3ab60e91e228a47311cab5d8d7f6c99edb03235bfff51d012ad970af01c87f6c

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
Size 243KB
Sample260415-t321jsgt3s
SHA256 3ab60e91e228a47311cab5d8d7f6c99edb03235bfff51d012ad970af01c87f6c
MD5 5901bff4fbac5602581ab3ce00e38812
SHA1 c114003551099fa30b7aa6daaa3ebc4710e429cc
SHA512 550b098e516f13252e2fb209281b954b12f33aa7ceacdcd22555ae2fcd2a29a109a9db56c399ea5c481dacd4b7c6b8e598118c9cdcddfba5ebfa0752f371290f
SSDEEP 3072:M+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:M+59tBBLkQa3lLNngoqRttA7Z
TLSH
T18834490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
900	CP.exe
1276	wuomgeywro.exe
4196	CP.exe
2836	CP.exe
4812	i_wuomgeywro.exe
2628	trljdbvtol.sys
4884	CP.exe
3516	mgeytrljdb.exe
3520	CP.exe
5040	CP.exe
3508	i_mgeytrljdb.exe
1376	oigbytrljd.sys
3868	CP.exe
2892	vqoigaysql.exe
1512	CP.exe
4900	CP.exe
4068	i_vqoigaysql.exe
5000	vqlidbvtnl.sys
4744	CP.exe
2912	lgaysqkida.exe
3304	CP.exe
4936	CP.exe
3156	i_lgaysqkida.exe
2180	favsnlfdxv.sys
4516	CP.exe
3744	vqkicausnk.exe
1684	CP.exe
4640	CP.exe
2580	i_vqkicausnk.exe
5116	kicausnkfd.sys
4552	CP.exe
3624	zxspkicaus.exe
1136	CP.exe
1284	CP.exe
3612	i_zxspkicaus.exe
2288	rpkhcausmk.sys
1324	CP.exe
2292	upmhcwupmh.exe
4432	CP.exe
3456	CP.exe
1940	i_upmhcwupmh.exe
1072	wupmhfzxrp.sys
764	CP.exe
224	zurmkecwrb.exe
4784	CP.exe
4448	CP.exe
788	i_zurmkecwrb.exe
2888	mgezwrojhb.sys
2276	CP.exe
4408	bztrmjecwu.exe
1740	CP.exe
4364	CP.exe
4976	i_bztrmjecwu.exe
4372	ojgbztrljd.sys
3188	CP.exe
4932	vtolgbztrl.exe
1540	CP.exe
3880	CP.exe
1060	i_vtolgbztrl.exe
4564	gbytjdbvtn.sys
1408	CP.exe
4816	nlfdyvqoig.exe
2280	CP.exe
3772	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aykidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwrb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwrb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaysqkida.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3008	ipconfig.exe
5028	ipconfig.exe
4140	ipconfig.exe
2064	ipconfig.exe
640	ipconfig.exe
5036	ipconfig.exe
3428	ipconfig.exe
1884	ipconfig.exe
452	ipconfig.exe
3448	ipconfig.exe
2392	ipconfig.exe
4112	ipconfig.exe
724	ipconfig.exe
4448	ipconfig.exe
3220	ipconfig.exe
2088	ipconfig.exe
112	ipconfig.exe
1520	ipconfig.exe
2672	ipconfig.exe
3268	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000453d8c044d2e7b409aa2a2ec94653b5200000000020000000000106600000001000020000000d966896e4081aa63aafc7de0f8adad416e501ad0f06288fcaec185a334368b49000000000e8000000002000020000000366a6ece24243434ec10f29773557f4a9bc3f9b606df8f1dd7fb88086a5ed33820000000ee62a91192c34d6ec5b9f4a7d50efdc411f6014b673b4fcd6576c6a3c13367a8400000005fa740d9814f38d4d55e794f607c31935074100e22672fdf6d3a2e71109507ca5257e56e27cbbf75ddecd5588f8ca11037c8b59df64aae3e981b3d64e48ee6a7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10359dd000cddc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "483036972"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9934B039-38EB-11F1-A84F-F634701597AD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207a98d000cddc01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000453d8c044d2e7b409aa2a2ec94653b520000000002000000000010660000000100002000000076b3e32f80cef7f9b50424ddfd9bce0e6ab29e46382067016abdea1d828a81a6000000000e8000000002000020000000777868021dd97b8499ca1af73112934c229132a10cb960e298392be62db820b82000000053b4a8b948d6d36cd686b09618eb621a05d3507293af375d32a2d2f84252829b40000000ba81c33014fd48d13feaf59ac49bf61076377e86272f1b129b9026220a7ff4c2dab581737088087d8860e23994fbf0dfd45d683a8cc675499be4d7d812bf5896	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	i_wuomgeywro.exe
Token: SeDebugPrivilege	3508	i_mgeytrljdb.exe
Token: SeDebugPrivilege	4068	i_vqoigaysql.exe
Token: SeDebugPrivilege	3156	i_lgaysqkida.exe
Token: SeDebugPrivilege	2580	i_vqkicausnk.exe
Token: SeDebugPrivilege	3612	i_zxspkicaus.exe
Token: SeDebugPrivilege	1940	i_upmhcwupmh.exe
Token: SeDebugPrivilege	788	i_zurmkecwrb.exe
Token: SeDebugPrivilege	4976	i_bztrmjecwu.exe
Token: SeDebugPrivilege	1060	i_vtolgbztrl.exe
Token: SeDebugPrivilege	4576	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	5108	i_nlyvqoigay.exe
Token: SeDebugPrivilege	3024	i_icavsnlfdx.exe
Token: SeDebugPrivilege	2112	i_axsqkicaus.exe
Token: SeDebugPrivilege	2504	i_upmhcausmk.exe
Token: SeDebugPrivilege	3616	i_pjhurmkecw.exe
Token: SeDebugPrivilege	468	i_ezwrojecwu.exe
Token: SeDebugPrivilege	2816	i_rljebwtomg.exe
Token: SeDebugPrivilege	2900	i_aytqljeywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4696	iexplore.exe
4696	iexplore.exe
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 4696	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	85
PID 4696 wrote to memory of 3796	4696	iexplore.exe	86
PID 3812 wrote to memory of 900	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	87
PID 1276 wrote to memory of 4196	1276	wuomgeywro.exe	90
PID 3812 wrote to memory of 2836	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	93
PID 3812 wrote to memory of 4884	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	98
PID 3516 wrote to memory of 3520	3516	mgeytrljdb.exe	100
PID 3812 wrote to memory of 5040	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	103
PID 3812 wrote to memory of 3868	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	107
PID 2892 wrote to memory of 1512	2892	vqoigaysql.exe	109
PID 3812 wrote to memory of 4900	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	112
PID 3812 wrote to memory of 4744	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	116
PID 2912 wrote to memory of 3304	2912	lgaysqkida.exe	118
PID 3812 wrote to memory of 4936	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	121
PID 3812 wrote to memory of 4516	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	127
PID 3744 wrote to memory of 1684	3744	vqkicausnk.exe	129
PID 3812 wrote to memory of 4640	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	132
PID 3812 wrote to memory of 4552	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	136
PID 3624 wrote to memory of 1136	3624	zxspkicaus.exe	138
PID 3812 wrote to memory of 1284	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	141
PID 3812 wrote to memory of 1324	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	145
PID 2292 wrote to memory of 4432	2292	upmhcwupmh.exe	147
PID 3812 wrote to memory of 3456	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	150
PID 3812 wrote to memory of 764	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	154
PID 224 wrote to memory of 4784	224	zurmkecwrb.exe	156
PID 3812 wrote to memory of 4448	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	159
PID 3812 wrote to memory of 2276	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	166
PID 4408 wrote to memory of 1740	4408	bztrmjecwu.exe	168
PID 3812 wrote to memory of 4364	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	172
PID 3812 wrote to memory of 3188	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	178
PID 4932 wrote to memory of 1540	4932	vtolgbztrl.exe	180
PID 3812 wrote to memory of 3880	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	183
PID 3812 wrote to memory of 1408	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	187
PID 4816 wrote to memory of 2280	4816	nlfdyvqoig.exe	189
PID 3812 wrote to memory of 3772	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	192
PID 3812 wrote to memory of 856	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	196
PID 4320 wrote to memory of 3212	4320	nlyvqoigay.exe	198
PID 3812 wrote to memory of 3408	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	201
PID 3812 wrote to memory of 1904	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	205
PID 3160 wrote to memory of 4112	3160	icavsnlfdx.exe	207
PID 3812 wrote to memory of 4008	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	210
PID 3812 wrote to memory of 2736	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	214
PID 2064 wrote to memory of 3620	2064	axsqkicaus.exe	216
PID 3812 wrote to memory of 4020	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	219
PID 3812 wrote to memory of 4060	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	223
PID 4716 wrote to memory of 4564	4716	upmhcausmk.exe	225
PID 3812 wrote to memory of 4232	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	228
PID 3812 wrote to memory of 1964	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	232
PID 544 wrote to memory of 3084	544	pjhurmkecw.exe	234
PID 3812 wrote to memory of 4400	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	237
PID 3812 wrote to memory of 1176	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	241
PID 2656 wrote to memory of 4652	2656	ezwrojecwu.exe	243
PID 3812 wrote to memory of 4648	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	246
PID 3812 wrote to memory of 3104	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	250
PID 4976 wrote to memory of 3916	4976	rljebwtomg.exe	252
PID 3812 wrote to memory of 4728	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	255
PID 3812 wrote to memory of 3480	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	259
PID 4148 wrote to memory of 4620	4148	aytqljeywq.exe	261
PID 3812 wrote to memory of 3468	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	264
PID 3812 wrote to memory of 3508	3812	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	268
PID 3828 wrote to memory of 1844	3828	aykidavtnl.exe	270

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4696 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:900
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Temp\mgeytrljdb.exe
    C:\Temp\mgeytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\i_mgeytrljdb.exe
    C:\Temp\i_mgeytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Temp\vqoigaysql.exe
    C:\Temp\vqoigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Temp\i_vqoigaysql.exe
    C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4744
- - C:\Temp\lgaysqkida.exe
    C:\Temp\lgaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4936
- - C:\Temp\i_lgaysqkida.exe
    C:\Temp\i_lgaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\vqkicausnk.exe
    C:\Temp\vqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\i_vqkicausnk.exe
    C:\Temp\i_vqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\zxspkicaus.exe
    C:\Temp\zxspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1284
- - C:\Temp\i_zxspkicaus.exe
    C:\Temp\i_zxspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhcwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\upmhcwupmh.exe
    C:\Temp\upmhcwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhcwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3456
- - C:\Temp\i_upmhcwupmh.exe
    C:\Temp\i_upmhcwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwrb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:764
- - C:\Temp\zurmkecwrb.exe
    C:\Temp\zurmkecwrb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwrb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\i_zurmkecwrb.exe
    C:\Temp\i_zurmkecwrb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\bztrmjecwu.exe
    C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Temp\i_bztrmjecwu.exe
    C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Temp\vtolgbztrl.exe
    C:\Temp\vtolgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\i_vtolgbztrl.exe
    C:\Temp\i_vtolgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1408
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlyvqoigay.exe ups_run
  2⤵
  PID:856
- - C:\Temp\nlyvqoigay.exe
    C:\Temp\nlyvqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlyvqoigay.exe ups_ins
  2⤵
  PID:3408
- - C:\Temp\i_nlyvqoigay.exe
    C:\Temp\i_nlyvqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnlfdx.exe ups_run
  2⤵
  PID:1904
- - C:\Temp\icavsnlfdx.exe
    C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnlfdx.exe ups_ins
  2⤵
  PID:4008
- - C:\Temp\i_icavsnlfdx.exe
    C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  PID:2736
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  PID:4020
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhcausmk.exe ups_run
  2⤵
  PID:4060
- - C:\Temp\upmhcausmk.exe
    C:\Temp\upmhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhcausmk.exe ups_ins
  2⤵
  PID:4232
- - C:\Temp\i_upmhcausmk.exe
    C:\Temp\i_upmhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhurmkecw.exe ups_run
  2⤵
  PID:1964
- - C:\Temp\pjhurmkecw.exe
    C:\Temp\pjhurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhurmkecw.exe ups_ins
  2⤵
  PID:4400
- - C:\Temp\i_pjhurmkecw.exe
    C:\Temp\i_pjhurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrojecwu.exe ups_run
  2⤵
  PID:1176
- - C:\Temp\ezwrojecwu.exe
    C:\Temp\ezwrojecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrojecwu.exe ups_ins
  2⤵
  PID:4648
- - C:\Temp\i_ezwrojecwu.exe
    C:\Temp\i_ezwrojecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtomg.exe ups_run
  2⤵
  PID:3104
- - C:\Temp\rljebwtomg.exe
    C:\Temp\rljebwtomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtomg.exe ups_ins
  2⤵
  PID:4728
- - C:\Temp\i_rljebwtomg.exe
    C:\Temp\i_rljebwtomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljeywq.exe ups_run
  2⤵
  PID:3480
- - C:\Temp\aytqljeywq.exe
    C:\Temp\aytqljeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljeywq.exe ups_ins
  2⤵
  PID:3468
- - C:\Temp\i_aytqljeywq.exe
    C:\Temp\i_aytqljeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aykidavtnl.exe ups_run
  2⤵
  PID:3508
- - C:\Temp\aykidavtnl.exe
    C:\Temp\aykidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:452

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:2628

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\vqlidbvtnl.sys
C:\Temp\vqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\favsnlfdxv.sys
C:\Temp\favsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2180

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
- Executes dropped EXE
PID:2288

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:1072

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:2888

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:4372

C:\Temp\gbytjdbvtn.sys
C:\Temp\gbytjdbvtn.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
PID:3944

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:3776

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
PID:5104

C:\Temp\nhfzxspcau.sys
C:\Temp\nhfzxspcau.sys
1⤵
PID:4428

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
PID:1832

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
PID:3764

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
PID:4868

C:\Temp\tomywqoigb.sys
C:\Temp\tomywqoigb.sys
1⤵
PID:1168

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favsnlfdxv.sys

Path C:\Temp\favsnlfdxv.sys
Size 141KB
SHA256 2a6c457c71654967b054724eb70b21ca36ffd86a748d7e300bdbf0f5ebb99768
MD5 402d34b3afd6b14741e034061bc77c50
SHA1 58510a39a6a3aa536b50f75ba023ed9901efd20d
SHA512 e385e9520d626ac2e8048fda22907b8ab7720265613bc49217bfea524eb835adc1d1220212b458f00a0b6e4b73645c0b52febb045f8fd96602ecfec822381f54
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgaysqkida.exe

Path C:\Temp\i_lgaysqkida.exe
Size 243KB
SHA256 f2abcb5f4e35dfe5fd152ecd59c46588d112e045e26a49eb43607d5e8d386108
MD5 329d59b020d82423d7839284c3f0d86e
SHA1 4e6536ce8edbfb879fe2ff44c28425b759af5f7c
SHA512 3ba636f86a2e27227dee8b923623e3eb4ba48c6a96d0c961c98b3dec15370930c87b5726b2c916874f66cf2d20423b97813e4b4e856b5dde123b7ef4de98d093
SSDEEP 3072:u+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:u+59tBBLkQa3lLNngoqRttA7f
TLSH
T1E734490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeytrljdb.exe

Path C:\Temp\i_mgeytrljdb.exe
Size 243KB
SHA256 bd88c6d591c44bcd23f2c7da2e2a7123428133927909af6cc12dd02fef8cf55d
MD5 e0e7caa804014606f02c5a6615d5f98d
SHA1 63a692d904e494f052b24ef3a4093434f0951ba7
SHA512 45c441b19565c8d53dfe4bb8cca77ef676570d3ef9fa60a92a805727548fb1c8d402d2eb1f95ce3638a583891a4f49dc72b69ecc5becdf763d7a92f063cdca4a
SSDEEP 3072:3+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:3+59tBBLkQa3lLNngoqRttA7g
TLSH
T15E34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhcwupmh.exe

Path C:\Temp\i_upmhcwupmh.exe
Size 243KB
SHA256 47a20340f6614f514211b41c4981bf27cb8bc230c27b7eb1300cb4ff43c4797a
MD5 7143844ea8a571f6d2e94f332b69a8ea
SHA1 ad5e709ee00c7a3168e557fe13b0796a8b2be224
SHA512 1a8bb676f3930e03fe428fbca992cc83433c9561ed3d0cde1a686c293519ab193dee9b74fc63b47d1e41fc96af48ec97c406d3e02f74646413096cba96a992f1
SSDEEP 3072:w+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:w+59tBBLkQa3lLNngoqRttA7B
TLSH
T1DC34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqkicausnk.exe

Path C:\Temp\i_vqkicausnk.exe
Size 243KB
SHA256 a3f25935054183159a5d023122a1ea77e9ac58bcf5ce2f91f0b4bb3340dac975
MD5 7869feebfae9e3b4c9034cd84c749dd6
SHA1 c5f88cde87963ce0d0cb8db54fad0a27c40fb6ee
SHA512 c8d3597c9e41f90f2adb5a3fe5a4294ffb67a60828dee5b56b2e22923ae36c3792dc02f57fc6f51dab47dcc9a032473e25e2abfacf1fe83c2eb8998b2daa0b24
SSDEEP 3072:5+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:5+59tBBLkQa3lLNngoqRttA7y
TLSH
T10734490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigaysql.exe

Path C:\Temp\i_vqoigaysql.exe
Size 243KB
SHA256 7f545119b5be1e5bb28f61d42cd2fa179faebb8903cdeb12e9c9bb6992f5d3d0
MD5 697e0c757a10fb603644d547ef7b2632
SHA1 cd06bd13af2129ee8f829551ebe3932b13abb335
SHA512 c3d0f5d54b6edb891559b34443ecfb39d10c6b4a612b61c77e0d15c20cbc55ef50324b0fb7901bc35b73f36dcb4d1884b26f7b648094803a6304ca437a8838bc
SSDEEP 3072:P+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:P+59tBBLkQa3lLNngoqRttA7g
TLSH
T1FF34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 243KB
SHA256 c92ee7304eb2551409b1a1c6f81e9a7c5a6c863fce378985a5d810cdfce8b4a4
MD5 12e300462d6018e68d3fc8bd3d1b2195
SHA1 91b63ea4ec24e0664e75b3da1662e05eacd31fa5
SHA512 a6d25eb7a90585fd0d1254f2e30bca7f277fccb28391782a1bc95b1cb6f4a0a994f2c6b1452b8446a78cb997f04c21e07ba3eceef09543172600c0d7851e997c
SSDEEP 3072:n+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:n+59tBBLkQa3lLNngoqRttA74
TLSH
T13234490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwrb.exe

Path C:\Temp\i_zurmkecwrb.exe
Size 243KB
SHA256 d98335a187b4fb53954875920044a25d8791e1ef68f21a34a74b7e02d7c0de0b
MD5 1605e3c44218891ed7fb3a5f82207947
SHA1 b835e064787ab3d079cee0d4ea6e6b5c8fd3bd40
SHA512 5159f63a7c9ed2def2ca62f44185afcfa1115a3a65bd5a22ecb5b08a8d60c014ffcb77986ac3c7f5504aff26af7fc155f8e8ccc5482a03058075e30fb626449c
SSDEEP 3072:i+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:i+59tBBLkQa3lLNngoqRttA7b
TLSH
T17334490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxspkicaus.exe

Path C:\Temp\i_zxspkicaus.exe
Size 243KB
SHA256 f0c91e93af3d7abd766626d3e3e2bfd6643a8198fec27e208af55c44f2c81723
MD5 b610c530378bff32fed12074f6375fde
SHA1 680d35812ba821e7ee93f3daccf193f41b8e41ee
SHA512 7bf1d3d11fea424a7760547b5314a0b386acbd49a6643269bac159b4507a53a42a882267d9aefbaa29d802063bc65ccc9c27474788178c84bf410e15d2bf95fb
SSDEEP 3072:P+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:P+59tBBLkQa3lLNngoqRttA70
TLSH
T1D134490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfd.sys

Path C:\Temp\kicausnkfd.sys
Size 141KB
SHA256 a83178aef2d195caaa1b4867ae1a7031305cee69b3fb6abb2f8c9738d7223899
MD5 d41a8766b1758910c88568aae6a98b45
SHA1 cac7e5e867b569fe8d916d9664a168f25003449b
SHA512 a4b1eccdfe1ee0b98a044e6bd5f01be301e4ae4cc538c38f0859ccf31cd801079817175428b548ea35a01c0aff8b58ca3eee7d23916d4fb2adfb7c66929cf471
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaysqkida.exe

Path C:\Temp\lgaysqkida.exe
Size 243KB
SHA256 b7e978d67c883c379d84d28e75d552effd93be30077fbf98ba0a855fdf9b6005
MD5 9b88643bae2edb42c528c26ffb3a6f90
SHA1 016342b45c34f8cbf559b10b6e8d4253998191e0
SHA512 e47b51838c8fb9ff69e713ac503662542bc8ff620c972832481d292c70aa1692fdea0eff42cf5866f056a255730c3d8670d8fc0c8e43cfa1540664cf477cc631
SSDEEP 3072:g+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:g+59tBBLkQa3lLNngoqRttA79
TLSH
T1DB34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeytrljdb.exe

Path C:\Temp\mgeytrljdb.exe
Size 243KB
SHA256 ef63fd3d046e4cddfdd7809ef79922e9f796560aa7101f83db9f32d1d6cadd55
MD5 d37e3a017817932aa17b6f188d349590
SHA1 ef01e42f4409437940df6a490a69449223debc81
SHA512 6985d946963979ac727ca83518ed88982af26143cb555a6f451fb7505146d6e4d9cee26e0297e280f8a55931f5703cdc1594a1b17d49bfeffdb8b32489edd613
SSDEEP 3072:v+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:v+59tBBLkQa3lLNngoqRttA74
TLSH
T15D34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 444cb66da1b67ce3a41fec9841000128a3399d69b9c1000df3fdde181ec61bb3
MD5 e78f13a35fce648b67dbb680ff852a1c
SHA1 313e63274b5a263d351b2eb294b7b2bd9031990d
SHA512 12694d5d123c77c77a79cd8a1f8fa520ce9f184183f453e39c9ccd5c619d1e6b251924c729c7de80ec046ce6bccdd7f9e44e365a4f711921dddade1da805334d
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T195E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhcausmk.sys

Path C:\Temp\rpkhcausmk.sys
Size 141KB
SHA256 85a37038470288b7739419d0eb3b5544c9889c079a77f588fe458adb7dc21b17
MD5 13bf25c06e5fc295f36d9c37b8381cfb
SHA1 21e0e85a473f00e99f3e8564fdd6f003c6725817
SHA512 acecc76ada0129a280e9b4db37a5691349aa267ed5c0cb5d42f625076b1f62d4318b5b8ccc064c3251e100f95b218960ec6e0bdc3fa40656aa296e50901904c7
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T181E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 4e3663a032468e8c89c2b2e53b22ab90b6abdcb3a1b4675ac61cd5f1aeebab1c
MD5 8c0cc83276cd78133998c6337ede4ac0
SHA1 235a88041e58440bdbeb80849e979556bc6ccb66
SHA512 1518fb3343cd794669a8b948bb9e4e1786a41f76b37d497ecef8209b40fb12555584c26998208334b4752007b992da6c5800655dfad7fd481400d2323412c344
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BCE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhcwupmh.exe

Path C:\Temp\upmhcwupmh.exe
Size 243KB
SHA256 28c6354185873318e627804fc5ec7788a012c9264862e7c3f3e15864e383ee0f
MD5 ed9e1c5154696de95694016a0bf0a193
SHA1 a31dadc414f69f90bdb17c25badc21ce4b88f0fb
SHA512 262006fa57ad8a0828515391b0bf34a166787cc85d25bd59def32cbff103557744634db1086251d68dd2737ffec345b67c0b9d28be153ad1543baf2ccb7b63cb
SSDEEP 3072:T+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:T+59tBBLkQa3lLNngoqRttA7Q
TLSH
T19434490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqkicausnk.exe

Path C:\Temp\vqkicausnk.exe
Size 243KB
SHA256 2dac10f1a6b54826935cb792480bfb649a3896c2facc667ca6c1218bbb20ce58
MD5 975cec06ad58594f3da3a957a412f321
SHA1 4c7b329526be1d1577cfbbb6090f2c699c9c6b9f
SHA512 9f9eb0dfe6cf599941f606a41358124f2ce07e7dc6764f1031e0b5144007320b50e929a63df8647045f52117f3f1aaf4b5ad138e94516a259d610fa84526cdcb
SSDEEP 3072:U+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:U+59tBBLkQa3lLNngoqRttA7t
TLSH
T17634490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqlidbvtnl.sys

Path C:\Temp\vqlidbvtnl.sys
Size 141KB
SHA256 a2c0b554c1d82eebc5a51e1a92e74be261f51836884216f5d966d208868aed36
MD5 5f229524b5654dd2eee7a1c478ce7389
SHA1 52f9e4aa6ec42b344a3fcd82d6965a5c63f07092
SHA512 23cce82ed4ec97d9bcde3ded369777668fd4b00114bac4dfa3007daacb31b91875fbc77a8cc9b09f99b1402ff4218a744bb828979ad8c0be4dd8e1b62ab571fd
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.exe

Path C:\Temp\vqoigaysql.exe
Size 243KB
SHA256 8ad9c30c9923cf27e2deb60cb5f93030e633c7108665f5e3cc7cc0206c07a8cc
MD5 22b71f9fdc518d4837cd5f481ef75cfd
SHA1 1466464d6cf8ce3fa37d944e10988c05dfa914ec
SHA512 cc06f06821ba2ff906d2ac67b44b61049eb00d3d0e075858765e96ee0e7bd4fc7c57717b17fddf8d2dfe1fcdddd106a7f9ee457086b6c963abbd58bd295f67ad
SSDEEP 3072:X+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:X+59tBBLkQa3lLNngoqRttA7k
TLSH
T19B34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 243KB
SHA256 17984870fe3a9fd158bed3a29ae133bb9718eacdd065f98757b1734a7fb08ee5
MD5 b1e15d630983cf34edf205baa14e985e
SHA1 3c32240be731c845fc128163f86c32a8e27ca076
SHA512 e42a3e173caf2bfbbfb39bfbf7fc2c3abf83df8764c0c817418047d5cac0ab9e1ff9317389896ef79b424b48d293b7a78ab0a60a1127a04c6bbd4818116fca90
SSDEEP 3072:J+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:J+59tBBLkQa3lLNngoqRttA7q
TLSH
T11834490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 141KB
SHA256 72e08bec79350b2940f60a609ab0dca01fe758072d6efc4a1b8cbcec05272240
MD5 f363360365b26273187c0a93f60b4891
SHA1 5294ba017776ae15c6b9c34c7a68da2974ada5a7
SHA512 4b7bb27d65a3d15cbe6c2f94b97bdaa804241df696a0f639f1a9be96b03b6166f6f366287e3068591a3098326e1cd8cd0129e212fe4cf8df0356ee1505f70fef
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwrb.exe

Path C:\Temp\zurmkecwrb.exe
Size 243KB
SHA256 3a182f9f531060251dad5286a1f23456995e43c480b928be0c77fad09341f3b6
MD5 d580da95044372914f96f8953065701d
SHA1 690ea5ce7a92d58ce69f69cd40d46d48aee99340
SHA512 0ee90935de5643ef49fb8b55e1d0694130f621643af039d34a825b5caa87c2d1c9b29d9353702a19e57e8cad46643f89e4999c02b1062e2266f564145faaf420
SSDEEP 3072:/+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:/+59tBBLkQa3lLNngoqRttA74
TLSH
T1B634490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspkicaus.exe

Path C:\Temp\zxspkicaus.exe
Size 243KB
SHA256 d960ceb5d403538943d6e30ba1acc65adc56dce00baad1c0d7bc657ccb86a5d9
MD5 144043cadb28115d4bc1b7ea038fe1d0
SHA1 c179b970e4a41d54b19e6b60bed048cb1817a221
SHA512 ef1049c8e47b368364f24bf7d2f8d66b675995b799d988ba2cc1da15eb3589c6845a404849861f2d7bd71f7ebf14f0a78320e24ac23a5b82c157147add30bda6
SSDEEP 3072:m+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:m+59tBBLkQa3lLNngoqRttA7/
TLSH
T19434490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\31ZU4R68\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-89-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1832-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2180-51-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2288-77-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2628-27-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2628-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2888-100-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3092-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3764-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3776-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4564-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4868-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-39-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-65-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads