4e996a7db76e984a8a89ba0aa67a465f801869d91af57825c6f3210ce3efff95

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
Size 243KB
Sample260824-e4h7hashlc
SHA256 4e996a7db76e984a8a89ba0aa67a465f801869d91af57825c6f3210ce3efff95
MD5 97bb10f75cad9965ae842ee38a23a0c1
SHA1 5dbd06c24ae191d9372d37d69e6b9243a60ed2c4
SHA512 919227d0c7fb35983178694e908f13cf921d65f25c50c6687816ba88cde51f1dcbec7a16bab4cfce13290c4155f6c5cc80383ca7c8574de950ee2824d64c5e08
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:yvMsLaOa3lLNngoqRttA7Z
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4940	CP.exe
2412	uomgeywroj.exe
2112	CP.exe
4068	CP.exe
4608	i_uomgeywroj.exe
1800	bwrojhbztr.sys
3940	CP.exe
4824	jdbvtolgey.exe
2752	CP.exe
1760	CP.exe
3364	i_jdbvtolgey.exe
320	olgeyljdbv.sys
5116	CP.exe
3280	oigaysqlid.exe
4892	CP.exe
3996	CP.exe
2180	i_oigaysqlid.exe
1796	tnlfdyvqni.sys
2192	CP.exe
4168	fdxvqnigav.exe
3740	CP.exe
4756	CP.exe
1680	i_fdxvqnigav.exe
4060	favsnlfdxv.sys
1312	CP.exe
956	sqkicavsni.exe
1188	CP.exe
4116	CP.exe
112	i_sqkicavsni.exe
2520	nkfcxvpnhf.sys
4608	CP.exe
1360	fzxspkecxu.exe
4884	CP.exe
4960	CP.exe
3648	i_fzxspkecxu.exe
4504	hcausmkecx.sys
1068	CP.exe
1440	pjhczusmke.exe
4252	CP.exe
1464	CP.exe
2844	i_pjhczusmke.exe
2748	smkecwupmh.sys
4264	CP.exe
4484	hezxpmhfzx.exe
4732	CP.exe
2132	CP.exe
3088	i_hezxpmhfzx.exe
3328	ebwuomgeyw.sys
1416	CP.exe
1184	trmjebwuom.exe
4256	CP.exe
3692	CP.exe
4544	i_trmjebwuom.exe
3772	qojgbztrlj.sys
5112	CP.exe
4464	jdbwtolgey.exe
2844	CP.exe
2184	CP.exe
1180	i_jdbwtolgey.exe
3556	wqojgbytrl.sys
4816	CP.exe
3524	dywqoigbyt.exe
396	CP.exe
4660	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2304	ipconfig.exe
3532	ipconfig.exe
3684	ipconfig.exe
1000	ipconfig.exe
620	ipconfig.exe
4544	ipconfig.exe
3472	ipconfig.exe
3320	ipconfig.exe
4484	ipconfig.exe
1856	ipconfig.exe
4708	ipconfig.exe
2120	ipconfig.exe
3684	ipconfig.exe
5080	ipconfig.exe
3064	ipconfig.exe
640	ipconfig.exe
2088	ipconfig.exe
4928	ipconfig.exe
1184	ipconfig.exe
5076	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31273857"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bb3fb75f33dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6917B8ED-9F74-11F1-B995-62F9C1B4CF77} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494310751"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1037400477"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31273857"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1039900833"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000725f724363fdee4e85dd0df115362cd9000000000200000000001066000000010000200000003855913c18daa78507e8a4ed2ddb7fb8738136549d078b28ff0bf89dd8502276000000000e8000000002000020000000378a353b7da3e9baf89b0b2d981c3c6db6e829d8c20ace3a4f93a8c2cbead95e2000000027c0da6238781261d7bf23688714d2bdc2fc7566c98a21a61eaf3f81547a1a8d40000000e59cc308c49facb1d349510d436452693572f7b9ae326d7db5865221d59fea852afbd4ecbf93e084443f1af0f5ff5ee8e8eee4a663371665edab7f0540bcebd3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000725f724363fdee4e85dd0df115362cd90000000002000000000010660000000100002000000039d55b3dc7afed1ffb34c31e66c450b2192ec2a738e65c41b45d2abb5b012ea9000000000e80000000020000200000002690dae7d2799dbb42641aacca7ed262589b060f43e143dbc4e0d26e0bfd24a220000000976763dcc03a5e11bc468336b3ce160fb7f7bd5eacfee864e580bf02f5ae08a6400000000baa7a5b79bdf141765549aff22259172454217369bfdb4293b7e8617d52992ff7929fe24ad344ff9ffe6978c430e693bba0d0abfeaf47295b83aaabe0511d0d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07644b75f33dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	i_uomgeywroj.exe
Token: SeDebugPrivilege	3364	i_jdbvtolgey.exe
Token: SeDebugPrivilege	2180	i_oigaysqlid.exe
Token: SeDebugPrivilege	1680	i_fdxvqnigav.exe
Token: SeDebugPrivilege	112	i_sqkicavsni.exe
Token: SeDebugPrivilege	3648	i_fzxspkecxu.exe
Token: SeDebugPrivilege	2844	i_pjhczusmke.exe
Token: SeDebugPrivilege	3088	i_hezxpmhfzx.exe
Token: SeDebugPrivilege	4544	i_trmjebwuom.exe
Token: SeDebugPrivilege	1180	i_jdbwtolgey.exe
Token: SeDebugPrivilege	4736	i_dywqoigbyt.exe
Token: SeDebugPrivilege	3308	i_dyvqnigavt.exe
Token: SeDebugPrivilege	2420	i_vsnifaysqk.exe
Token: SeDebugPrivilege	3824	i_snkfcxvpnh.exe
Token: SeDebugPrivilege	4764	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	412	i_smkecwupmh.exe
Token: SeDebugPrivilege	3420	i_pjhbzurmje.exe
Token: SeDebugPrivilege	3088	i_geywqojgbz.exe
Token: SeDebugPrivilege	4780	i_tnlgdywqoi.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3832	iexplore.exe
3832	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3832	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	86
PID 3832 wrote to memory of 2424	3832	iexplore.exe	87
PID 4176 wrote to memory of 4940	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	90
PID 2412 wrote to memory of 2112	2412	uomgeywroj.exe	93
PID 4176 wrote to memory of 4068	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	98
PID 4176 wrote to memory of 3940	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	109
PID 4824 wrote to memory of 2752	4824	jdbvtolgey.exe	111
PID 4176 wrote to memory of 1760	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	116
PID 4176 wrote to memory of 5116	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	122
PID 3280 wrote to memory of 4892	3280	oigaysqlid.exe	124
PID 4176 wrote to memory of 3996	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	127
PID 4176 wrote to memory of 2192	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	131
PID 4168 wrote to memory of 3740	4168	fdxvqnigav.exe	133
PID 4176 wrote to memory of 4756	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	136
PID 4176 wrote to memory of 1312	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	141
PID 956 wrote to memory of 1188	956	sqkicavsni.exe	143
PID 4176 wrote to memory of 4116	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	147
PID 4176 wrote to memory of 4608	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	151
PID 1360 wrote to memory of 4884	1360	fzxspkecxu.exe	153
PID 4176 wrote to memory of 4960	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	157
PID 4176 wrote to memory of 1068	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	161
PID 1440 wrote to memory of 4252	1440	pjhczusmke.exe	163
PID 4176 wrote to memory of 1464	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	166
PID 4176 wrote to memory of 4264	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	170
PID 4484 wrote to memory of 4732	4484	hezxpmhfzx.exe	172
PID 4176 wrote to memory of 2132	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	175
PID 4176 wrote to memory of 1416	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	179
PID 1184 wrote to memory of 4256	1184	trmjebwuom.exe	181
PID 4176 wrote to memory of 3692	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	184
PID 4176 wrote to memory of 5112	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	188
PID 4464 wrote to memory of 2844	4464	jdbwtolgey.exe	190
PID 4176 wrote to memory of 2184	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	193
PID 4176 wrote to memory of 4816	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	197
PID 3524 wrote to memory of 396	3524	dywqoigbyt.exe	199
PID 4176 wrote to memory of 4660	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	202
PID 4176 wrote to memory of 4120	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	207
PID 4524 wrote to memory of 1704	4524	dyvqnigavt.exe	209
PID 4176 wrote to memory of 3948	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	212
PID 4176 wrote to memory of 1956	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	216
PID 620 wrote to memory of 1580	620	vsnifaysqk.exe	218
PID 4176 wrote to memory of 3776	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	221
PID 4176 wrote to memory of 1568	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	225
PID 2080 wrote to memory of 1540	2080	snkfcxvpnh.exe	227
PID 4176 wrote to memory of 2304	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	230
PID 4176 wrote to memory of 3104	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	234
PID 3332 wrote to memory of 2856	3332	mhfzxrpjhc.exe	236
PID 4176 wrote to memory of 4160	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	239
PID 4176 wrote to memory of 3808	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	243
PID 3772 wrote to memory of 3392	3772	smkecwupmh.exe	245
PID 4176 wrote to memory of 2348	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	248
PID 4176 wrote to memory of 408	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	252
PID 2964 wrote to memory of 3844	2964	pjhbzurmje.exe	254
PID 4176 wrote to memory of 4444	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	257
PID 4176 wrote to memory of 3560	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	261
PID 5076 wrote to memory of 2888	5076	geywqojgbz.exe	263
PID 4176 wrote to memory of 5012	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	266
PID 4176 wrote to memory of 896	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	270
PID 4380 wrote to memory of 3648	4380	tnlgdywqoi.exe	272
PID 4176 wrote to memory of 4320	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	275
PID 4176 wrote to memory of 4356	4176	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	279
PID 2396 wrote to memory of 4544	2396	ytqljdbvtn.exe	281

C:\Users\Admin\AppData\Local\Temp\2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4940
- - C:\Temp\uomgeywroj.exe
    C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4068
- - C:\Temp\i_uomgeywroj.exe
    C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3940
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1760
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\oigaysqlid.exe
    C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3996
- - C:\Temp\i_oigaysqlid.exe
    C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Temp\fdxvqnigav.exe
    C:\Temp\fdxvqnigav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\i_fdxvqnigav.exe
    C:\Temp\i_fdxvqnigav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Temp\sqkicavsni.exe
    C:\Temp\sqkicavsni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\i_sqkicavsni.exe
    C:\Temp\i_sqkicavsni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\fzxspkecxu.exe
    C:\Temp\fzxspkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_fzxspkecxu.exe
    C:\Temp\i_fzxspkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczusmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1068
- - C:\Temp\pjhczusmke.exe
    C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczusmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1464
- - C:\Temp\i_pjhczusmke.exe
    C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxpmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4264
- - C:\Temp\hezxpmhfzx.exe
    C:\Temp\hezxpmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxpmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\i_hezxpmhfzx.exe
    C:\Temp\i_hezxpmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1416
- - C:\Temp\trmjebwuom.exe
    C:\Temp\trmjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\i_trmjebwuom.exe
    C:\Temp\i_trmjebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\jdbwtolgey.exe
    C:\Temp\jdbwtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2184
- - C:\Temp\i_jdbwtolgey.exe
    C:\Temp\i_jdbwtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\dywqoigbyt.exe
    C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\i_dywqoigbyt.exe
    C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigavt.exe ups_run
  2⤵
  PID:4120
- - C:\Temp\dyvqnigavt.exe
    C:\Temp\dyvqnigavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigavt.exe ups_ins
  2⤵
  PID:3948
- - C:\Temp\i_dyvqnigavt.exe
    C:\Temp\i_dyvqnigavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnifaysqk.exe ups_run
  2⤵
  PID:1956
- - C:\Temp\vsnifaysqk.exe
    C:\Temp\vsnifaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnifaysqk.exe ups_ins
  2⤵
  PID:3776
- - C:\Temp\i_vsnifaysqk.exe
    C:\Temp\i_vsnifaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfcxvpnh.exe ups_run
  2⤵
  PID:1568
- - C:\Temp\snkfcxvpnh.exe
    C:\Temp\snkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
  2⤵
  PID:2304
- - C:\Temp\i_snkfcxvpnh.exe
    C:\Temp\i_snkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  PID:3104
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  PID:4160
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  PID:3808
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  PID:2348
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmje.exe ups_run
  2⤵
  PID:408
- - C:\Temp\pjhbzurmje.exe
    C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmje.exe ups_ins
  2⤵
  PID:4444
- - C:\Temp\i_pjhbzurmje.exe
    C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run
  2⤵
  PID:3560
- - C:\Temp\geywqojgbz.exe
    C:\Temp\geywqojgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins
  2⤵
  PID:5012
- - C:\Temp\i_geywqojgbz.exe
    C:\Temp\i_geywqojgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run
  2⤵
  PID:896
- - C:\Temp\tnlgdywqoi.exe
    C:\Temp\tnlgdywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins
  2⤵
  PID:4320
- - C:\Temp\i_tnlgdywqoi.exe
    C:\Temp\i_tnlgdywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3320

C:\Temp\bwrojhbztr.sys
C:\Temp\bwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:1800

C:\Temp\olgeyljdbv.sys
C:\Temp\olgeyljdbv.sys
1⤵
- Executes dropped EXE
PID:320

C:\Temp\tnlfdyvqni.sys
C:\Temp\tnlfdyvqni.sys
1⤵
- Executes dropped EXE
PID:1796

C:\Temp\favsnlfdxv.sys
C:\Temp\favsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
- Executes dropped EXE
PID:2748

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:3328

C:\Temp\qojgbztrlj.sys
C:\Temp\qojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:3772

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\oidbvtnlfd.sys
C:\Temp\oidbvtnlfd.sys
1⤵
PID:2340

C:\Temp\fdyvqnigay.sys
C:\Temp\fdyvqnigay.sys
1⤵
PID:364

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:1388

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
PID:4088

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
PID:4480

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
PID:4876

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
PID:3612

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:3792

C:\Temp\gdywqoigby.sys
C:\Temp\gdywqoigby.sys
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwrojhbztr.sys

Path C:\Temp\bwrojhbztr.sys
Size 141KB
SHA256 5e977317501c8b97c643b895511e925e531752a2b7d3deffa23b0d96e242eec4
MD5 420e2ef403b5cbea60ca91fa5d5bba29
SHA1 8217827e42a88c2fed3f623b6a9545797863affd
SHA512 083da6fdc4955803f90806b3150087e5bf5e3882eac971b130acb197903f3bd81cac71cb8b99b8e40dedca816536f68a0a7e91b927ab8ebd45d49be0eeec2186
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favsnlfdxv.sys

Path C:\Temp\favsnlfdxv.sys
Size 141KB
SHA256 bcce4ba0d459b7b55446a059b7efa41ae5a514870fc21e4cc80139db1076dc51
MD5 8f86390da5ea8ab7820d770abb72e24c
SHA1 64035bbb600a2b5bbf572c72a62badabc6125f28
SHA512 4799d11048a6e3fd3f463986f324b0b7818ac373ec335440fe630a050ff1b8a3f31aa546a2cc884cf720dd71387254839babe596ee48c8a4b0bd15282946848f
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnigav.exe

Path C:\Temp\fdxvqnigav.exe
Size 243KB
SHA256 11fc2a63bc6e3055e1bcbd8384dd1c8a288ceaf26465e5504cd1e15beb227161
MD5 cd88c6988f86371b8ac46413c8046b03
SHA1 8efb129be24128d93835b0f5e9f7a7a0ea0eb681
SHA512 803a6ed3547b3252e0cc6bcbc11f0876dceaa5febfc1db692626f6e38321c555d15990209465bc8003d10caffde834584b5abbf07cdddd748477e64020ef66cb
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:svMsLaOa3lLNngoqRttA7/
TLSH
T148345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkecxu.exe

Path C:\Temp\fzxspkecxu.exe
Size 243KB
SHA256 6f9ec871334bd5447ff2059135d1ff27aee7edc9b1cbf50c38e93cb8ab7b8d8c
MD5 71805dba59323f20f8474cf683cf7ca6
SHA1 2a3fe4dcfe2a0070ec752b731ad0fc1443c0bc75
SHA512 e6500fbdb9315af450666e9a0d3a0ec7a957c372c96539c375bab19af6c91ce0da5c54f7c330a968cbcdd887777c7839ad37063c0de8d8a182f4d1dd2c3ac580
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:cvMsLaOa3lLNngoqRttA73
TLSH
T101345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.sys

Path C:\Temp\hcausmkecx.sys
Size 141KB
SHA256 74c5d080f0ebafc42787f27d32ce75212b8cb2669178a23d32f3f7c626da4195
MD5 a0c3babe74bea081e14b25c927248d9a
SHA1 8a8a3b5fb69394a95af35fafce9e1a05286fadb1
SHA512 bb51373aecbef0d1840c77df091fd76eb614ddf62537821dc7fd579e821f094e9736b6db226e1f75434cc6516bfc6aca1335fd4ea5db35db8d06cb988ffb6551
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T145E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxpmhfzx.exe

Path C:\Temp\hezxpmhfzx.exe
Size 243KB
SHA256 a1710af7c75e57a0c2cb4380f1043f549bcc81196810bd7315eb4aea1e971afd
MD5 a8d61513a002b7eb5c190ec7ecc20a5e
SHA1 5a2d2e657197686dfef007ac8a31cd005575e535
SHA512 f812835ea70908e043cba177d86ed822ebf72b44172f0c86224a354e90bd8402b1e9a59c5dc3dadb7db217c3d3e2b8927abd26fd8ff2caf7f08946922a71228c
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:DvMsLaOa3lLNngoqRttA7O
TLSH
T180345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvqnigav.exe

Path C:\Temp\i_fdxvqnigav.exe
Size 243KB
SHA256 9eae3936c0c9cc079c9682b1d7adb9e797057dbf4e30c7853593448cb8e983e5
MD5 e1036d5abec234d168430702da50c74d
SHA1 37bdd905fa81dfb35e402aec771115593b66f41a
SHA512 96b95980232b415c4c8acf1af12305b0492e900400f201d0982c78db901fc09a42f63fd3eb5b3c6e9abf62a85d9cb815a416b52f0bc1fc22c8d6e21094abce5e
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:NvMsLaOa3lLNngoqRttA78
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkecxu.exe

Path C:\Temp\i_fzxspkecxu.exe
Size 243KB
SHA256 acd9dd048b86bc9dd8bf664e158f77e1ef4a38bca4b3dbe7cbf6f22febf7291e
MD5 4e2bca517ef68d0eb07b8ffd9261429b
SHA1 105c068f8d15c29c0b21a3bc1c31fdc3a952db6b
SHA512 5d9aeea7d0cb0b9e674b55b74585798003f5d3670e4df860b15bfa3fdce9a3bd4d49a1678d8bd6a6939efae93378fc50e5c6cbafdb95983e90c4172f66affeec
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:uvMsLaOa3lLNngoqRttA7B
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtolgey.exe

Path C:\Temp\i_jdbvtolgey.exe
Size 243KB
SHA256 25d301731d2e6ee6f549a24906b2741b95b1158e79f29f95d9979f29a34256d3
MD5 742c119c6ef2987c1dfff94a28e8bd46
SHA1 0c538232bedca4fe7e142c259635af183a57a4dd
SHA512 ef12b4ce1208c0b7356f241a0fae90f6e7cb24ff3fb48131920a0ed5263f2b118ab0ebedd54a651df9172c4ceea05ea9853b914d69b590b8c78b6d973144b807
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:DvMsLaOa3lLNngoqRttA76
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqlid.exe

Path C:\Temp\i_oigaysqlid.exe
Size 243KB
SHA256 0c8b22a9960b8beac0c8255e5bcceedb0839e9840679769ad46367a9110facc4
MD5 122747bc3e5d6e7f00acc98705da7286
SHA1 c9a8b8647a42daf7b2e95df275625289190c4873
SHA512 23d66bb0188b7db5b07735501e7def8810a119c7ecff9860d9546da302e889686f62c2608c3d61906a344f9575a85545d4bcf88c0f7940e0d43e70e030930e3f
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:gvMsLaOa3lLNngoqRttA77
TLSH
T16A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhczusmke.exe

Path C:\Temp\i_pjhczusmke.exe
Size 243KB
SHA256 5fb5785cc81c8145eb98d8f6fd2419025b11b4d39ecb0f558ee657715c54d89b
MD5 eafa826bfc45c9f0a5d78f29ea8aeb47
SHA1 1af0eafa678d3e4e5ca9945b8d8748e1107d318d
SHA512 a0926968af1e56dac0d19d1f9934baa6d04546d1ea09f902a80f0c7fb88b4fdb3dbf9e9147c78693e54ec4335c0efe12be627618ed6d6efb6d7e9c298f899b91
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:kvMsLaOa3lLNngoqRttA7X
TLSH
T1CB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsni.exe

Path C:\Temp\i_sqkicavsni.exe
Size 243KB
SHA256 a4a684a9b9f012db99e6ad8bf26b1448b011f6504ea668549f45cfc7753bb5f8
MD5 d110ee27c165a8df4c7148f1398bfb84
SHA1 1f39c760182a261276904bae43571e151f6afc4f
SHA512 4f7bf7495e1ef3dafd8cc41b7e67d217856f5c2a1a78c98b12341870e0e2176944db349cbe116e3aa55b8de93fbf906e7ede58eea569d2ed0654fff7bcff535d
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:HvMsLaOa3lLNngoqRttA7q
TLSH
T106345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywroj.exe

Path C:\Temp\i_uomgeywroj.exe
Size 243KB
SHA256 d28324e6d0b01d0349a90a60cd46d930452f9130f37f2c483baad6009f9c14be
MD5 cf006dde90cfaea2da9aecbc6defc5db
SHA1 5d686658b92a67b3f43891d7470590fd6785c9c6
SHA512 730322ccd9e6abe33eec44102b9d36ae430f9a326e1a58bf4a3c6d0488517a6032d146025090bf76d95ab632a898b2a5372d7808a3e74cce1714e251deab1ea5
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:rvMsLaOa3lLNngoqRttA7m
TLSH
T195345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgey.exe

Path C:\Temp\jdbvtolgey.exe
Size 243KB
SHA256 a68e8b9a105f058b5615422ee3c1601bce16400624b0767b36c00187fb45618f
MD5 656e7ff909fa19ef94ebbbf8a217b472
SHA1 bc06907d7db70f44a1a8d3432fe1608504f82d8e
SHA512 eb78f63ac8f3180f8a8433b20804c6161fa435a103d827d2987ae5452297ad7dbdd5b29227cf30cd8d1635dca8f75eadaece6c1c32347c481769c9117159590c
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:AvMsLaOa3lLNngoqRttA7v
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.sys

Path C:\Temp\nkfcxvpnhf.sys
Size 141KB
SHA256 1bafdfed0a1dcf8acdf08df94a1b0dca37a62085a7db9b1b535ed01732d425ea
MD5 2167c2e0ac03cc20867fc441403b29ff
SHA1 56bafd227a69599b3156b2043b2cc48f64623282
SHA512 d96a5a101579717f28f9527bd1ab697231d234045b870510e78b2fed367c5288150349520c161ab568df75323639f407ec0440a69b7d6e43d7e3c2a06823a537
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.exe

Path C:\Temp\oigaysqlid.exe
Size 243KB
SHA256 a537c79dd5ec70e788e7256230698e3b638cc9b071993fba7a77327bed3e9595
MD5 3ae2cbfb1c6f2c4d4d9da06a8746e2cc
SHA1 ee02b996500e1a029c4f3bb982777e90c12d085e
SHA512 b1257f78ca1f5f0045db80baa245b06dcce717b7e9290e336b8aeccf888939b1b1c0112fadae7dd0075a7e664dd4efaeab1c49b08da45cfe48d54c8dd5963016
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:cvMsLaOa3lLNngoqRttA7b
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeyljdbv.sys

Path C:\Temp\olgeyljdbv.sys
Size 141KB
SHA256 c4dbd452e4980f58229332793312b2528c9eb790b8c24417c59e18c9b00673fb
MD5 12ac3ddd1e59cccddb06e96a64d8738f
SHA1 0ad1b33f40718e41bf9852d8ab259c92fde9ee3c
SHA512 e924568ccd5513b487de66fa56108239950d2fd07d8afc782e69d1c03e8a19d493db0a6719b8f369e8bb6e5175665c98e1deaf327b1baf661fb9db164c0c4989
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczusmke.exe

Path C:\Temp\pjhczusmke.exe
Size 243KB
SHA256 24438a499a2abe74253769afab2d8421759c76f07e4a68c5f7130d127871ed06
MD5 f5b35a99d469c35991cb8e01d0be5ed8
SHA1 56c5de7eb83730f37706b0752f4a791878c56726
SHA512 5e5b11c805f135a61bc2034753815b33f98e5fb63966fdf19d52da1b24a91980653ca0888c1f69402cbbbe030ce2482e7f1205deb8cf8eb8dc93d780ef729b0d
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:3vMsLaOa3lLNngoqRttA7O
TLSH
T174345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmh.sys

Path C:\Temp\smkecwupmh.sys
Size 141KB
SHA256 48db8daa4fc7721dc248917c78835fa9190744d6fbd39261032f3966136e6456
MD5 195942225cf28598bee725f09c136299
SHA1 ca1082c1edd599dc936756e23cf2b30adbad04f6
SHA512 29a1c2dfd8886db0ba55dee5193325aa34a8a17e2073558dfb8c83de8a181515a3062959a10fc9a0aa0310cae0ae29f51a5984c0bf997d1693fd203f2b215962
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsni.exe

Path C:\Temp\sqkicavsni.exe
Size 243KB
SHA256 96afe12e307a2c02260d42d48de126250d6989686d44e9964cdfb9502952cb0f
MD5 732c96ebcb50d589350f6d316de51f56
SHA1 fa5b9a0ad68c2f5451c325dea9985a80ed873c4d
SHA512 c6cfa93daee976a87b6b6cb7932d2f5530de63c925e74bbf8bdf0a4a7c40ee186f06bad68ca6457550c41220735dbe7709c14e5ac7898a0a8962b00933680d32
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:avMsLaOa3lLNngoqRttA7V
TLSH
T157345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqni.sys

Path C:\Temp\tnlfdyvqni.sys
Size 141KB
SHA256 d1613368444ef614397739e912fd18855faf2b0c7342f60ae3dc5399ef693f5f
MD5 2b144722819fd95b7d62d573fdcb4f99
SHA1 0124a4431e7ab8a285de1b3cc9f79d9be8e81d11
SHA512 f27e618e61ccb4669a2d2ffbf27cab4557125ad30d375c07e541fd67c3c39dd6e48b74aecfe6b69e93776c53b299c6a37ce33b72264eb0a1838d669c3dbfa974
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywroj.exe

Path C:\Temp\uomgeywroj.exe
Size 243KB
SHA256 d2d1f3d1baefdf48f437d02b378ae9990d992397620b325486fb70e97133a8f5
MD5 330da1ddc5c5acd6bdb402e12795fd1c
SHA1 e9fb3840c161a7b932e3f2e72157a96c6552feb7
SHA512 846867365e24f3b5d911c940882008ee5bac3bdd3c92ed2c3bf336064e7a6b6c952672c470bb67645f5b02b46516812b3b56e067564c18d4fbdd5dd2be21faa1
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:NvMsLaOa3lLNngoqRttA7E
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 65ee7a9ffd0d2d7e510d50224c722aa4ddb96e3dffb38cd2f984178ff8ecc5a2
MD5 25404d6210cc8c7bc118a37e6efa0794
SHA1 cca33327b82445d7237b350b261d813dfbd4d66c
SHA512 2527dd17bc4d77cf4ae45473a8aabecddd2e8ccc7ba90ce7135157d5e69ce9b92ab8838f6f3775304a2100da932bc1916e3b40e33ee8f36910bed357a8f9043c
TLSH
T154F02397D0FAE5B5F9C2D9DC16F8507D38B6866F1054040AE43C46F11C5A3E1E7570B9
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 b186e1f5804c9f45538279a88b8cc3da3b5c36958cf499391cab2ea529a90ef3
MD5 48e3127330826848de7140eda79fe5f8
SHA1 5e6802ff0039d28636a2a708d37b83f0cb47e444
SHA512 b42add5eaa24a5366d954d1a643457b2c59c65ce9204d89f0df61eaadf94ab4421f1efce9f8817ee1cb0f9a5ce7a0fc85cf09260b063fabc3175edf417197366
TLSH
T1A1E0C03821F7456FF5F5D075CBCC7826815AF0366019F2B52DDC6B04A702640AD03F2A
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FVK2FCOF\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/320-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/364-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1388-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1796-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1800-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2340-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3328-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3556-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3612-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3772-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3792-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3836-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4088-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads