lLNngoqRttA7F
TLSH
T10A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8GAU4O3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/976-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1132-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1160-75-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1236-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2024-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2620-49-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3120-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3260-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4216-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-81-0x00000000005C0000-0x00000000005FD000-memory.dmp

Download

memory/4436-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-63-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4472-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-100-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4856-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5032-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads