79d3c193befa20c0fa292d78221a51ba3b788b07369675e1ba18dddab9dd0f4d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
Size 243KB
Sample260828-eamylaswhy
SHA256 79d3c193befa20c0fa292d78221a51ba3b788b07369675e1ba18dddab9dd0f4d
MD5 e473ff9e05504510749d7b4bb6e5b737
SHA1 789af2a96657f197fb26cdf49e70a440f6a9c5ed
SHA512 8bcae98a053d6133bdf8a92f4621d3c4a686b9bea021db1205a05d1612cb58b9501451e0fda198e3059833dc213979d49fcab0aa9ce218bd9c706ed80a6d3985
SSDEEP 3072:Whn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:qn7nLQka3lLNngoqRttA74
TLSH
T13F34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1152	CP.exe
1716	ezurmkecwu.exe
2144	CP.exe
1916	CP.exe
4512	i_ezurmkecwu.exe
3640	omgezwrpjh.sys
2604	CP.exe
4900	gezpjhcwuo.exe
5104	CP.exe
2776	CP.exe
536	i_gezpjhcwuo.exe
3760	ywrojgbztr.sys
1252	CP.exe
404	rljebwuomg.exe
2544	CP.exe
5056	CP.exe
2688	i_rljebwuomg.exe
4148	lgeywqoigb.sys
4364	CP.exe
1960	aytrljdbwt.exe
932	CP.exe
4164	CP.exe
4968	i_aytrljdbwt.exe
4628	igtqljdbvt.sys
2092	CP.exe
2348	tnlgdyvqoi.exe
1384	CP.exe
4512	CP.exe
2132	i_tnlgdyvqoi.exe
668	sqkidavtnl.sys
3148	CP.exe
2136	dxvqnifays.exe
4004	CP.exe
1824	CP.exe
1028	i_dxvqnifays.exe
1148	lfdxvpnifa.sys
2908	CP.exe
1704	axsqkicavs.exe
3612	CP.exe
956	CP.exe
880	i_axsqkicavs.exe
4888	usmkfcxupn.sys
3808	CP.exe
1768	nkfcxvpnhf.exe
4672	CP.exe
4012	CP.exe
3948	i_nkfcxvpnhf.exe
1764	mhfzxrpkhc.sys
4432	CP.exe
3556	czusmkecwu.exe
2808	CP.exe
4616	CP.exe
4396	i_czusmkecwu.exe
2372	mkecwupmhf.sys
1344	CP.exe
3020	wrpjhbzurm.exe
4100	CP.exe
3716	CP.exe
4936	i_wrpjhbzurm.exe
4332	ezwrpjhbzt.sys
4876	CP.exe
2680	trljezwrpj.exe
5096	CP.exe
2712	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iysnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkeuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezpjhcwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezpjhcwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_iysnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkeuomh.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3012	ipconfig.exe
1652	ipconfig.exe
4156	ipconfig.exe
984	ipconfig.exe
5016	ipconfig.exe
4280	ipconfig.exe
5016	ipconfig.exe
1044	ipconfig.exe
2728	ipconfig.exe
2164	ipconfig.exe
4444	ipconfig.exe
1728	ipconfig.exe
1584	ipconfig.exe
1064	ipconfig.exe
4892	ipconfig.exe
4140	ipconfig.exe
2532	ipconfig.exe
1684	ipconfig.exe
5016	ipconfig.exe
800	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C1B24EEB-A292-11F1-B995-5AB93EA64185} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000488a9908a57d474a9e741a3ea45a1f8c0000000002000000000010660000000100002000000090f9022392c1e504b21b399f9cc0197efdbf2ccd7891d782f50b39c79f332a9d000000000e8000000002000020000000249dc1d28cc008c8a51e1a8d0daa9b402a3713a3b57274443798ff48446b1855200000005ad8b93ccd59adfd712c154c8b60d4b9a7727af92a01c832bf2e8627273526e6400000002cd27c3b332f2f4b878f8099990190dd1f93a197b7d590b256e3dd24c85810582eb5fb5e655860a0358b0f4d699a19e64798e9ddc80ec499afd9f5dc06821c29	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2527002979"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494653638"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a084bbf8a736dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000488a9908a57d474a9e741a3ea45a1f8c00000000020000000000106600000001000020000000d304016574269ebed90d6b71ab181aabe76a4acf7af36417267b36ae0d2ef966000000000e8000000002000020000000b89c4b8e086e8d0075d9e871b5d30f74a6a6a633f9409c9d7b790ead02bd54992000000040a1063ce12fc673be429e16ef6522704fb124957c9ffba68d55751b6ea6583740000000d6167a5a693b22257e6d071970fc00f9d97a0778482637416a4e91fea24d3f87ac08c6c19841b5a8731458d76e6864efc7c775c4f389d3c97236b890105fa602	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b0c2f8a736dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31274655"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	i_ezurmkecwu.exe
Token: SeDebugPrivilege	536	i_gezpjhcwuo.exe
Token: SeDebugPrivilege	2688	i_rljebwuomg.exe
Token: SeDebugPrivilege	4968	i_aytrljdbwt.exe
Token: SeDebugPrivilege	2132	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	1028	i_dxvqnifays.exe
Token: SeDebugPrivilege	880	i_axsqkicavs.exe
Token: SeDebugPrivilege	3948	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	4396	i_czusmkecwu.exe
Token: SeDebugPrivilege	4936	i_wrpjhbzurm.exe
Token: SeDebugPrivilege	3040	i_trljezwrpj.exe
Token: SeDebugPrivilege	2300	i_omgeywqojg.exe
Token: SeDebugPrivilege	4640	i_fdyvqoigay.exe
Token: SeDebugPrivilege	4444	i_iysnlfdxvq.exe
Token: SeDebugPrivilege	1628	i_faysqkidav.exe
Token: SeDebugPrivilege	748	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	2104	i_usmkecxupm.exe
Token: SeDebugPrivilege	4980	i_zusmkeuomh.exe
Token: SeDebugPrivilege	1860	i_uomhezxrpj.exe
Token: SeDebugPrivilege	4092	i_ojhbztrlje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
4232	IEXPLORE.EXE
4232	IEXPLORE.EXE
4232	IEXPLORE.EXE
4232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2156	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	84
PID 2156 wrote to memory of 4232	2156	iexplore.exe	85
PID 2316 wrote to memory of 1152	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	86
PID 1716 wrote to memory of 2144	1716	ezurmkecwu.exe	89
PID 2316 wrote to memory of 1916	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	92
PID 2316 wrote to memory of 2604	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	96
PID 4900 wrote to memory of 5104	4900	gezpjhcwuo.exe	98
PID 2316 wrote to memory of 2776	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	103
PID 2316 wrote to memory of 1252	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	110
PID 404 wrote to memory of 2544	404	rljebwuomg.exe	112
PID 2316 wrote to memory of 5056	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	117
PID 2316 wrote to memory of 4364	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	121
PID 1960 wrote to memory of 932	1960	aytrljdbwt.exe	123
PID 2316 wrote to memory of 4164	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	126
PID 2316 wrote to memory of 2092	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	131
PID 2348 wrote to memory of 1384	2348	tnlgdyvqoi.exe	133
PID 2316 wrote to memory of 4512	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	136
PID 2316 wrote to memory of 3148	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	140
PID 2136 wrote to memory of 4004	2136	dxvqnifays.exe	142
PID 2316 wrote to memory of 1824	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	145
PID 2316 wrote to memory of 2908	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	149
PID 1704 wrote to memory of 3612	1704	axsqkicavs.exe	151
PID 2316 wrote to memory of 956	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	154
PID 2316 wrote to memory of 3808	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	159
PID 1768 wrote to memory of 4672	1768	nkfcxvpnhf.exe	161
PID 2316 wrote to memory of 4012	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	164
PID 2316 wrote to memory of 4432	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	168
PID 3556 wrote to memory of 2808	3556	czusmkecwu.exe	170
PID 2316 wrote to memory of 4616	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	173
PID 2316 wrote to memory of 1344	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	177
PID 3020 wrote to memory of 4100	3020	wrpjhbzurm.exe	179
PID 2316 wrote to memory of 3716	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	182
PID 2316 wrote to memory of 4876	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	186
PID 2680 wrote to memory of 5096	2680	trljezwrpj.exe	188
PID 2316 wrote to memory of 2712	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	191
PID 2316 wrote to memory of 4888	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	195
PID 4824 wrote to memory of 1576	4824	omgeywqojg.exe	197
PID 2316 wrote to memory of 1904	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	200
PID 2316 wrote to memory of 540	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	204
PID 2452 wrote to memory of 3208	2452	fdyvqoigay.exe	206
PID 2316 wrote to memory of 3184	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	209
PID 2316 wrote to memory of 2080	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	213
PID 4152 wrote to memory of 2296	4152	iysnlfdxvq.exe	215
PID 2316 wrote to memory of 3324	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	218
PID 2316 wrote to memory of 3996	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	222
PID 4332 wrote to memory of 1148	4332	faysqkidav.exe	224
PID 2316 wrote to memory of 3544	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	227
PID 2316 wrote to memory of 4864	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	231
PID 1956 wrote to memory of 2176	1956	xvpnhfzxsp.exe	233
PID 2316 wrote to memory of 1552	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	236
PID 2316 wrote to memory of 2336	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	240
PID 2532 wrote to memory of 3116	2532	usmkecxupm.exe	242
PID 2316 wrote to memory of 3000	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	245
PID 2316 wrote to memory of 468	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	249
PID 3960 wrote to memory of 800	3960	zusmkeuomh.exe	251
PID 2316 wrote to memory of 828	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	254
PID 2316 wrote to memory of 4264	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	258
PID 3212 wrote to memory of 1016	3212	uomhezxrpj.exe	260
PID 2316 wrote to memory of 3472	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	263
PID 2316 wrote to memory of 2368	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	267
PID 4636 wrote to memory of 3036	4636	ojhbztrlje.exe	269
PID 2316 wrote to memory of 1056	2316	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1152
- - C:\Temp\ezurmkecwu.exe
    C:\Temp\ezurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1916
- - C:\Temp\i_ezurmkecwu.exe
    C:\Temp\i_ezurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezpjhcwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\gezpjhcwuo.exe
    C:\Temp\gezpjhcwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezpjhcwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Temp\i_gezpjhcwuo.exe
    C:\Temp\i_gezpjhcwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1252
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytrljdbwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Temp\aytrljdbwt.exe
    C:\Temp\aytrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytrljdbwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_aytrljdbwt.exe
    C:\Temp\i_aytrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Temp\dxvqnifays.exe
    C:\Temp\dxvqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_dxvqnifays.exe
    C:\Temp\i_dxvqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2908
- - C:\Temp\axsqkicavs.exe
    C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Temp\i_axsqkicavs.exe
    C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4616
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1344
- - C:\Temp\wrpjhbzurm.exe
    C:\Temp\wrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Temp\i_wrpjhbzurm.exe
    C:\Temp\i_wrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4876
- - C:\Temp\trljezwrpj.exe
    C:\Temp\trljezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2712
- - C:\Temp\i_trljezwrpj.exe
    C:\Temp\i_trljezwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:4888
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:1904
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run
  2⤵
  PID:540
- - C:\Temp\fdyvqoigay.exe
    C:\Temp\fdyvqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins
  2⤵
  PID:3184
- - C:\Temp\i_fdyvqoigay.exe
    C:\Temp\i_fdyvqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\iysnlfdxvq.exe ups_run
  2⤵
  PID:2080
- - C:\Temp\iysnlfdxvq.exe
    C:\Temp\iysnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_iysnlfdxvq.exe ups_ins
  2⤵
  PID:3324
- - C:\Temp\i_iysnlfdxvq.exe
    C:\Temp\i_iysnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkidav.exe ups_run
  2⤵
  PID:3996
- - C:\Temp\faysqkidav.exe
    C:\Temp\faysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkidav.exe ups_ins
  2⤵
  PID:3544
- - C:\Temp\i_faysqkidav.exe
    C:\Temp\i_faysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  PID:4864
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  PID:1552
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupm.exe ups_run
  2⤵
  PID:2336
- - C:\Temp\usmkecxupm.exe
    C:\Temp\usmkecxupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupm.exe ups_ins
  2⤵
  PID:3000
- - C:\Temp\i_usmkecxupm.exe
    C:\Temp\i_usmkecxupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkeuomh.exe ups_run
  2⤵
  PID:468
- - C:\Temp\zusmkeuomh.exe
    C:\Temp\zusmkeuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkeuomh.exe ups_ins
  2⤵
  PID:828
- - C:\Temp\i_zusmkeuomh.exe
    C:\Temp\i_zusmkeuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run
  2⤵
  PID:4264
- - C:\Temp\uomhezxrpj.exe
    C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins
  2⤵
  PID:3472
- - C:\Temp\i_uomhezxrpj.exe
    C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:2368
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:1056
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
- Executes dropped EXE
PID:3640

C:\Temp\ywrojgbztr.sys
C:\Temp\ywrojgbztr.sys
1⤵
- Executes dropped EXE
PID:3760

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\igtqljdbvt.sys
C:\Temp\igtqljdbvt.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:668

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:1148

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\mhfzxrpkhc.sys
C:\Temp\mhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\ztolgeywqo.sys
C:\Temp\ztolgeywqo.sys
1⤵
PID:4852

C:\Temp\ytjdbvtnlg.sys
C:\Temp\ytjdbvtnlg.sys
1⤵
PID:4452

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
PID:1016

C:\Temp\nlfdxvqnig.sys
C:\Temp\nlfdxvqnig.sys
1⤵
PID:4636

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
PID:4528

C:\Temp\nhfzxspcau.sys
C:\Temp\nhfzxspcau.sys
1⤵
PID:3108

C:\Temp\hfzxrpkhcz.sys
C:\Temp\hfzxrpkhcz.sys
1⤵
PID:3468

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:3476

C:\Temp\wuomgezwro.sys
C:\Temp\wuomgezwro.sys
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.exe

Path C:\Temp\axsqkicavs.exe
Size 243KB
SHA256 3dcd3999f7af477252c8545678b9fea0dbfd83656cc8baf7afc927f83b0ec801
MD5 8cc0ebba6b1d22e0536f46a8a973a670
SHA1 640728769f84e477ecda0624265a8afd16058ce9
SHA512 454bc0e79f42211b79c4f797a0d83e90780e5b6ca81f0226d18f8ef4d24e69bb70564d4b7bc33e2919acb00abfc1116699d082210f7a364022610f2929895176
SSDEEP 3072:7hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:9n7nLQka3lLNngoqRttA7B
TLSH
T13D34490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytrljdbwt.exe

Path C:\Temp\aytrljdbwt.exe
Size 243KB
SHA256 e922100618e1eb5c11be02652fcb6bed2a59eeec58eefb56589ffc8a9a434700
MD5 4e9c6355876de3450b72f79e663e61d9
SHA1 266288059b6f2754f78df115b4f1828c611b5913
SHA512 9bd30b820e0816d23b12634b6d34688f64ce908e6ca649c2be1108cb27b7ec23ba59d234575e73c0e30d4e6a034c599e912e7a5ac27ae555dec86f8059b9c4b7
SSDEEP 3072:5hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:3n7nLQka3lLNngoqRttA7f
TLSH
T1B634590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifays.exe

Path C:\Temp\dxvqnifays.exe
Size 243KB
SHA256 d8d596b5cedac1c0f2cfcf25719695985dbf07770d72c3e46f265926c97fa3f9
MD5 5e8c1c0b58a94b89790dbac63b9fa007
SHA1 505c8a55b77c994c7306ec4b0f33ac763ce4e1ed
SHA512 6d098f5c4820e615a9de2b647973d0244910cd43cb3565b3e8ba8b7290c1f0b00dd66e9f653ab9709cc6b19a4e6c14478826daf27bf801dab7c87aaf911a1dae
SSDEEP 3072:Qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:In7nLQka3lLNngoqRttA7W
TLSH
T10734490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezurmkecwu.exe

Path C:\Temp\ezurmkecwu.exe
Size 243KB
SHA256 8d4abd191f3cea03f2e93b4a595c4a079298ef099ccfed637f7ab2500d12903e
MD5 7e4eda9aafcc754c9afcfe39083079b8
SHA1 489560c8cc313e2e0351eaff870afb8e1d093153
SHA512 797586bff641ad86e249a49283936b54399dd98f23b1f4933a25b1e64c95786b94b25e21b5e80dbe8cdd76842da43d28c0c97df03f608c31740da83da2b81463
SSDEEP 3072:Ghn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:an7nLQka3lLNngoqRttA7c
TLSH
T12B34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezpjhcwuo.exe

Path C:\Temp\gezpjhcwuo.exe
Size 243KB
SHA256 0d86b7758daed535869c8e2a3eac380ecf35df1e425c931bad8948a8a3a2aaa0
MD5 2648affec4136b22992004fadaa3a941
SHA1 cb6b6d0114f5b7144d14d6c69acbe4c65aa4a33e
SHA512 9971415fd494b1fb6e0498f91c14e9485ba15a974e16f10412a857afb19e3edb0aad1ef170b2586251a55356c3ed2789a59aebe0af9d768345c875edbdd34f7d
SSDEEP 3072:rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:tn7nLQka3lLNngoqRttA75
TLSH
T18A34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicavs.exe

Path C:\Temp\i_axsqkicavs.exe
Size 243KB
SHA256 2d7559b1bc990d3fc8eafbb2523efa5aad7b819af6d30af66a4fc12f0fc80f67
MD5 fa9ca28c6777d431e3fe25b1b4782654
SHA1 4599f272a1c28df3daabec6275de3c8df957f0eb
SHA512 05e2ad3c8cae805395a68724f4cccbce59edc4d02f0cdb406c975aa8a972a99328ec559b6469cbbce77bc11546a3c1460890d5fba1222dd78cbddbf7e96e66d5
SSDEEP 3072:Yhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:gn7nLQka3lLNngoqRttA7G
TLSH
T17F34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytrljdbwt.exe

Path C:\Temp\i_aytrljdbwt.exe
Size 243KB
SHA256 c8c501d3863bc6df845ad296c77b148b7482f6dd13197efe8756e49e30063051
MD5 b44ee950b29c92e1b281f1181d8126b4
SHA1 fa736ce2588278ed5b3ddddc0f4cb4048647e375
SHA512 ee0b19354bf8707692e2f525458bc0118be32284b646e4e697e803bd3a4be855a810b9f533855ad1b41c326cfc97d9a7e813ef6a2afe3aec3e7d5806386f6bda
SSDEEP 3072:1hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:rn7nLQka3lLNngoqRttA7/
TLSH
T1FA34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqnifays.exe

Path C:\Temp\i_dxvqnifays.exe
Size 243KB
SHA256 d44eb1957a790ec3b00e397cb3eefe139b1bf3c9201db4b70f8f80b4417de68e
MD5 e704d7f4e47d5d56061f404ee6bb9945
SHA1 84ebf7cc20271d8e0dccd24316563e406158f358
SHA512 dbd9c28c391548b1b7960b7cb13f26c61356c6fcdd2ab8e85c475571c644676b5a6ded98bc59a01dd827d2056bfad752edbd40ba66f8bb30111fc9f9b45c3af8
SSDEEP 3072:ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Cn7nLQka3lLNngoqRttA7s
TLSH
T19534590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezurmkecwu.exe

Path C:\Temp\i_ezurmkecwu.exe
Size 243KB
SHA256 57ec084403572adaa2320f93b8cb8477cefb77fab40b881d85f324afbec3471e
MD5 b738158068537c051bbeffbe3c60a407
SHA1 82c27437a57b1c15a063cc6baec5209e51302112
SHA512 674d4243f4c1fb41c55dec9d7b18164aec53c70cc7aedf953f6e9a7e41c1982ddb24db1ce3776a0c9570682c0f88a99ceb429cb4121beca58f9adf73b2a4c89a
SSDEEP 3072:9hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:Dn7nLQka3lLNngoqRttA77
TLSH
T1FC34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezpjhcwuo.exe

Path C:\Temp\i_gezpjhcwuo.exe
Size 243KB
SHA256 f3d0a7cb289b4603a15afb41e967d2103b52dabf172e7d0f5e810f94304a980b
MD5 f2556dcdd466be7ab291b08395604f7f
SHA1 4640cb4e341f836522ea9a0ec394ee50b0a50d39
SHA512 0582c0c9409d1df611f646846b9e51e45848e8ebbf2e931c9f5e27059f4071817b6c20cb0db54a9700ff911717680046fde14e85679796692018485c41a5a300
SSDEEP 3072:Qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:In7nLQka3lLNngoqRttA7i
TLSH
T14C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxvpnhf.exe

Path C:\Temp\i_nkfcxvpnhf.exe
Size 243KB
SHA256 745205afe3bbd7459bf2bfff3fa19f9845a3e3cc98beb94ee63a31bad9f0d33d
MD5 1880e3a90da91d3de99ad9c4321572f6
SHA1 a2e75db202e285c654a41106d8f81a82d58b6c57
SHA512 18952fa1d186f0e22aefe6e35623096d28e91e5cbb87d214eddafb9bc89e5d02011495e7b945b5b6c08cb2f9836c2918a0b8d85a4ebfcba690d0e4758f31acb6
SSDEEP 3072:Lhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:Nn7nLQka3lLNngoqRttA7Z
TLSH
T10534590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebwuomg.exe

Path C:\Temp\i_rljebwuomg.exe
Size 243KB
SHA256 fbd7a52711904086ef819b67d9362df8241ac82f69a2b6027a1f2b5cb83ff016
MD5 58d8cf89142333341585d52bef57da5f
SHA1 8b76acbc6724d825cccaa491aa3bbe810c405059
SHA512 49c572bb206cbe9356cf42f0818202c56dfc4938ecebcb9e0695b27cada89df88632e4fe269cf68a9e6cd673baf4e67a1ffe3e3b36221befe859d3948107c977
SSDEEP 3072:Zhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:Xn7nLQka3lLNngoqRttA7X
TLSH
T17D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdyvqoi.exe

Path C:\Temp\i_tnlgdyvqoi.exe
Size 243KB
SHA256 6401bfd1c95763f9af4d9c16edc898ff2040d2354c98ff07c046787219a3607a
MD5 c1d1e669d56f520cd2900714eeb2f876
SHA1 847849a3d196d952fa61f4418541d03ef776d327
SHA512 7d8ef88b6a239fdba0ebf5eceb12b36d32b017bbdfb16275c10b625dbed3c79deb25c214123724ef240e523fae5f8c64c9ba5bc02403cca1f46d8cec0ee56deb
SSDEEP 3072:uhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:Sn7nLQka3lLNngoqRttA7w
TLSH
T1E934590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igtqljdbvt.sys

Path C:\Temp\igtqljdbvt.sys
Size 141KB
SHA256 e41dbf3af49fb981bda6ebdc06c739524a0da5c5c2bb4e5ad453a7a30d01a322
MD5 307255dc89cdeccbc2d8f4ae2b522c69
SHA1 47926c83c3826f3175af61fb0979e5ccb81c809f
SHA512 ad42929597f540adc1e03ce488a29692190daddd553dffcc13b01e8b0a4ef35bfd82c75c484f2a1436019ddf524dbec255e6b9c435cd3e37202545550f2cd862
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.sys

Path C:\Temp\lfdxvpnifa.sys
Size 141KB
SHA256 3aa817c5d375a484a5e8980a8a640cab808844f955bbd42b341ba42484ad7778
MD5 86fc863a3366f899d8a7eb593a28ecd6
SHA1 0ff860349821d082e426a98db0dc7eca678bb3b8
SHA512 c66e472c403c598aa02f7588492cc65f3885129cb5c1402d97355e88fb8785ee58a082323eeea685452ead2d774bc472bf63c1aa4addfadc042cc2c17468a1f5
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.sys

Path C:\Temp\lgeywqoigb.sys
Size 141KB
SHA256 28d378a66a30df79a597995fcf1a0ec552545528cb1df68e354e4a12716e5806
MD5 b4ea737ae41911d4db699bd6e5f67e43
SHA1 f78bab3eefae6ef308f106843ae0cd91d982d592
SHA512 0233f486aebebe977fbbcc03e5dd5e1c9d056b8cabf7470bf16c46c6d0266165c9973c4d5eacbf7bfecb324504e484049df2fdcac3a056f356c211244279ba8e
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DAE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.exe

Path C:\Temp\nkfcxvpnhf.exe
Size 243KB
SHA256 db8e3f83417973a9961307ab64faa714dc32cae99bbdbeb69f8d7dd21fbfd8d7
MD5 b1902914873dd5ce6806e6e108928ed0
SHA1 ca88dcda58657079f94becd1c111fa236aa0dd33
SHA512 67223bd98c18b8704b543b8bbc2b4c825817b957f450c3dc71cea2fe8bf9999fd8a42d5dd2494535cf3cc5e5df41c9c9cc3bff75c3ab3d700471c730ef1524dd
SSDEEP 3072:rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:tn7nLQka3lLNngoqRttA7F
TLSH
T1DA34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjh.sys

Path C:\Temp\omgezwrpjh.sys
Size 141KB
SHA256 d961ecda865de51ef1288cc840b555ecb9daf629fa0e053fd5a33cc26c9804d5
MD5 b9fc4ae3b4c539a34b6202f5ae33ec59
SHA1 e1a396bf49be1fa94e0a559cec059f4109c2080e
SHA512 d47812bc60090b073bb4b74f3ec1bc0e16ebffb7656f278d4f30b24cacb918ed7d8605e6ff24106f74ff4982e5ec653b8f30ad70c7d6eca88741bf2d281deac3
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.exe

Path C:\Temp\rljebwuomg.exe
Size 243KB
SHA256 661e9f556ee707aadfc7cd45a5fd2f209fb90f16be36d2527e14d01ffaa75700
MD5 0c398b3f67ff14c74ee43a28f4063249
SHA1 7a5b599b85f58dabdab3d085705907a41c5a5c61
SHA512 030ceaf7c685fc55378ef784964a17b63b04a18965496aafa5939d9da9833537abb62de21b0adebbb22c9f2ae3bfca4b258a56b69bd7317d1cbf381111e93870
SSDEEP 3072:ihn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:en7nLQka3lLNngoqRttA7k
TLSH
T16234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.sys

Path C:\Temp\sqkidavtnl.sys
Size 141KB
SHA256 eab9fc475fdd8094c1615f02964fc306960e420d167f16c22c0342f58d95b3bf
MD5 7564d687981822523df3bbea38d5fef0
SHA1 4b913e8dae8ee8d23a116358d8cfba3f31e76f90
SHA512 b1d37d023964680b260954e4a53be345fea134ab4fc9d67e211e00d4c5932473ca548e94174bdcd77150185864fcdb6a59e54be6d114c647afd8a52aa30f1649
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoi.exe

Path C:\Temp\tnlgdyvqoi.exe
Size 243KB
SHA256 cfc92d3d3e1746e15fddeb4e753dac339ee9c05488ab7f185f6501d794f21d85
MD5 632a238261d8a59ab985bee4ebe1512a
SHA1 678c06fde058d9d7f53727149633e1dc9bbf5f65
SHA512 9e9b41c3bf4f075003e6e94dd6c5f98de0159a9b1f10a36c41fc782b0e7be000251a0ccb60f41edc601bbc3fcca26f5d9f0264e9fe99d6ff05ccdb65bd5fb53c
SSDEEP 3072:Uhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:kn7nLQka3lLNngoqRttA7e
TLSH
T19D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupn.sys

Path C:\Temp\usmkfcxupn.sys
Size 141KB
SHA256 804ceab1394f75a498e8efecf3f3ab175c5685b2b3a9b18c7e7653c53f6266cf
MD5 6536c787845877a411025c29c4ca6c54
SHA1 adc874a8cc6498780c179f591ae141a8edeb9a3b
SHA512 017bb5373411ba12e5a15391b41b78b0b755503b46c9a63910dfd51bbd606b465c99f44c405538ef6e9b6c441ad7947176b92c156aa3415da650af28043a85ac
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztr.sys

Path C:\Temp\ywrojgbztr.sys
Size 141KB
SHA256 7aca0b01c8a17af817ac20983389ae0804d5a8ffb285d54ce95e1c203fd105ab
MD5 2f160647217a22a20e5aba8b27cb2334
SHA1 2f8766bc26082d4cb3eb981b9e9f6a2410c24286
SHA512 a4d3d72407b8814d4548748e985152eaa8450846c1d656e887b4f433b5dfbd7bf99ac4041746c90a38845021d3918d8b408e74dfcfb2bd4c14c0e14fe0d87b8f
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FVK2FCOF\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-68-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1016-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-80-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1488-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1764-103-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2316-32-0x0000000000410000-0x000000000044D000-memory.dmp

Download

memory/2372-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3108-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3468-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3476-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3640-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-39-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4528-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-54-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4852-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4888-92-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads