5a3daeade69c7498a6aaaac002c463ae260475d127c56d7c8496a677bd963699

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
Size 243KB
Sample260502-2gwweagw21
SHA256 5a3daeade69c7498a6aaaac002c463ae260475d127c56d7c8496a677bd963699
MD5 20dd1e8f8edaca7f673c186c5befd02e
SHA1 8a2cf9ba047a145ee5d07823376bbca6ba31d8b0
SHA512 984f3f92d2ce565e20d21b87f0ec0f2392d16e56bd51249e6c61740c0af988ea04674d96972c8274700d30b1938c101a68f4fd4f70686956fbb66f535e2752aa
SSDEEP 3072:hhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:vn7nLQka3lLNngoqRttA7j
TLSH
T17C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4756	CP.exe
4656	cxupnhfzxr.exe
3180	CP.exe
1016	CP.exe
4384	i_cxupnhfzxr.exe
3320	jhbzurmkec.sys
3820	CP.exe
5296	cwupmhezxr.exe
4104	CP.exe
4196	CP.exe
3152	i_cwupmhezxr.exe
4896	bwuomgeywr.sys
3716	CP.exe
5556	uojhbztrlj.exe
1244	CP.exe
4916	CP.exe
3128	i_uojhbztrlj.exe
5652	ztrljdbwto.sys
5088	CP.exe
3984	gdywqoigby.exe
4596	CP.exe
5952	CP.exe
1600	i_gdywqoigby.exe
552	qoigbytrlj.sys
1304	CP.exe
388	jdbwqoigtq.exe
6036	CP.exe
1372	CP.exe
1144	i_jdbwqoigtq.exe
1560	igaysqlidb.sys
3464	CP.exe
1568	avtnlfdyvq.exe
5796	CP.exe
5156	CP.exe
1692	i_avtnlfdyvq.exe
1228	dxvqnigays.sys
2588	CP.exe
2308	sqkicasqki.exe
5176	CP.exe
1128	CP.exe
1048	i_sqkicasqki.exe
4372	ausnkfdxvp.sys
2344	CP.exe
1152	hfaxsqkica.exe
2544	CP.exe
4524	CP.exe
4744	i_hfaxsqkica.exe
2880	pnhfzxspki.sys
4228	CP.exe
5516	hcausmkfcx.exe
1504	CP.exe
5900	CP.exe
2876	i_hcausmkfcx.exe
5924	jhczusmkec.sys
5072	CP.exe
5408	cwupmhezxr.exe
4896	CP.exe
5600	CP.exe
5840	i_cwupmhezxr.exe
2604	gezwrojhbz.sys
5040	CP.exe
5908	zwrpjhbzur.exe
3076	CP.exe
5816	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicasqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicasqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwqoigtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwqoigtq.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5004	ipconfig.exe
2536	ipconfig.exe
2880	ipconfig.exe
3256	ipconfig.exe
4396	ipconfig.exe
5368	ipconfig.exe
2376	ipconfig.exe
3616	ipconfig.exe
5636	ipconfig.exe
3720	ipconfig.exe
684	ipconfig.exe
1936	ipconfig.exe
3384	ipconfig.exe
4700	ipconfig.exe
3868	ipconfig.exe
4224	ipconfig.exe
5048	ipconfig.exe
4804	ipconfig.exe
3488	ipconfig.exe
5792	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fe13328cdadc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FAD18CC8-4676-11F1-9F8B-FECFF8056302} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b7d9ef70524a1745ae99083813ae677a00000000020000000000106600000001000020000000c63bd64ea9f3c5d4a96a736fa911a927ba2e7b849856e6fba6d5f2f076f5f2cb000000000e800000000200002000000029bffb2beb324a9d76d55df4b8198e2c5baf50556a19483fbe107279ab6a3a8320000000e8ee65f698d1e5a1b5f5f8c1e0b833fa1a1da8354563aada8ddf8f7b2209d95a40000000dca3df12058d0ef707df5ab693e23d5bfb115e11b6f1d297b90a646b6ab40ba6daebf11ec5aa94a3ff61511b9327d464373e6483da953a4e98c48693a14caf14	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b7d9ef70524a1745ae99083813ae677a00000000020000000000106600000001000020000000b055155941e6f14ba9a4858f990d7c3342b4b57c8f8a42196cb89239bf42d661000000000e8000000002000020000000a2ad3aed1191dc927dd94aabdec1ebae0a7341a22333955485a50f727fd160a22000000002a08271eaa3b44ecffddb0a100bedc7d0ca541f187f00968d8dacb63a58895f4000000006462d0084eb15b6edc07604beb8338c5984eea4430e7b364ed6e0571786a456468ce5103cc3b7d9dad12bd58e05d5b8bda0a2c14c05a3a689b2ea4951ece167	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "484526200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31251075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3481131149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d20c328cdadc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	i_cxupnhfzxr.exe
Token: SeDebugPrivilege	3152	i_cwupmhezxr.exe
Token: SeDebugPrivilege	3128	i_uojhbztrlj.exe
Token: SeDebugPrivilege	1600	i_gdywqoigby.exe
Token: SeDebugPrivilege	1144	i_jdbwqoigtq.exe
Token: SeDebugPrivilege	1692	i_avtnlfdyvq.exe
Token: SeDebugPrivilege	1048	i_sqkicasqki.exe
Token: SeDebugPrivilege	4744	i_hfaxsqkica.exe
Token: SeDebugPrivilege	2876	i_hcausmkfcx.exe
Token: SeDebugPrivilege	5840	i_cwupmhezxr.exe
Token: SeDebugPrivilege	1404	i_zwrpjhbzur.exe
Token: SeDebugPrivilege	5124	i_qojgbztrlj.exe
Token: SeDebugPrivilege	5976	i_trljdbwtol.exe
Token: SeDebugPrivilege	2172	i_qoigaytqlj.exe
Token: SeDebugPrivilege	5160	i_kidavtnlfd.exe
Token: SeDebugPrivilege	4076	i_icausnkfdx.exe
Token: SeDebugPrivilege	3456	i_hfzxspkhca.exe
Token: SeDebugPrivilege	3476	i_czusmkecxu.exe
Token: SeDebugPrivilege	5444	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	5592	i_wtomgeywro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4436	iexplore.exe
4436	iexplore.exe
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4436	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	84
PID 4436 wrote to memory of 1424	4436	iexplore.exe	85
PID 4672 wrote to memory of 4756	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	86
PID 4656 wrote to memory of 3180	4656	cxupnhfzxr.exe	89
PID 4672 wrote to memory of 1016	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	92
PID 4672 wrote to memory of 3820	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	96
PID 5296 wrote to memory of 4104	5296	cwupmhezxr.exe	98
PID 4672 wrote to memory of 4196	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	101
PID 4672 wrote to memory of 3716	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	109
PID 5556 wrote to memory of 1244	5556	uojhbztrlj.exe	111
PID 4672 wrote to memory of 4916	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	114
PID 4672 wrote to memory of 5088	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	121
PID 3984 wrote to memory of 4596	3984	gdywqoigby.exe	123
PID 4672 wrote to memory of 5952	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	126
PID 4672 wrote to memory of 1304	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	131
PID 388 wrote to memory of 6036	388	jdbwqoigtq.exe	133
PID 4672 wrote to memory of 1372	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	136
PID 4672 wrote to memory of 3464	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	140
PID 1568 wrote to memory of 5796	1568	avtnlfdyvq.exe	142
PID 4672 wrote to memory of 5156	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	145
PID 4672 wrote to memory of 2588	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	149
PID 2308 wrote to memory of 5176	2308	sqkicasqki.exe	151
PID 4672 wrote to memory of 1128	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	154
PID 4672 wrote to memory of 2344	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	158
PID 1152 wrote to memory of 2544	1152	hfaxsqkica.exe	160
PID 4672 wrote to memory of 4524	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	164
PID 4672 wrote to memory of 4228	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	168
PID 5516 wrote to memory of 1504	5516	hcausmkfcx.exe	170
PID 4672 wrote to memory of 5900	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	173
PID 4672 wrote to memory of 5072	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	177
PID 5408 wrote to memory of 4896	5408	cwupmhezxr.exe	179
PID 4672 wrote to memory of 5600	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	182
PID 4672 wrote to memory of 5040	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	186
PID 5908 wrote to memory of 3076	5908	zwrpjhbzur.exe	188
PID 4672 wrote to memory of 5816	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	191
PID 4672 wrote to memory of 5024	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	195
PID 1980 wrote to memory of 1764	1980	qojgbztrlj.exe	197
PID 4672 wrote to memory of 5216	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	200
PID 4672 wrote to memory of 3296	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	204
PID 612 wrote to memory of 4548	612	trljdbwtol.exe	206
PID 4672 wrote to memory of 220	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	209
PID 4672 wrote to memory of 1432	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	213
PID 5172 wrote to memory of 1120	5172	qoigaytqlj.exe	215
PID 4672 wrote to memory of 3828	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	218
PID 4672 wrote to memory of 5912	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	222
PID 2500 wrote to memory of 3800	2500	kidavtnlfd.exe	224
PID 4672 wrote to memory of 5596	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	227
PID 4672 wrote to memory of 4260	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	231
PID 5956 wrote to memory of 728	5956	icausnkfdx.exe	233
PID 4672 wrote to memory of 4624	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	236
PID 4672 wrote to memory of 4516	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	240
PID 3352 wrote to memory of 3388	3352	hfzxspkhca.exe	242
PID 4672 wrote to memory of 1824	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	245
PID 4672 wrote to memory of 3224	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	249
PID 5688 wrote to memory of 3012	5688	czusmkecxu.exe	251
PID 4672 wrote to memory of 2548	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	254
PID 4672 wrote to memory of 3964	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	258
PID 4804 wrote to memory of 5380	4804	zwrpjhbztr.exe	260
PID 4672 wrote to memory of 2604	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	263
PID 4672 wrote to memory of 5328	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	267
PID 3692 wrote to memory of 5456	3692	wtomgeywro.exe	269
PID 4672 wrote to memory of 5964	4672	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4436 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4756
- - C:\Temp\cxupnhfzxr.exe
    C:\Temp\cxupnhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1016
- - C:\Temp\i_cxupnhfzxr.exe
    C:\Temp\i_cxupnhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3820
- - C:\Temp\cwupmhezxr.exe
    C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Temp\i_cwupmhezxr.exe
    C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Temp\uojhbztrlj.exe
    C:\Temp\uojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4916
- - C:\Temp\i_uojhbztrlj.exe
    C:\Temp\i_uojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5088
- - C:\Temp\gdywqoigby.exe
    C:\Temp\gdywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5952
- - C:\Temp\i_gdywqoigby.exe
    C:\Temp\i_gdywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwqoigtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1304
- - C:\Temp\jdbwqoigtq.exe
    C:\Temp\jdbwqoigtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwqoigtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Temp\i_jdbwqoigtq.exe
    C:\Temp\i_jdbwqoigtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3464
- - C:\Temp\avtnlfdyvq.exe
    C:\Temp\avtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5156
- - C:\Temp\i_avtnlfdyvq.exe
    C:\Temp\i_avtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicasqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2588
- - C:\Temp\sqkicasqki.exe
    C:\Temp\sqkicasqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicasqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Temp\i_sqkicasqki.exe
    C:\Temp\i_sqkicasqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\hfaxsqkica.exe
    C:\Temp\hfaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4524
- - C:\Temp\i_hfaxsqkica.exe
    C:\Temp\i_hfaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4228
- - C:\Temp\hcausmkfcx.exe
    C:\Temp\hcausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5900
- - C:\Temp\i_hcausmkfcx.exe
    C:\Temp\i_hcausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\cwupmhezxr.exe
    C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5600
- - C:\Temp\i_cwupmhezxr.exe
    C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\zwrpjhbzur.exe
    C:\Temp\zwrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5816
- - C:\Temp\i_zwrpjhbzur.exe
    C:\Temp\i_zwrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run
  2⤵
  PID:5024
- - C:\Temp\qojgbztrlj.exe
    C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins
  2⤵
  PID:5216
- - C:\Temp\i_qojgbztrlj.exe
    C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtol.exe ups_run
  2⤵
  PID:3296
- - C:\Temp\trljdbwtol.exe
    C:\Temp\trljdbwtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtol.exe ups_ins
  2⤵
  PID:220
- - C:\Temp\i_trljdbwtol.exe
    C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqlj.exe ups_run
  2⤵
  PID:1432
- - C:\Temp\qoigaytqlj.exe
    C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqlj.exe ups_ins
  2⤵
  PID:3828
- - C:\Temp\i_qoigaytqlj.exe
    C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  PID:5912
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  PID:5596
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run
  2⤵
  PID:4260
- - C:\Temp\icausnkfdx.exe
    C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins
  2⤵
  PID:4624
- - C:\Temp\i_icausnkfdx.exe
    C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  PID:1824
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecxu.exe ups_run
  2⤵
  PID:3224
- - C:\Temp\czusmkecxu.exe
    C:\Temp\czusmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecxu.exe ups_ins
  2⤵
  PID:2548
- - C:\Temp\i_czusmkecxu.exe
    C:\Temp\i_czusmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  PID:3964
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  PID:2604
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywro.exe ups_run
  2⤵
  PID:5328
- - C:\Temp\wtomgeywro.exe
    C:\Temp\wtomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywro.exe ups_ins
  2⤵
  PID:5964
- - C:\Temp\i_wtomgeywro.exe
    C:\Temp\i_wtomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\bwuomgeywr.sys
C:\Temp\bwuomgeywr.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:5652

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:552

C:\Temp\igaysqlidb.sys
C:\Temp\igaysqlidb.sys
1⤵
- Executes dropped EXE
PID:1560

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
- Executes dropped EXE
PID:1228

C:\Temp\ausnkfdxvp.sys
C:\Temp\ausnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:4372

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:2880

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:5924

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:2604

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
PID:5276

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
PID:1276

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:5656

C:\Temp\vqnigaysql.sys
C:\Temp\vqnigaysql.sys
1⤵
PID:1228

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:4860

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:2684

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:1936

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:6076

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfdxvp.sys

Path C:\Temp\ausnkfdxvp.sys
Size 141KB
SHA256 bf4dc6efd0425b05fc0be9e9e0fe463a90f44f0da54c0154ada46d57e9df468d
MD5 713d7316b0ae45c92a9c0c1bce308f58
SHA1 68deeac2b0601930150cf6c8281941f7ad00c41f
SHA512 8464a3eaeddc034b251c6115401141f73e9ac988bcf29417757f96991fa6a0a75bbe5b05815576af518a1bf76b267dbacf2af9e67b0b78c79818885de0d48fa7
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdyvq.exe

Path C:\Temp\avtnlfdyvq.exe
Size 243KB
SHA256 48b52da29ab60702c064ada4df367f8ef885f89e4ffdae5f13396dd53bb0f073
MD5 18bc6422920cb37ff71c09e31b551d56
SHA1 859801981137a14cccafd3e1025a84de51f3d510
SHA512 781bd192730b7be2891a7dfd8eb965b6f0f3abe6b1f799db4b6efd5721b7cc795115912dbcb7b774fe1ff940de6d3867b23aa00c866940bbad75bd5782c98ff6
SSDEEP 3072:vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:Zn7nLQka3lLNngoqRttA7J
TLSH
T1DB34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeywr.sys

Path C:\Temp\bwuomgeywr.sys
Size 141KB
SHA256 a016dfe58e32789e839df5e84af68a8d79ecc45ed3fd22a1d2fc994bd71a03fc
MD5 6c69e8e3a37189a9b85f92a2f8b86b18
SHA1 f5f1ce79f528b467e52cc6297e16deb2d49e0b70
SHA512 6810148e932e3bece6702660511a2f755b58efa376120dd6e02fc47e15c26806bc1d95dd41bf78dcd5d5134880a916504fbfab4a9a89404f624c826bdc2ac4db
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhezxr.exe

Path C:\Temp\cwupmhezxr.exe
Size 243KB
SHA256 2495e7dd8512980110c514b16d291731649a44db25c17c0773246d6d4ad47f63
MD5 7597b39eaadcdfc48af1a9fb2069d5f0
SHA1 ee11147a554a83e4bb3185c12897e1a9326e3ca7
SHA512 b0622dbef93b86f8eb1d041457638f0394fe400cd998b0aab418d9188f6391195f97cdcaa93909de01efc0a8213ca65ee8a28b8fd0f97ae37a0de60bc9f19526
SSDEEP 3072:ihn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:en7nLQka3lLNngoqRttA7A
TLSH
T1A834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.exe

Path C:\Temp\cxupnhfzxr.exe
Size 243KB
SHA256 ae260649230090bcc78a267719a16ec2bf6072d124f13f55563c53d379df364c
MD5 b9b82dc1c92669cef27eb1d743737b18
SHA1 48f84c11c5b91904fd0f2f7f714e631566046483
SHA512 73d852c99ad976e6b43e0843ac07ca529df144be550c7f42cc46e5afcb3024abcb2a411f8604685b6ce33cc2d46f1c01ad6da33cee6625b6483d3a5ad75be29b
SSDEEP 3072:+hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:in7nLQka3lLNngoqRttA7w
TLSH
T1EB34490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnigays.sys

Path C:\Temp\dxvqnigays.sys
Size 141KB
SHA256 266a01e786c769f1dd02ff29c71565ea34b182d7be9299bc380f1cfe2cb837ad
MD5 cc353f9afcf0092779dc8441bc4a94ed
SHA1 c1eaa21a1e4e32f7b7ed95ee7f35e45cca1b2050
SHA512 444d38eea6e5a14bcb37474278880e10259d92bbad4c17811d0c0a8409145538946db2e6929e9ff87087d1f56637bdaaf215ec7fad92ff915bec9ed75a64a9bf
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigby.exe

Path C:\Temp\gdywqoigby.exe
Size 243KB
SHA256 373f9316c542a2c56a06d21993e33cc78d27b93e4e2fe15bb8724ad64aa4663d
MD5 c944426424ec41983e177055a02f540b
SHA1 65fa8d84df767883b07d22831598b18e9d275a08
SHA512 27a0e2be82f142f33be0e8c643c2f7ba269a584c3a4225a50c53b5339c47972e16532a8204ccd142a123ef4fa3cae3cd92e8405b045c329a2e9804551b71304d
SSDEEP 3072:8hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:cn7nLQka3lLNngoqRttA7y
TLSH
T16334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkica.exe

Path C:\Temp\hfaxsqkica.exe
Size 243KB
SHA256 58cbe2557497119b4c7b69601505362aba7c275328f1751e06bc881dc37e1d87
MD5 bc0623c61bb39608ef7a7f97d4549901
SHA1 4e87ef90a607671c6427bd1f6b0ebd88108ec0b2
SHA512 0edbdc7e7565c4f6040e5802211640e18c1014b09ae804c897c6d8a52ffcf5d4b7a995b648a6b5f17f90e104be82e2e583e5af84365f2cd00605083e4b5f1131
SSDEEP 3072:Ahn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:4n7nLQka3lLNngoqRttA7K
TLSH
T14934590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnlfdyvq.exe

Path C:\Temp\i_avtnlfdyvq.exe
Size 243KB
SHA256 e59e64c5494a4db5e9cc3090ab94916f6a205797fafa4ce740c0120ccc77bd38
MD5 de64ac8b295c1e5974db1074ead4cec1
SHA1 6dfa0375232d604ccade0e5fdacba25c075a005e
SHA512 39fc2827dce5c9160150d9db66f8cc84d022ceb2ff594fc564f1eb2dd360341357dd74e9a2f397053b0583b3bb1a083ab071525786dea16cb395e4103bfd33fd
SSDEEP 3072:6hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:Gn7nLQka3lLNngoqRttA70
TLSH
T1B334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmhezxr.exe

Path C:\Temp\i_cwupmhezxr.exe
Size 243KB
SHA256 425c3ea1802bae0114360d399b5e84b88915bf36ba014b8ec321afad551b90d4
MD5 0046e2b22750a9b73a7bd4b8d75ac22d
SHA1 0f85c70baecf86f22dd1540e748a8922b230ee8b
SHA512 798cc0969d86906f0f3e63dc459f6ba5c1339d217730c277a2ccec7077a153869aeea3a924add2bb0654ad3f5a456c5aa043a957b815e822b61f703c677e6ee8
SSDEEP 3072:6hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:Gn7nLQka3lLNngoqRttA74
TLSH
T17434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupnhfzxr.exe

Path C:\Temp\i_cxupnhfzxr.exe
Size 243KB
SHA256 979cc8bd229ba2bd20627d6fbf79838ccffa1f56585034afd9df80d237317b24
MD5 432a9056a1f16dcdfada4e3e174670f7
SHA1 033876dd33a6b4e4e72de6a1130d9f486dd0670d
SHA512 9bb4538f8cd3c1a8fa7d1edb376c447112842720fc1b7900a4887277199a1ab6c5cf44c58ac1691de5c37ba884717b75f2283308001057d06faff82797a50517
SSDEEP 3072:qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:2n7nLQka3lLNngoqRttA7c
TLSH
T15C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdywqoigby.exe

Path C:\Temp\i_gdywqoigby.exe
Size 243KB
SHA256 09a34645ff20eb79217dfaa0ed8b3eab3daf196f40be263b542855d7917ca76b
MD5 b7b4a30806e79e62742f4e68022946e9
SHA1 23b399458beb98bef4f98bb87b66cf9c43af4152
SHA512 efb7037bcf87b920407b94d55aeed3305e3df2b3f21061e676d3ce4d50bec874ae044470cde82fdc9e2c30927a2dc0addde15dee478aa29568a800e32c972065
SSDEEP 3072:3hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:xn7nLQka3lLNngoqRttA7J
TLSH
T12834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxsqkica.exe

Path C:\Temp\i_hfaxsqkica.exe
Size 243KB
SHA256 3e6308cebffef1c37d154f0c5174462fc47927e5fa23a74c921dfd8b70e436b0
MD5 9e7f6e97fdca2292245d00bd4506dae4
SHA1 f2ff7fbeeeb064644e2a8e7d570b8cb187a65fc8
SHA512 83b549289daa61e94bd66b35cc7b302244fcfdd9d88b8d854dc5cf9aab4c62fb69e3bbe551e83f7f80291e903dd406cc0924f1fa8aeb20a5090a53323c9b0739
SSDEEP 3072:ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:Cn7nLQka3lLNngoqRttA7M
TLSH
T16C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwqoigtq.exe

Path C:\Temp\i_jdbwqoigtq.exe
Size 243KB
SHA256 7fda8b16dff7d9329fb77c9e1e41f157dc30ac473d6d950afab14de344425cec
MD5 bcd616ab234fca628474bc5c6ad6f6a1
SHA1 78df83ff8a329734f14ee96249bd389154d9e249
SHA512 1b7cb4bcce3383f5407625224ec8d600422fe58c26e0fc793d3014ecb006924717d1401b019257e6890c79bd70b0db584e89085d973bb0d50145cd8b828a1809
SSDEEP 3072:chn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:8n7nLQka3lLNngoqRttA72
TLSH
T14234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicasqki.exe

Path C:\Temp\i_sqkicasqki.exe
Size 243KB
SHA256 28a43508c62732490a58eec6f144ab89eae1e0155d8a131ca4e63c30597f598b
MD5 6af724c354c6271dbb3fc98c3058f211
SHA1 160f07017d22f127b210811f4916b710b335808d
SHA512 2da89fe4ea132d4d5aa4165477c621aaccbf1e47635430dd7fd2b7763ba8d9cd421dcb45165892b98f6b2fd508040039f37c9e07d7dbc4ee86587f7426043d8d
SSDEEP 3072:Ohn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:yn7nLQka3lLNngoqRttA70
TLSH
T11C34490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uojhbztrlj.exe

Path C:\Temp\i_uojhbztrlj.exe
Size 243KB
SHA256 77aa23bf13b314f15e502484ad8091dfa12aae5d7e0c6b09df8a4a9b3c10b8fe
MD5 2a222600724cafb35ac4c5f5a3c9294c
SHA1 0225a8fcbe164ea9e959ed998cbd10f7a27871b2
SHA512 fb40bec6d8b379d4fb68320809c0a4a63fdde638665d23bd8c127d768f7afe1955666dc9a82d4c9eb69561d728c9a331100c7140e6805219fd6a405de94d155d
SSDEEP 3072:Dhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:Vn7nLQka3lLNngoqRttA7V
TLSH
T1D734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlidb.sys

Path C:\Temp\igaysqlidb.sys
Size 141KB
SHA256 5de3e156afdafd1c5d64bbb0eaf0efa72c7346b71e935f4c8df46f75b052f7c9
MD5 237350c6df0c47d04194d8dc69723fa3
SHA1 4c62444c76ce967abb61c5809cdaf59d35b1a70a
SHA512 c49d5ba6fe563d9c2cfce6bcd1bf71e8e730f5eaa46c99e62dc53eb50b3222943a633d8181c5d9006bd56740e8d53a37a28f5ac31e59fcccbecb890fe6bc4427
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T173E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwqoigtq.exe

Path C:\Temp\jdbwqoigtq.exe
Size 243KB
SHA256 7a6646630cf9f17d212047f108ad586b8932f29c11bb575f8bb9acb99fc413e0
MD5 b24bbbdf09b361a2e577d222338cd872
SHA1 e5bebbbd79408a4ad60c20a9fe9f67884d2b7c07
SHA512 9b4169380cfb47f9cad473d45ac5398cee922118fdcf6ce9c6d54c569b04a70f4cc7c9403062d42dd53ffcf1f86f95c2e53c71c0f1bc1fb37da6fcde26d7b5ee
SSDEEP 3072:Ahn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:4n7nLQka3lLNngoqRttA7G
TLSH
T1EC34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkec.sys

Path C:\Temp\jhbzurmkec.sys
Size 141KB
SHA256 8274edbb7449ded379064828b207f0281337fce40ca7277ae42c9d3dd51085e7
MD5 0134c921b292e5115b79a624d6bb96bb
SHA1 c5e61d2a805b55673b0da8da445224af09d924ce
SHA512 d59f405462f9b6c258726395c7d49e4ee8eb28de07395ebbeb0611ce74a2bebb319d9befc42babb53009342c0f26bc07571f736ef77ce2825d008d8434cd95fe
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytrlj.sys

Path C:\Temp\qoigbytrlj.sys
Size 141KB
SHA256 681f8627507114b2baaad4c67d20c37737fa403423e438c969d1f6c2f3a40723
MD5 b4683ad7e656ffe671d00c525983a649
SHA1 a9e1ac5007f188f187e145b8fa1a7d999457f659
SHA512 4a009b0cebc4c9f4e95e86a6facf401c5fc6daa8fd6a2e88c56fdab9fddb16522a1906d54946e9ea5e45dbf58aeb73bf33c8332d9d3b3e1673256a5e6a46fd38
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicasqki.exe

Path C:\Temp\sqkicasqki.exe
Size 243KB
SHA256 ec2dd5198701be2bed7dffc10c00990bf111a8c565c553ef8e9a5c304b4e4939
MD5 70e050bb57b73d2f4f990b568ebd6e4a
SHA1 d15d08f82db293f834d7790396148a571a9cd884
SHA512 9479e32411c55e75229dd6a67942f7afb8f367d1c35be1a13104e511f3d789b89f661fe28e3c9d4e7b31be89ca10d8b81b44856313fe1368e6020e9aabf0a92a
SSDEEP 3072:fhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:Jn7nLQka3lLNngoqRttA7t
TLSH
T1C934490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uojhbztrlj.exe

Path C:\Temp\uojhbztrlj.exe
Size 243KB
SHA256 a81ab14c9d54e0e76e5112930cde867908d107a88ab0662457226c06ae334fe2
MD5 be97c61b922cc844a4b06801cd5ec5a3
SHA1 37b6738160405238bd052aa8a5632c4549e687d2
SHA512 870939094cc87647eb63f62318cdd3c9054a117895137132e79ec926223cbd95488b92898ed84a34075cf7933e2ae80f97f2bae83babacfc2b07f52164837a1a
SSDEEP 3072:5hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:3n7nLQka3lLNngoqRttA7L
TLSH
T10234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 3b252ffaf1737f5f8be9291b35706af073a379b0ef686221c7b81e1244546560
MD5 b10caa19d9f5dab3be6dfb593290b1ed
SHA1 2c695f1a98ff1bfeb4a1685c22c4afd0858ffa81
SHA512 651f935f51fe2c04da0471916972cb7a8aefbb7e0121fcac09ca0e4d369f558aecd4f3dd8a4913a4fda47a7e617ac944ce7cc3694964b57176aa57b52fb51633
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5V03W766\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1560-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1936-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2684-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2880-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5276-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5376-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5652-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5656-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5924-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6076-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads