235ec856ffc4576f282ede701256697052964448e00e70c8aefd1a673b181701

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe
Size 243KB
Sample260417-p3tlyset7j
SHA256 235ec856ffc4576f282ede701256697052964448e00e70c8aefd1a673b181701
MD5 8751f3e7df3066265c65769320ae6e51
SHA1 b243787efa076eae589d5c9ab02d191e72a6258a
SHA512 4d97abb1cbfb495570e8fafe07d309363f8a806f2d14928a6f87534bc4dc27d6d81198572072be42398e493f57c456ba950b8e7c71f968e2ff60c65fbf58e302
SSDEEP 3072:Chn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:+n7nLQka3lLNngoqRttA7Y
TLSH
T1BD34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4932	CP.exe
3372	wuomhezxrm.exe
3376	CP.exe
2852	CP.exe
1076	i_wuomhezxrm.exe
3976	ezxrpjhbzm.sys
1768	CP.exe
3796	mgeywrojgb.exe
3448	CP.exe
4972	CP.exe
4124	i_mgeywrojgb.exe
2932	mgezwrojhb.sys
1960	CP.exe
2328	bwtobwtolg.exe
772	CP.exe
3396	CP.exe
468	i_bwtobwtolg.exe
1552	ytolgeywqo.sys
4924	CP.exe
1376	oigaytqljd.exe
4576	CP.exe
452	CP.exe
2936	i_oigaytqljd.exe
4140	lidbvtnlgd.sys
560	CP.exe
2740	dyvqoigays.exe
2176	CP.exe
4060	CP.exe
4328	i_dyvqoigays.exe
3092	lidavlfdxv.sys
3040	CP.exe
1176	sqkicavsnk.exe
4560	CP.exe
1188	CP.exe
224	i_sqkicavsnk.exe
3720	sqkicavsnl.sys
4760	CP.exe
4124	kxspkiausp.exe
2424	CP.exe
1744	CP.exe
4832	i_kxspkiausp.exe
5084	ausnkfcxvp.sys
2720	CP.exe
396	pkhcausmke.exe
2232	CP.exe
4248	CP.exe
3692	i_pkhcausmke.exe
3820	kecxupmhfz.sys
2472	CP.exe
1180	zurmkezxrp.exe
1704	CP.exe
2140	CP.exe
1636	i_zurmkezxrp.exe
3408	trmjecwuom.sys
3544	CP.exe
3116	jhbztrmjec.exe
2360	CP.exe
2496	CP.exe
4780	i_jhbztrmjec.exe
4428	jeywrojhbz.sys
816	CP.exe
2592	rljeywqojg.exe
2452	CP.exe
208	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytnlgaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kxspkiausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtobwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtobwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlgaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxspkiausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2492	ipconfig.exe
3136	ipconfig.exe
3388	ipconfig.exe
4164	ipconfig.exe
2800	ipconfig.exe
212	ipconfig.exe
2744	ipconfig.exe
3720	ipconfig.exe
3980	ipconfig.exe
4668	ipconfig.exe
4780	ipconfig.exe
2360	ipconfig.exe
4372	ipconfig.exe
1712	ipconfig.exe
4224	ipconfig.exe
3944	ipconfig.exe
1696	ipconfig.exe
3552	ipconfig.exe
660	ipconfig.exe
4688	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000453d8c044d2e7b409aa2a2ec94653b5200000000020000000000106600000001000020000000297c6cb4a69a85c0a914e8e971d2835aa1017d67eebb1654c6c991c47d9a034a000000000e80000000020000200000001eaad00eef5a21bce5d30e10b36f158ed264d411a3afc3ea63fd3a1f8e175cdb20000000f81dd8624b51a4600707a06395205ad123dcc5398f665ce0bf623da4dadf110140000000c728975f4c1fe1bf23b6bfce1cc6e5f01cacf973c0f6b6b59f13a5c00314e4ccf7912785092019c94e775cf65c5091858cd97996448c5843ca82f802a2e3fe1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31247980"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1040749948"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303457a074cedc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{69065DD3-3A5F-11F1-A84F-EAA6BA3891E2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d160a074cedc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000453d8c044d2e7b409aa2a2ec94653b52000000000200000000001066000000010000200000009f9e406d74a6a68a231e78ae5008c815fb6e0ddafb1dc2f272d5ffe1ba804eef000000000e8000000002000020000000d882f7bcfbfb8c3aaacc0b80a068223d4f1de2b08bd78ab6f3f8e878998b600020000000af27935d36dff5c68f42f2de1dd69fa9092c034d5ac9dcbb681b8f751f07b871400000004c5ebf7f2a089f7b152502a1b14b23e1298e1f613dbc2035ca35688b787103b96a27bcc1ca54a0f5ad378e287250ca8f75f0b9f6621ad8c4553b35cfa86452cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "483196664"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	i_wuomhezxrm.exe
Token: SeDebugPrivilege	4124	i_mgeywrojgb.exe
Token: SeDebugPrivilege	468	i_bwtobwtolg.exe
Token: SeDebugPrivilege	2936	i_oigaytqljd.exe
Token: SeDebugPrivilege	4328	i_dyvqoigays.exe
Token: SeDebugPrivilege	224	i_sqkicavsnk.exe
Token: SeDebugPrivilege	4832	i_kxspkiausp.exe
Token: SeDebugPrivilege	3692	i_pkhcausmke.exe
Token: SeDebugPrivilege	1636	i_zurmkezxrp.exe
Token: SeDebugPrivilege	4780	i_jhbztrmjec.exe
Token: SeDebugPrivilege	2416	i_rljeywqojg.exe
Token: SeDebugPrivilege	3944	i_ojdbwtolge.exe
Token: SeDebugPrivilege	3468	i_ytnlgaytql.exe
Token: SeDebugPrivilege	4616	i_qlfdxvqnig.exe
Token: SeDebugPrivilege	2492	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	4928	i_causmkfcxv.exe
Token: SeDebugPrivilege	5028	i_jecwupmhfz.exe
Token: SeDebugPrivilege	2564	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	4332	i_ojhbztrlje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
616	iexplore.exe
616	iexplore.exe
3868	IEXPLORE.EXE
3868	IEXPLORE.EXE
3868	IEXPLORE.EXE
3868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 616	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	85
PID 616 wrote to memory of 3868	616	iexplore.exe	86
PID 3956 wrote to memory of 4932	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	87
PID 3372 wrote to memory of 3376	3372	wuomhezxrm.exe	90
PID 3956 wrote to memory of 2852	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	95
PID 3956 wrote to memory of 1768	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	102
PID 3796 wrote to memory of 3448	3796	mgeywrojgb.exe	104
PID 3956 wrote to memory of 4972	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	109
PID 3956 wrote to memory of 1960	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	113
PID 2328 wrote to memory of 772	2328	bwtobwtolg.exe	115
PID 3956 wrote to memory of 3396	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	118
PID 3956 wrote to memory of 4924	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	122
PID 1376 wrote to memory of 4576	1376	oigaytqljd.exe	124
PID 3956 wrote to memory of 452	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	127
PID 3956 wrote to memory of 560	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	132
PID 2740 wrote to memory of 2176	2740	dyvqoigays.exe	134
PID 3956 wrote to memory of 4060	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	137
PID 3956 wrote to memory of 3040	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	141
PID 1176 wrote to memory of 4560	1176	sqkicavsnk.exe	143
PID 3956 wrote to memory of 1188	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	146
PID 3956 wrote to memory of 4760	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	150
PID 4124 wrote to memory of 2424	4124	kxspkiausp.exe	152
PID 3956 wrote to memory of 1744	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	155
PID 3956 wrote to memory of 2720	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	159
PID 396 wrote to memory of 2232	396	pkhcausmke.exe	161
PID 3956 wrote to memory of 4248	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	164
PID 3956 wrote to memory of 2472	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	168
PID 1180 wrote to memory of 1704	1180	zurmkezxrp.exe	170
PID 3956 wrote to memory of 2140	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	173
PID 3956 wrote to memory of 3544	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	177
PID 3116 wrote to memory of 2360	3116	jhbztrmjec.exe	179
PID 3956 wrote to memory of 2496	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	182
PID 3956 wrote to memory of 816	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	187
PID 2592 wrote to memory of 2452	2592	rljeywqojg.exe	189
PID 3956 wrote to memory of 208	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	192
PID 3956 wrote to memory of 3168	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	196
PID 4636 wrote to memory of 2160	4636	ojdbwtolge.exe	198
PID 3956 wrote to memory of 3524	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	201
PID 3956 wrote to memory of 3624	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	205
PID 3716 wrote to memory of 4432	3716	ytnlgaytql.exe	207
PID 3956 wrote to memory of 2308	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	210
PID 3956 wrote to memory of 2356	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	214
PID 1080 wrote to memory of 1948	1080	qlfdxvqnig.exe	216
PID 3956 wrote to memory of 4688	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	219
PID 3956 wrote to memory of 4408	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	223
PID 1424 wrote to memory of 456	1424	cavsnkfdxv.exe	225
PID 3956 wrote to memory of 4304	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	228
PID 3956 wrote to memory of 760	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	232
PID 996 wrote to memory of 1672	996	causmkfcxv.exe	234
PID 3956 wrote to memory of 4876	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	237
PID 3956 wrote to memory of 176	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	241
PID 1152 wrote to memory of 4184	1152	jecwupmhfz.exe	243
PID 3956 wrote to memory of 1504	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	246
PID 3956 wrote to memory of 2096	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	250
PID 3236 wrote to memory of 3508	3236	zxrpjhbzur.exe	252
PID 3956 wrote to memory of 2400	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	255
PID 3956 wrote to memory of 5100	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	259
PID 2684 wrote to memory of 3680	2684	ojhbztrlje.exe	261
PID 3956 wrote to memory of 4660	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	264
PID 3956 wrote to memory of 5072	3956	2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe	268
PID 2752 wrote to memory of 3976	2752	jgbwtomgey.exe	270

C:\Users\Admin\AppData\Local\Temp\2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_8751f3e7df3066265c65769320ae6e51_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4932
- - C:\Temp\wuomhezxrm.exe
    C:\Temp\wuomhezxrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Temp\i_wuomhezxrm.exe
    C:\Temp\i_wuomhezxrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1768
- - C:\Temp\mgeywrojgb.exe
    C:\Temp\mgeywrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Temp\i_mgeywrojgb.exe
    C:\Temp\i_mgeywrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtobwtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1960
- - C:\Temp\bwtobwtolg.exe
    C:\Temp\bwtobwtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtobwtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\i_bwtobwtolg.exe
    C:\Temp\i_bwtobwtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\oigaytqljd.exe
    C:\Temp\oigaytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:452
- - C:\Temp\i_oigaytqljd.exe
    C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Temp\dyvqoigays.exe
    C:\Temp\dyvqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4060
- - C:\Temp\i_dyvqoigays.exe
    C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3040
- - C:\Temp\sqkicavsnk.exe
    C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\i_sqkicavsnk.exe
    C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kxspkiausp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\kxspkiausp.exe
    C:\Temp\kxspkiausp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kxspkiausp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Temp\i_kxspkiausp.exe
    C:\Temp\i_kxspkiausp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2720
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4248
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\zurmkezxrp.exe
    C:\Temp\zurmkezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_zurmkezxrp.exe
    C:\Temp\i_zurmkezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3544
- - C:\Temp\jhbztrmjec.exe
    C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Temp\i_jhbztrmjec.exe
    C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:816
- - C:\Temp\rljeywqojg.exe
    C:\Temp\rljeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:208
- - C:\Temp\i_rljeywqojg.exe
    C:\Temp\i_rljeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojdbwtolge.exe ups_run
  2⤵
  PID:3168
- - C:\Temp\ojdbwtolge.exe
    C:\Temp\ojdbwtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojdbwtolge.exe ups_ins
  2⤵
  PID:3524
- - C:\Temp\i_ojdbwtolge.exe
    C:\Temp\i_ojdbwtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlgaytql.exe ups_run
  2⤵
  PID:3624
- - C:\Temp\ytnlgaytql.exe
    C:\Temp\ytnlgaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytnlgaytql.exe ups_ins
  2⤵
  PID:2308
- - C:\Temp\i_ytnlgaytql.exe
    C:\Temp\i_ytnlgaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlfdxvqnig.exe ups_run
  2⤵
  PID:2356
- - C:\Temp\qlfdxvqnig.exe
    C:\Temp\qlfdxvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlfdxvqnig.exe ups_ins
  2⤵
  PID:4688
- - C:\Temp\i_qlfdxvqnig.exe
    C:\Temp\i_qlfdxvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnkfdxv.exe ups_run
  2⤵
  PID:4408
- - C:\Temp\cavsnkfdxv.exe
    C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
  2⤵
  PID:4304
- - C:\Temp\i_cavsnkfdxv.exe
    C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  PID:760
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwupmhfz.exe ups_run
  2⤵
  PID:176
- - C:\Temp\jecwupmhfz.exe
    C:\Temp\jecwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwupmhfz.exe ups_ins
  2⤵
  PID:1504
- - C:\Temp\i_jecwupmhfz.exe
    C:\Temp\i_jecwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  PID:2096
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  PID:2400
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:5100
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:4660
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbwtomgey.exe ups_run
  2⤵
  PID:5072
- - C:\Temp\jgbwtomgey.exe
    C:\Temp\jgbwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4780

C:\Temp\ezxrpjhbzm.sys
C:\Temp\ezxrpjhbzm.sys
1⤵
- Executes dropped EXE
PID:3976

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\ytolgeywqo.sys
C:\Temp\ytolgeywqo.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\lidbvtnlgd.sys
C:\Temp\lidbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:4140

C:\Temp\lidavlfdxv.sys
C:\Temp\lidavlfdxv.sys
1⤵
- Executes dropped EXE
PID:3092

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
- Executes dropped EXE
PID:3720

C:\Temp\ausnkfcxvp.sys
C:\Temp\ausnkfcxvp.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\kecxupmhfz.sys
C:\Temp\kecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:3820

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\jeywrojhbz.sys
C:\Temp\jeywrojhbz.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
PID:5048

C:\Temp\gaysqlidbv.sys
C:\Temp\gaysqlidbv.sys
1⤵
PID:1040

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:1252

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
PID:1228

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
PID:5020

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:4344

C:\Temp\kecwupmhez.sys
C:\Temp\kecwupmhez.sys
1⤵
PID:4380

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
PID:3844

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfcxvp.sys

Path C:\Temp\ausnkfcxvp.sys
Size 141KB
SHA256 ec9dfd2cb95804ad52907154490579b6839952f8f1b203586b472834540e7a97
MD5 d64cceadbc412f580fbf8b3ef76afe3c
SHA1 cf90c3b1861d5ccd4f3daf0eb1d2afcc9aa194d1
SHA512 deede741d4418fdc0d008253449bbdecdc76f28ecc809a4f1a1b71a94bf9262e3cd24c554523cfddc7d97b553aed11c518f3eb4cfab20d5ac017c99435369dd1
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T182E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtobwtolg.exe

Path C:\Temp\bwtobwtolg.exe
Size 243KB
SHA256 191e3872a5a8e18fdfa7abe0546f9aca2dd8533c1fa78d2fe0ad4f2bb5d8c5bf
MD5 b569360bbd03a51ffbd243aa3946527c
SHA1 c047646912272023a98e6fd3c922c5ac5f5c51fd
SHA512 235fe1e2c661f2d00bd29ae18327c5637fb2605eff9d05af8e509418f68e7c8d1c1e96ecaf8d9efdbec5d1462fe9c6e5c43c48756b735d9a380058764496b5b5
SSDEEP 3072:qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:2n7nLQka3lLNngoqRttA7M
TLSH
T19D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.exe

Path C:\Temp\dyvqoigays.exe
Size 243KB
SHA256 230307a34ff8751a5183269d266929db4ab3811a0ee0c8c5429b123035bb10da
MD5 c307ef5d1fede3e660bbee1af65c8aca
SHA1 927a102bea683563839382e2298159d2e08ad9c9
SHA512 9140206e88e15a9289d25a15f8b15115659a626b54a1d6c5922ecb60a2de51a5c5c2558c3af38210700c90f5f3e3a7cc9ad73f2d6fadf4bf478d3998afeb153d
SSDEEP 3072:bhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:dn7nLQka3lLNngoqRttA7V
TLSH
T1DE34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzm.sys

Path C:\Temp\ezxrpjhbzm.sys
Size 141KB
SHA256 64d8d14d14dcb4cbadb95d01f0a5e17c88984f7c68ce1c2978321ec3c13c34c6
MD5 fdf9d291e4d0d0a215d4f6ddd363bdd0
SHA1 d7efb37de2743dc8e6709626af0f81cd98ed6f37
SHA512 d142b2ce78f6bfc545fc53ab0112137f001018ed4538633b1fa3d0504418b4e5c176e9e43f64f4ab7ca44825b92b851ff2ec5c7cc647339212eb2a43d2ecea9e
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtobwtolg.exe

Path C:\Temp\i_bwtobwtolg.exe
Size 243KB
SHA256 65aa25bbb59a346aa3b57aaa2ad6d0cd5945e2a26db4e96d62cafe8167f91adf
MD5 a51c51e3502a23d77f0a05cc3d84d03c
SHA1 552562863688bf13e6b7aa2a84c2ae37a062f743
SHA512 1c0427bb22bcfa00f63d9db7b042d30a26789c197cdb87558994533d761e3de45dd4b6e2df539d270bfcb29d34a1e6730842b7dee4ca28a6c6f36801dddf72bb
SSDEEP 3072:/hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:pn7nLQka3lLNngoqRttA7p
TLSH
T11134590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqoigays.exe

Path C:\Temp\i_dyvqoigays.exe
Size 243KB
SHA256 fc055b43ce74a14e8357a3a8dec9da234e06db0518513aa41e13b6285254ea24
MD5 8d245f0511bc76bb03f723225492531a
SHA1 f076f9368c10f653d18d14d3eb6f3f73a0c4767b
SHA512 0052a44147d29d1c2006148003b04aa98313291e66ae1b4083c26d56e12878fd441fe0394d83d6532705a330eaddc65ae5b84060af3a0a1eabf615dcb748e44a
SSDEEP 3072:0hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:En7nLQka3lLNngoqRttA7S
TLSH
T18F34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kxspkiausp.exe

Path C:\Temp\i_kxspkiausp.exe
Size 243KB
SHA256 b6fa7ae2b2417a01522946ab9065eb85108d22b3d04da1e8afe37640040d7570
MD5 d64b811b45beed9458b6023fa444f4aa
SHA1 55739b4f976afa71a78e0d3a76624092528b676c
SHA512 e8c9d3b7094d19057e93ab2543aa94ae91857470954d591ea8408f113a0553c90bbb31e9717c6726e629daf8adde80e89f056166aeda0af851ba26bf750215cd
SSDEEP 3072:0hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:En7nLQka3lLNngoqRttA7q
TLSH
T1D834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywrojgb.exe

Path C:\Temp\i_mgeywrojgb.exe
Size 243KB
SHA256 5e8d5dfbca555df576914cc3850f78297b711ba63a4dc121a7628e9ef25dfac8
MD5 608333a8f8f5162f3727228f7118519b
SHA1 f02cb77f7a34523db2b622d9e1a3cdf87e96b06a
SHA512 ca4289202eca78072cfa3a3c6c99175474f29fc5985005c3bf7f4461bba8659887bb94eaf9a421d13870f5a19d606d6c362c0a450a68b588d4081b5e0109cc2e
SSDEEP 3072:5hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:3n7nLQka3lLNngoqRttA7H
TLSH
T11734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaytqljd.exe

Path C:\Temp\i_oigaytqljd.exe
Size 243KB
SHA256 62a6d6d409df90c715e525377030771b33f65824cd97119e1c0cb26d6a3acb14
MD5 1bfcec21505141693a2b13b9c7b92532
SHA1 dea8895cf08f8c21eba73cc8fa5e5ca77d7ef5b9
SHA512 7cfc4e2b4d129cdb7ffd2cfbd59f821f9bca98770f3fccc6071cf46d834322893a2aca39269d211291be0219b7e5fb97526e7f577841274499242af2512695fc
SSDEEP 3072:Rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:fn7nLQka3lLNngoqRttA7b
TLSH
T1B234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausmke.exe

Path C:\Temp\i_pkhcausmke.exe
Size 243KB
SHA256 2a5bf0760eafdb807e29a79129f57507a91cb1f756d646a8eedbd7aec69ded63
MD5 6b1151eef68ccf36b65a2d3dd02e9355
SHA1 22dfa26de211b95737a0d90f1af943457e7fd5c7
SHA512 bb3237ec3a52b6629118e133bdc257ef4b621b811729f95e53d7fa203579fde6ab17e8709c24708e6a52f014c2eba417067547bd11b432ee753127634c1c5faa
SSDEEP 3072:ahn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:mn7nLQka3lLNngoqRttA70
TLSH
T11C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnk.exe

Path C:\Temp\i_sqkicavsnk.exe
Size 243KB
SHA256 0d6280021a8e0b518786ad9a9a7a83bcc8477c5a87b050d8342239174b65ffa2
MD5 c0540b1b11e155003e4de48b5e6ce353
SHA1 d59eb26ae86f1834fd8fa7d552652943581c21f8
SHA512 f4d4277c2896b78b3100de8b35dbacdab1cd501df6c134daa8c19a2f5ea981c66eb7607311150c1ff4669f4f399024a600dad50a880018c408438f990d6c967a
SSDEEP 3072:Ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:Un7nLQka3lLNngoqRttA7+
TLSH
T1A834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomhezxrm.exe

Path C:\Temp\i_wuomhezxrm.exe
Size 243KB
SHA256 5ab233edee8e9c441eebf97e54752019a316bca71d4633e71ebfb235a11936c0
MD5 aa9cfccd0cab2b34f083f4c751c17557
SHA1 ea28964f8f48dad08e77ace4e4d659c44595d2da
SHA512 9a7902883f917f68129c7d3a76393492698c114847a1c9381108b55a9cd6b21a94188d928219f14c12ba5b8eabe007c3fe69f7d0d16b1210998945f29ce735c8
SSDEEP 3072:fhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:Jn7nLQka3lLNngoqRttA7h
TLSH
T1C334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxspkiausp.exe

Path C:\Temp\kxspkiausp.exe
Size 243KB
SHA256 9230521cb5098bb9387f84640546c9017ff33f346ffac68caf8006fae56877e6
MD5 a447d27b4408ea39bb95638bcc305d0f
SHA1 63002fec7815f38a319eb98d43a8521d141a82cc
SHA512 caea187eda38b81f1b56b8f417be54eb18f9346a727f22e8fb32c5819d5f5eb35128f0d1ef9d5e99453466956ef332cb931b0c8ea7156e9876f36c1dcc7b0379
SSDEEP 3072:Uhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:kn7nLQka3lLNngoqRttA7C
TLSH
T11B34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavlfdxv.sys

Path C:\Temp\lidavlfdxv.sys
Size 141KB
SHA256 99a13f0afcbc98c603a8aedec8fcdaa20a41e505a28d651e1d8c07489bb98bc1
MD5 a635876464203bc23b7ffa1e3de3f319
SHA1 e311f6ebeb16c9175e4f437eacb0d32708aec6f5
SHA512 0c1380398175bd4396df7d714f6aa90873b3bdc4c11ab86b00cfa0569ab09ab4101f1a19d1eccd00fbc604a4214289ec2a9397f1c305e677378b5cede2c8ebd3
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlgd.sys

Path C:\Temp\lidbvtnlgd.sys
Size 141KB
SHA256 5b2e063f5038ba8a5a6ebb4bd9af99c1020d0a648e25da51098120e88bb0f5d3
MD5 942e743a92ab1bfe04f69e57f61592c9
SHA1 8e9b5140f24fb62b559ad7c5bec0056b660fa720
SHA512 25e07968daf9c7b5a71d3d5173a4c180a12cf4ba8aca3752bf2d67f04c3c5b904beab3136c8e655ad9844a2d237dc2b2b5acd935f01178c0d7d5b37ea09c1783
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojgb.exe

Path C:\Temp\mgeywrojgb.exe
Size 243KB
SHA256 a0d97e85f7c4483da64dfe6a203499eb961c7b8d188580f685d1eefb2805f484
MD5 ab8b8fd645b1cf8387f10d1228919551
SHA1 f0d94c537207ae7ea9b03b6fe6dc45d9956b71fd
SHA512 ffacfda531ca96e37f0da3a38d252a16915175177e1ae7b5413d30ef7dd26326ba0957f936edb7c72fc914b887b8971eeeac7dacc7a5c838cfcec21692a432f8
SSDEEP 3072:ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:Cn7nLQka3lLNngoqRttA7Y
TLSH
T16D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrojhb.sys

Path C:\Temp\mgezwrojhb.sys
Size 141KB
SHA256 4c3d17989030ef25836be10d9f00589f2346fbdb83bf686f2e34f1b7db0c2a2a
MD5 4349d84a28a926171fd42fc1da6f906f
SHA1 52976ef0042c17a885b5bde5cdc7db0bb51b664f
SHA512 af573cc6a5f1eb25725f2862a63474476c61bab5c4bcab3f48e76df3edcb3abf66ed3bfd03a3038021a892338df8f31ff112de7f738d2932e512bd763b33ce92
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqljd.exe

Path C:\Temp\oigaytqljd.exe
Size 243KB
SHA256 6b331a778485d8da88510a376ad25bc26fb3d608ac04a7917fa887e5a98f3a7e
MD5 0c988d2879bf5f2784410c678351f673
SHA1 67ea5b6d7f00940c33bb6178c7dc41313344ae0c
SHA512 0e12dd423e8ae58d54a0d6491b59764c99238c09fc7d0d278f9b89942eccfe626fb9f6589b444ff62dd71bd1265d434b17e41f397fb053a4e141b9533cadf85a
SSDEEP 3072:zhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:Fn7nLQka3lLNngoqRttA7V
TLSH
T18034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.exe

Path C:\Temp\pkhcausmke.exe
Size 243KB
SHA256 64abc8f9db7395b9d1abf16ac8a3035dbb3b70f773471f340d53bf19502dbd99
MD5 a43194f635314876aa7ab9cf8bf23f2d
SHA1 bb606f3f5f880c97b5b83229dfefdc3da32fe289
SHA512 a20ac79c2f24fa974d0433baa2575d1bce83f0b084c30656886d0d70f2a972f2f109a6a202ecd49bee1dccd66c348182809cc5cff599e2f33c25dd4250518d23
SSDEEP 3072:ihn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:en7nLQka3lLNngoqRttA7I
TLSH
T16C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.exe

Path C:\Temp\sqkicavsnk.exe
Size 243KB
SHA256 8a83f4bef3e65650215fa2cccd4a8cb529748999cabcc52ecc647389aaf184ad
MD5 814d8741adacc2b123247e4f12e14ef0
SHA1 aadd9d67515b8bb3ab52ce978383f5cbc83da49d
SHA512 6064d02524b8de60e58713c8b326c21d442972d89e11b6c40b43e016d6d693969cbd4920a8303b55e757e834dc40c3e410ec3f04663332bf81f5063fc71a7a3d
SSDEEP 3072:0hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:En7nLQka3lLNngoqRttA7i
TLSH
T17334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.sys

Path C:\Temp\sqkicavsnl.sys
Size 141KB
SHA256 443d64db994a9a505e0048a13778445dad5fe4a000634a2c8f7496daa0f42872
MD5 9d65c38fb1d8ea4c24e6848f4b546a5b
SHA1 29bb1c85122c8217bd8e995f82f5608cffefa0d4
SHA512 d8762d8318b5ef4c764264041c554e8431b0f3f7d0b06919b3f6648a1b803d1c02bc3e6f0e4fcfbe2b58395839e413e2cd40c563f030a3216b9d105ba02e762c
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezxrm.exe

Path C:\Temp\wuomhezxrm.exe
Size 243KB
SHA256 2050273568f9ad2c9bd2a034d76ef606eb5adb1c5abc5f386e4506fe9315ca99
MD5 bc402f9b1b2acedf0ceaef2bfb7e092c
SHA1 46d06ce6c50551480544b7bdf47fe73dac2061f1
SHA512 73f147c2b8140a686a3a534e561c747452f630f5cbb82f4b1768c0d8cde66946a5e915bf0e0ef061b0c59f9bbd7a4819568960550b9a1af699e89651ee20634c
SSDEEP 3072:/hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:pn7nLQka3lLNngoqRttA7x
TLSH
T1CD34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytolgeywqo.sys

Path C:\Temp\ytolgeywqo.sys
Size 141KB
SHA256 b75000e9e11d92f388c04f0d1cb6f09103024c6e312af9e1cde126bdd0d856a8
MD5 b0b9f99f3dce756118441b4dd446151d
SHA1 cde032eee1cf07e963e2d421c7b794facb82f0ab
SHA512 8627d5e8d95c42717dfaf02eaf7c6b942be6001bb23f171277d3065bee260b9f5b53ac6b77b9654693f4f213815e79ae44cf849e426f39017cc06fbdbc6399b6
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T123E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\31ZU4R68\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1040-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3092-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3408-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3820-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4140-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4344-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4820-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5048-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5084-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads