7fd919548b4485edf2b90850bea5129c2f030bb7fb09807ad1fd270e43e6aac6

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
Size 243KB
Sample260511-rbfbcsfs3m
SHA256 7fd919548b4485edf2b90850bea5129c2f030bb7fb09807ad1fd270e43e6aac6
MD5 0605641eb68d6b682a5bc192d61bb6c0
SHA1 63077d6ca1a0cc47254f92e092545804883fb422
SHA512 73af49b16b5018ed2ee6f5c907d77acd6f27eae696e576a7aecf4291040b8ba0437a92e3f6ee62f1338783a9d86391fd99800f4d672d1eadecfba2663a7d8bd7
SSDEEP 3072:YF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:U3frLQsa3lLNngoqRttA7M
TLSH
T1F2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4164	CP.exe
3332	causnkfcxv.exe
4556	CP.exe
1164	CP.exe
2100	i_causnkfcxv.exe
1152	cxupnhfzxr.sys
4908	CP.exe
1620	spkhcausmk.exe
3344	CP.exe
4140	CP.exe
2688	i_spkhcausmk.exe
2328	omhezxrpjh.sys
560	CP.exe
2244	hcwuomhezx.exe
1892	CP.exe
4576	CP.exe
1632	i_hcwuomhezx.exe
2384	jhbzurmkec.sys
1680	CP.exe
1160	uomgezwroj.exe
904	CP.exe
4792	CP.exe
888	i_uomgezwroj.exe
5052	bztrljdbwt.sys
1328	CP.exe
1084	trljebwuom.exe
3992	CP.exe
4104	CP.exe
4604	i_trljebwuom.exe
692	olgeywqoig.sys
2828	CP.exe
1516	gbytqljbvt.exe
3060	CP.exe
4820	CP.exe
3652	i_gbytqljbvt.exe
1136	avtnlfdyvq.sys
5060	CP.exe
4080	tnlgdyvqoi.exe
4628	CP.exe
4400	CP.exe
2044	i_tnlgdyvqoi.exe
2416	vqoigaysql.sys
4076	CP.exe
5064	cxvpnifays.exe
2160	CP.exe
1780	CP.exe
3740	i_cxvpnifays.exe
2676	icavsnkfdx.sys
3364	CP.exe
3448	xvpnhfaxsq.exe
228	CP.exe
2076	CP.exe
1884	i_xvpnhfaxsq.exe
1968	xvpnhfaxsp.sys
3328	CP.exe
1864	pkfcxupnhf.exe
4952	CP.exe
3828	CP.exe
3692	i_pkfcxupnhf.exe
4660	smkecwupmh.sys
5080	CP.exe
1888	hezusmkecw.exe
2824	CP.exe
5024	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3116	ipconfig.exe
5100	ipconfig.exe
2072	ipconfig.exe
3732	ipconfig.exe
4588	ipconfig.exe
2456	ipconfig.exe
2440	ipconfig.exe
1804	ipconfig.exe
1048	ipconfig.exe
1064	ipconfig.exe
4640	ipconfig.exe
4444	ipconfig.exe
3840	ipconfig.exe
2544	ipconfig.exe
5036	ipconfig.exe
4632	ipconfig.exe
3216	ipconfig.exe
3688	ipconfig.exe
3780	ipconfig.exe
4252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D395EF9B-4D41-11F1-A84F-CEEB04D51BF9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6000e20a57e1dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d4da0a57e1dc01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "485273044"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e68df2e645519e42a95bcf396f70602200000000020000000000106600000001000020000000b1256c9a0e268a4acb53f7b3f49b209f4dd3d9c0c004bf9ddccc1810dd758454000000000e8000000002000020000000fd52eab0cf5ae06739b418f300ee5bc8c4a9b3f0cd9dbb3a059cf48a06aa3d42200000005c61a69700976422622ccf41287d0ce94f45009a9278bff1c1d3e5408bffd95740000000c2f5e9e85dcfa2aee701931386f4dfd0278fa4e2dc6c980612acc8e1ec86ca3bfdba6289945309739a5d3cc160fec99876351ab0c3eee31b5fde5879b56d2e15	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e68df2e645519e42a95bcf396f70602200000000020000000000106600000001000020000000430c2d7e385b131ddf70f6250a254172c7e7bdeaa419517d468a88970137dda8000000000e800000000200002000000011bc6e36405c84c182bca6984cb1c1d17a5bb8e25ee88220b2f71b6d67a142c6200000002222d1ab75264d7b59cd0ecd292a86eba38ad02cae61bbf47e39970a8781cc25400000000d3bcd642c428b7c2e345e44db8198b8b7b27c1891b8c9a3bce4764d822e55f8d458c7f36e4c8ed1b48b3e77051679a0482d416f7481d73c1a55bf8f896e190c	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	i_causnkfcxv.exe
Token: SeDebugPrivilege	2688	i_spkhcausmk.exe
Token: SeDebugPrivilege	1632	i_hcwuomhezx.exe
Token: SeDebugPrivilege	888	i_uomgezwroj.exe
Token: SeDebugPrivilege	4604	i_trljebwuom.exe
Token: SeDebugPrivilege	3652	i_gbytqljbvt.exe
Token: SeDebugPrivilege	2044	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	3740	i_cxvpnifays.exe
Token: SeDebugPrivilege	1884	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	3692	i_pkfcxupnhf.exe
Token: SeDebugPrivilege	4880	i_hezusmkecw.exe
Token: SeDebugPrivilege	2956	i_ztrmjecwuo.exe
Token: SeDebugPrivilege	2472	i_wrojgbztrl.exe
Token: SeDebugPrivilege	204	i_ojgbztrljd.exe
Token: SeDebugPrivilege	3832	i_dbvtnlgdyt.exe
Token: SeDebugPrivilege	4888	i_vqnigaysqk.exe
Token: SeDebugPrivilege	3256	i_sqkicavsnk.exe
Token: SeDebugPrivilege	5008	i_nhfzxsnkfd.exe
Token: SeDebugPrivilege	1284	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	2652	i_ztrmjecwuo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4828	iexplore.exe
4828	iexplore.exe
440	IEXPLORE.EXE
440	IEXPLORE.EXE
440	IEXPLORE.EXE
440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 4828	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	85
PID 4828 wrote to memory of 440	4828	iexplore.exe	86
PID 2124 wrote to memory of 4164	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	87
PID 3332 wrote to memory of 4556	3332	causnkfcxv.exe	90
PID 2124 wrote to memory of 1164	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	93
PID 2124 wrote to memory of 4908	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	98
PID 1620 wrote to memory of 3344	1620	spkhcausmk.exe	100
PID 2124 wrote to memory of 4140	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	103
PID 2124 wrote to memory of 560	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	107
PID 2244 wrote to memory of 1892	2244	hcwuomhezx.exe	109
PID 2124 wrote to memory of 4576	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	112
PID 2124 wrote to memory of 1680	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	116
PID 1160 wrote to memory of 904	1160	uomgezwroj.exe	118
PID 2124 wrote to memory of 4792	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	121
PID 2124 wrote to memory of 1328	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	127
PID 1084 wrote to memory of 3992	1084	trljebwuom.exe	129
PID 2124 wrote to memory of 4104	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	132
PID 2124 wrote to memory of 2828	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	136
PID 1516 wrote to memory of 3060	1516	gbytqljbvt.exe	138
PID 2124 wrote to memory of 4820	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	141
PID 2124 wrote to memory of 5060	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	145
PID 4080 wrote to memory of 4628	4080	tnlgdyvqoi.exe	147
PID 2124 wrote to memory of 4400	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	150
PID 2124 wrote to memory of 4076	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	154
PID 5064 wrote to memory of 2160	5064	cxvpnifays.exe	156
PID 2124 wrote to memory of 1780	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	159
PID 2124 wrote to memory of 3364	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	163
PID 3448 wrote to memory of 228	3448	xvpnhfaxsq.exe	165
PID 2124 wrote to memory of 2076	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	168
PID 2124 wrote to memory of 3328	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	172
PID 1864 wrote to memory of 4952	1864	pkfcxupnhf.exe	174
PID 2124 wrote to memory of 3828	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	177
PID 2124 wrote to memory of 5080	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	181
PID 1888 wrote to memory of 2824	1888	hezusmkecw.exe	183
PID 2124 wrote to memory of 5024	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	186
PID 2124 wrote to memory of 1304	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	190
PID 1428 wrote to memory of 1580	1428	ztrmjecwuo.exe	192
PID 2124 wrote to memory of 3560	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	195
PID 2124 wrote to memory of 2888	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	199
PID 3804 wrote to memory of 4044	3804	wrojgbztrl.exe	201
PID 2124 wrote to memory of 2212	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	204
PID 2124 wrote to memory of 3740	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	211
PID 4384 wrote to memory of 3252	4384	ojgbztrljd.exe	214
PID 2124 wrote to memory of 4876	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	217
PID 2124 wrote to memory of 4524	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	223
PID 3132 wrote to memory of 4596	3132	dbvtnlgdyt.exe	225
PID 2124 wrote to memory of 4620	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	228
PID 2124 wrote to memory of 2220	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	232
PID 4060 wrote to memory of 3752	4060	vqnigaysqk.exe	234
PID 2124 wrote to memory of 3768	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	237
PID 2124 wrote to memory of 3688	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	241
PID 2416 wrote to memory of 3032	2416	sqkicavsnk.exe	243
PID 2124 wrote to memory of 1268	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	246
PID 2124 wrote to memory of 1196	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	250
PID 1560 wrote to memory of 3956	1560	nhfzxsnkfd.exe	252
PID 2124 wrote to memory of 1544	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	255
PID 2124 wrote to memory of 3856	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	259
PID 1640 wrote to memory of 2896	1640	ecxupnhfzx.exe	261
PID 2124 wrote to memory of 4184	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	264
PID 2124 wrote to memory of 764	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	268
PID 2440 wrote to memory of 2260	2440	ztrmjecwuo.exe	270
PID 2124 wrote to memory of 3648	2124	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causnkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4164
- - C:\Temp\causnkfcxv.exe
    C:\Temp\causnkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causnkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1164
- - C:\Temp\i_causnkfcxv.exe
    C:\Temp\i_causnkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4908
- - C:\Temp\spkhcausmk.exe
    C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\i_spkhcausmk.exe
    C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Temp\hcwuomhezx.exe
    C:\Temp\hcwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\i_hcwuomhezx.exe
    C:\Temp\i_hcwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\uomgezwroj.exe
    C:\Temp\uomgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4792
- - C:\Temp\i_uomgezwroj.exe
    C:\Temp\i_uomgezwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1328
- - C:\Temp\trljebwuom.exe
    C:\Temp\trljebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\i_trljebwuom.exe
    C:\Temp\i_trljebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqljbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Temp\gbytqljbvt.exe
    C:\Temp\gbytqljbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqljbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\i_gbytqljbvt.exe
    C:\Temp\i_gbytqljbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4076
- - C:\Temp\cxvpnifays.exe
    C:\Temp\cxvpnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1780
- - C:\Temp\i_cxvpnifays.exe
    C:\Temp\i_cxvpnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\pkfcxupnhf.exe
    C:\Temp\pkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_pkfcxupnhf.exe
    C:\Temp\i_pkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5080
- - C:\Temp\hezusmkecw.exe
    C:\Temp\hezusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5024
- - C:\Temp\i_hezusmkecw.exe
    C:\Temp\i_hezusmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\ztrmjecwuo.exe
    C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
  2⤵
  PID:3560
- - C:\Temp\i_ztrmjecwuo.exe
    C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
  2⤵
  PID:2888
- - C:\Temp\wrojgbztrl.exe
    C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
  2⤵
  PID:2212
- - C:\Temp\i_wrojgbztrl.exe
    C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  PID:3740
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlgdyt.exe ups_run
  2⤵
  PID:4524
- - C:\Temp\dbvtnlgdyt.exe
    C:\Temp\dbvtnlgdyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlgdyt.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_dbvtnlgdyt.exe
    C:\Temp\i_dbvtnlgdyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  PID:2220
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  PID:3768
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run
  2⤵
  PID:3688
- - C:\Temp\sqkicavsnk.exe
    C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins
  2⤵
  PID:1268
- - C:\Temp\i_sqkicavsnk.exe
    C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxsnkfd.exe ups_run
  2⤵
  PID:1196
- - C:\Temp\nhfzxsnkfd.exe
    C:\Temp\nhfzxsnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxsnkfd.exe ups_ins
  2⤵
  PID:1544
- - C:\Temp\i_nhfzxsnkfd.exe
    C:\Temp\i_nhfzxsnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run
  2⤵
  PID:3856
- - C:\Temp\ecxupnhfzx.exe
    C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_ecxupnhfzx.exe
    C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
  2⤵
  PID:764
- - C:\Temp\ztrmjecwuo.exe
    C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
  2⤵
  PID:3648
- - C:\Temp\i_ztrmjecwuo.exe
    C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:1152

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:5052

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:692

C:\Temp\avtnlfdyvq.sys
C:\Temp\avtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:1136

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:1968

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
- Executes dropped EXE
PID:4660

C:\Temp\rpjhczurmk.sys
C:\Temp\rpjhczurmk.sys
1⤵
PID:764

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
PID:2100

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:1396

C:\Temp\oigbytqljd.sys
C:\Temp\oigbytqljd.sys
1⤵
PID:4196

C:\Temp\lidbvtnlgd.sys
C:\Temp\lidbvtnlgd.sys
1⤵
PID:4868

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
PID:3780

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:2308

C:\Temp\pkhcausmkf.sys
C:\Temp\pkhcausmkf.sys
1⤵
PID:2844

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdyvq.sys

Path C:\Temp\avtnlfdyvq.sys
Size 141KB
SHA256 bd362f33a7beeb35fa833edde51eba63691fbc1010f49fb7a38a09692f5c1fdd
MD5 d1447b07d2f1c1992103551bd2f4d2fc
SHA1 9bcee38120542bfd30204ba37b688fbea2c15c1d
SHA512 c831ec22ff36853dac97f703383ebb96c7c8c83c04496c47beec59e1f143e2e2bae08a7e2f87922b231cada6b72ba38e14d41ff3d558deed9e043b22d1948a45
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwt.sys

Path C:\Temp\bztrljdbwt.sys
Size 141KB
SHA256 c80955965f8715eee9c1af65e42a743bffaefff44dfbaad52e1156fc544f5ea1
MD5 1c6004ecc4a5302e8d3dcbd57b4e8671
SHA1 ca78e728665e03ad3b2c5a83b85d707ca37dd055
SHA512 cd7ddff2c34fca2a32f13deb6437bcc6f52f5174c02426dafbb027e054164ddda1239fa006bd2303aad52babb10f06bdf46631f7bbf447ce3eb6fb9aca79aef8
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkfcxv.exe

Path C:\Temp\causnkfcxv.exe
Size 243KB
SHA256 2e849992d1cc6bfc4fb7511a26c15455213bff6a1abc4aa95e1daa9e24546ded
MD5 cdc1ff74465bd984cff4f1046c23a5cf
SHA1 bdbe5c7b910aea7cc2ece02e3f749e7c7d4291a1
SHA512 2822d58e5c151884a8924832ac4abbefe4639f09cb6eceebe6a9344f7c72e62923f59d343d70919d78c734224266d4e5a6d80d75d661183c01a0bc3563839626
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:m3frLQsa3lLNngoqRttA7S
TLSH
T11B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.sys

Path C:\Temp\cxupnhfzxr.sys
Size 141KB
SHA256 09d5d1ce456d2e3570704e3b4c0b6424e17afbefda3fba6c362377d75fa3fe25
MD5 5415d7dc7d9672f181c7e50497d2ff58
SHA1 d284a288049d61f171a4d8e0142fbcdf986021b3
SHA512 b8f4110d2299f37af4abfc0f21274a52034ac43560c8aae89da061351b2438d5a974f8384482af8e65fff46ba4cf57d7ff95763eec52b429205e56ae6b67ec78
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnifays.exe

Path C:\Temp\cxvpnifays.exe
Size 243KB
SHA256 c8c342f48f443c4d64715c6dda6471bb0a0d4970988fe7ad17aa8073f7df1631
MD5 93d47f238a738390cda82662ab7f35c9
SHA1 b59bdf34c8fc7311f19cece9b18e1666378aa2ef
SHA512 1eb2c4224c97bb39c1707f0b4384621b97a41f74f117efa8ec7ad2b55e7f0771f0499e71174f43cf6f29c08522f5812869b61c1baf8d0a5776191c151022e18e
SSDEEP 3072:qF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:63frLQsa3lLNngoqRttA7e
TLSH
T140345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqljbvt.exe

Path C:\Temp\gbytqljbvt.exe
Size 243KB
SHA256 b1fb9852a9795cae974f7c7c835d1f1301e39d6e77fba184664cd25544509996
MD5 8df2d2ef24e18ce79b28b78194081552
SHA1 470f4aea5d4a58ab9bdc9c869a683bc55e71e1a4
SHA512 eb433bc297efd769f03aed07d2b4a1498b79f58bede49adb7b0cd03dfd6979b11d6b2aa8c545ead9e34c42b47a49a74f8453b6a9fecc9127b4cefebd2b0e23aa
SSDEEP 3072:NF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:v3frLQsa3lLNngoqRttA7d
TLSH
T165345A0172818032E7150B78045AE7A1867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwuomhezx.exe

Path C:\Temp\hcwuomhezx.exe
Size 243KB
SHA256 9c18921153dd8848082fdb858913cc1dc38cafab0cc2c8e4fab1a1564f74fc54
MD5 7e9fcb4e86ed0dd5d27e84a0de184e64
SHA1 60ac00081f4f7a53249aceb47ceebb8109ddd91e
SHA512 f41746ed854cc5cfce49c4268d955f1ed8cdc412794e44d797b00d188839392d450a2f1db2676ed3333a3e839f14fc1c2e180edf6c6265f541dc137ddf103cee
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:03frLQsa3lLNngoqRttA7w
TLSH
T182345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causnkfcxv.exe

Path C:\Temp\i_causnkfcxv.exe
Size 243KB
SHA256 0644d392074bb55ec2b3ed05962725ced9c26785ba425b6335b913f840d76fc4
MD5 ea7834cff5181e3c1867102aeec00651
SHA1 289df2af0637054ad250fe21d7553ada9e767b24
SHA512 a13935d82d1f26e5f56fda5f8fedf5cdd46f81d0b6b654d9d7f74c8b6a8ecd87771612b21ddb46d66e85022caaf0fac7ca6ff89b8ec80e9362e28d3b69d75635
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:m3frLQsa3lLNngoqRttA7W
TLSH
T155345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnifays.exe

Path C:\Temp\i_cxvpnifays.exe
Size 243KB
SHA256 6fe02bbb2eb5f593a358067e7d2d499f310a896dee3b9b99687c0ce5ca7fd2fc
MD5 38578aac60ba8242f24f457e45a6d78f
SHA1 868b917faa679c620608a522317af636b7d1c38c
SHA512 613a9c7ab0d39aee766afdeceb071d560a0d6687051e9748f95419b116a24ce6576e75ec7fc69ba7a9732a0ede650cb796989938d72f48038be93816da8357ab
SSDEEP 3072:wF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:s3frLQsa3lLNngoqRttA7o
TLSH
T11E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytqljbvt.exe

Path C:\Temp\i_gbytqljbvt.exe
Size 243KB
SHA256 8d85126731bbec658ac808e993d8fdf8032f0a2bea2c71c1c7e88d4fdfc4b92d
MD5 aad0943456bd8df18a0b6dc448427699
SHA1 5d010f3cbcd4469f91a65173051136d01e61ec3f
SHA512 ed4d817360f5ecd1e3d8da16beca08aba401ec080eaa1ae50604eea66af176d5d60d717e6e10278c97a933800b298f5119c9aef9fbf61908fcd99222a681981a
SSDEEP 3072:aF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:K3frLQsa3lLNngoqRttA7+
TLSH
T1BA34590172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwuomhezx.exe

Path C:\Temp\i_hcwuomhezx.exe
Size 243KB
SHA256 9e8f628afc4ae1cda30f91993f34e666d19e479c2f60613416de2a13004d6c01
MD5 c37ba2063e21fe432aa2493c45a98214
SHA1 185cdb34550810cfa0e58ad4f63fee52a1766f1f
SHA512 7942ea03da4e04a1fc71b1d8eab702eb12d6c4ba2f25cac4ab212832c02ed2e451c864b8107c090d1a890ae295fdb010f8e601353bdc9562831cdc29189c2f54
SSDEEP 3072:vF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:t3frLQsa3lLNngoqRttA7n
TLSH
T17B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhcausmk.exe

Path C:\Temp\i_spkhcausmk.exe
Size 243KB
SHA256 1d871e743fd5545e96e6b4caa26863002995f7a4547e6dc8e6e7e3908fb3ab8b
MD5 e324340ce8205150be1f41dd0c1b3124
SHA1 62765b02f86351b6147e0f27af7102c0d6c8394b
SHA512 7a108ae4ef5d045ccef720287e3862692cd9464b13af262c300cd176b0821a979ea2fca1a17cbec508b4afacbd751c5e26fe419914f0c24c89b757b4c23f07db
SSDEEP 3072:cF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:I3frLQsa3lLNngoqRttA7c
TLSH
T188345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdyvqoi.exe

Path C:\Temp\i_tnlgdyvqoi.exe
Size 243KB
SHA256 d987aa0d3389b89c34186ce24c470a91e2f9490f8dbc5d9c7bdb6d35c68a4dca
MD5 2c51f124d76e940c0020cc9d4ffbbe8f
SHA1 31542d0b432a5ce7e397d5ad2cee775ea21a260a
SHA512 d4b6f2d723127baafe96105869cae084eee248c2197276d35bb5768ff4f555de9aa91a80dd5e33b7c24c42188bdd1fea9b64bacd80623cbc62d6228d09227498
SSDEEP 3072:uF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:u3frLQsa3lLNngoqRttA7G
TLSH
T163345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljebwuom.exe

Path C:\Temp\i_trljebwuom.exe
Size 243KB
SHA256 ef5fbb7b0ad95d44923f01b3e9edead736bb15509669b8da893f30d7641fa352
MD5 569eb4ad17a1bc4be985b80fdea43ddb
SHA1 9f2531f5d82ff4fc13d2ab5c93c3898d9cb26cc5
SHA512 6d712ef28d6a794e3bc4ddd5cb5b450aa7997be751a28b775731bca4def311b6094e52858fb026984c962a406f83cadae525f746b1372065843d20e6f6c24d96
SSDEEP 3072:cF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:I3frLQsa3lLNngoqRttA7g
TLSH
T1F4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgezwroj.exe

Path C:\Temp\i_uomgezwroj.exe
Size 243KB
SHA256 741ce5d117679ce029e6547c258371508ff14585b3fdeae7d757c2dd3f8024f3
MD5 51d74c4ae252d31ac8fdff8c5665efe5
SHA1 8572a9590ad98fb90bee4859224f8ae4c8995bc1
SHA512 ac3454a6f01a6f76eec37e3a553227f18bca79a8020e3a90df9d4e6700ef4f154193127afdcc67e871e0436ddbfc02cb9b8c0b37d7b4f1b3b23a00d9eeea70bf
SSDEEP 3072:eF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:+3frLQsa3lLNngoqRttA7+
TLSH
T197345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkec.sys

Path C:\Temp\jhbzurmkec.sys
Size 141KB
SHA256 d78f34551199e6d877073616d9714180d109a3145350ae56b897a6d2a0617b7f
MD5 409d5242f7ea750c70907b1d29b4b26e
SHA1 926fad73073212f2bac7d25125b9c68b43fd4c7f
SHA512 1b4579bfd40b635b3aa17e96e358568e4bba37011a320decff4f219b7f1a2e5d3b95cd584f9227f44c6d79ce233c9edebc390724c94ff6bfe61d869552e27f48
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.sys

Path C:\Temp\olgeywqoig.sys
Size 141KB
SHA256 64642f22e1672530078557583148fbbc6c84eb8b1c839680e1ae46893edbc751
MD5 1db777a46ca5337ec7fac6384f87e6c4
SHA1 33bea05bb430fa14e822427532ae0c3f0ee2e844
SHA512 ad0b640d907867cb5889e868c4ef010242e214dd75596a7e70d8e3e1e2655a57e6a085143feafc7ca976b831bce0bafb13de5342fae8c876156d54efcbdbf67b
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 0425d091b121ee84ca577e1c182140dcfdb8b983cf768298ba7ebc4aa2094fff
MD5 a3b054e3e7047522616731bb99c71d17
SHA1 ea8370544f30aec64dd70cf066e3e28a2a803789
SHA512 2dd736fa4c3f65fae6eba69438799a055c33dc53eade1653a0ca903b6ba7b85c553ab02184639a6b389c76c9365d927318574e6cdd523cddeecd521036054106
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcausmk.exe

Path C:\Temp\spkhcausmk.exe
Size 243KB
SHA256 4e9208a62a2e4c55aca460b4614b4f61a7f68cb87ea9dd1ac7e7e4a57466bcc0
MD5 bf8d0da7e884f9de46c6bca7f9ab9b96
SHA1 7200f535706e566a147ae2436ebb29baf1e416aa
SHA512 247eb8418a375d9d2e264a4e3d5f13a620ca12a43172392a29bb3d62f553130d8f7b714f46041be069f159fbe3f47c490e383d9dabae9f9b5bc8f967d9d72b1d
SSDEEP 3072:pF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:L3frLQsa3lLNngoqRttA7h
TLSH
T1F2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoi.exe

Path C:\Temp\tnlgdyvqoi.exe
Size 243KB
SHA256 19051896531960f09a27a9c2bd992e0214e85c4c2eb0de280a51f2d0f5933cc6
MD5 d1acc573348f1e014b3721192cb28c98
SHA1 c386944354b2e42c58b696517f9c350733ead12c
SHA512 1ec419495f3924f00c3b99be90a999429e20e4832987911a4c9a69fac794a37a276bef2be6f03837d2b9bea90a7c439a7a864ab3da9126bf3da6433e43d00313
SSDEEP 3072:qF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:63frLQsa3lLNngoqRttA7G
TLSH
T113345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwuom.exe

Path C:\Temp\trljebwuom.exe
Size 243KB
SHA256 6b806d29c76110c6796ee64e49bf99da0f2b8f3e9870a337f549d8d33f3afe17
MD5 184a19b936c70285ee3576ad048a6aa4
SHA1 bcd492daf0698637d91530a90fb717190e2afde2
SHA512 464660ad464510ecabbf977530e02156eef6d62c3b318cb2aa246ed195a24f70a3e57bd838d7428d49fccf7773bec51c5b2df062128a5de40796cc02dcbce144
SSDEEP 3072:3F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:13frLQsa3lLNngoqRttA7X
TLSH
T173345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwroj.exe

Path C:\Temp\uomgezwroj.exe
Size 243KB
SHA256 b21e1f0a6b270bd8b4f1b2faa38ff076afb11f27147055e2779f2b66206a0f8f
MD5 0cfe45796fe024509080d2e28e4befc6
SHA1 c4836ab3672c9feca6ea224cd31417b8b001d394
SHA512 33156c78d0666d04a424eb28d095a4575c632e7ec374a248078399f419f6ad817ec1db1d1dad19e33893cf1249cfc035eeeba818778c67ea6cb1d4ded2903c41
SSDEEP 3072:PF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:N3frLQsa3lLNngoqRttA7v
TLSH
T15C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.sys

Path C:\Temp\vqoigaysql.sys
Size 141KB
SHA256 613334aff90ff0695a289c0087572fd3670fcaec269b0b6021a33b15f73f1e4d
MD5 6d3574a3f409142c86f8b6f8b0d191fa
SHA1 19543438adcf214abc0535fdd6f77c6875f0e0eb
SHA512 22125dd36b7d9757941fbb8e82b1ade6fc3f67002dad76b4defae8b58dc4a40fb3e72eb63a6efdfce620c1e8e889aaa3794b758fdbc3f25add558568fc431ba6
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\31ZU4R68\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/764-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1136-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1396-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1968-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2100-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2308-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2676-99-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2844-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3780-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3952-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4868-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5052-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads