c5c778cf02d71e0d7ec2cdcc81a5a370b430be07b6377ff5e37828f440cd601b

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe
Size 243KB
Sample260806-1nbclscd64
SHA256 c5c778cf02d71e0d7ec2cdcc81a5a370b430be07b6377ff5e37828f440cd601b
MD5 a201fa5dddc67c8083e4249753289218
SHA1 5c8b5713b76e1fac7dea0f60106c137420714b71
SHA512 fcfd0bdffcfda40d57d92506128b5dc632e6e7686431b494eddcb388cc36ae48e4d3bbeb245bc652cd8cbddd779ae21c2723fa51b960e858b02680340382c4e9
SSDEEP 3072:xVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:jXP7LQMa3lLNngoqRttA7o
TLSH
T153345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2316	CP.exe
3152	uomhbztrdb.exe
3164	CP.exe
4876	CP.exe
3328	i_uomhbztrdb.exe
116	jdbvtolgey.sys
628	CP.exe
2508	ytqljdbvtn.exe
1604	CP.exe
4676	CP.exe
2820	i_ytqljdbvtn.exe
1600	sqlidavtnl.sys
3356	CP.exe
3224	lfdyvqoiga.exe
3148	CP.exe
2580	CP.exe
3880	i_lfdyvqoiga.exe
2936	fdxvqnifay.sys
5112	CP.exe
4740	ysqkicavsn.exe
1072	CP.exe
4892	CP.exe
1872	i_ysqkicavsn.exe
2500	axsqkicavs.sys
1436	CP.exe
1108	kfdxvpnhfa.exe
1544	CP.exe
3948	CP.exe
4172	i_kfdxvpnhfa.exe
1732	pnhfzxspki.sys
3436	CP.exe
2152	hcxsmkecxu.exe
2480	CP.exe
1552	CP.exe
3404	i_hcxsmkecxu.exe
4820	cxupmhfzxr.sys
748	CP.exe
4328	rpjhczusmk.exe
2600	CP.exe
2644	CP.exe
3124	i_rpjhczusmk.exe
2848	ojhbzurmje.sys
1872	CP.exe
4440	eywrjhbztr.exe
4444	CP.exe
2028	CP.exe
3328	i_eywrjhbztr.exe
3716	geywrojhbz.sys
316	CP.exe
2436	rojhbztrlj.exe
924	CP.exe
760	CP.exe
2236	i_rojhbztrlj.exe
3732	ztrljdbwto.sys
2820	CP.exe
1536	oigbytrljd.exe
2808	CP.exe
1972	CP.exe
4340	i_oigbytrljd.exe
2680	qljdbvtnlg.sys
808	CP.exe
2012	gdyvqoigay.exe
4000	CP.exe
4108	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcxsmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcxsmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhbztrdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhbztrdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbvtolgdyw.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3352	ipconfig.exe
3436	ipconfig.exe
5000	ipconfig.exe
4152	ipconfig.exe
1012	ipconfig.exe
4792	ipconfig.exe
4748	ipconfig.exe
4592	ipconfig.exe
4304	ipconfig.exe
2024	ipconfig.exe
1764	ipconfig.exe
1812	ipconfig.exe
2292	ipconfig.exe
2276	ipconfig.exe
4928	ipconfig.exe
2448	ipconfig.exe
740	ipconfig.exe
3468	ipconfig.exe
3504	ipconfig.exe
612	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000f25982f2d5b4a56e2e0e9661693b4620b249ad9bd48dd394b2d1f728037c94d0000000000e8000000002000020000000233955fe384c18692f23eb660f0e153ab974a8256491cdc823ec30e6af90123920000000e2d3b97412572f4103765944acff5abcc6aff28536c09c4d29e11b65ea6533a540000000415470a5712723ccfe911dee11c9f56329c66438dab5c44c06aecbb143bb6a6d19cd0103783c0cc2a850306eba1b3e75893b5f217b0ccecb716361ddcf6161ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006d929cf525dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6553500D-91E0-11F1-BC3D-5AB93EA64185} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "974866886"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f027979cf525dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000a29249a600ee80284b9fb2a05e30414a53c595dfe1cb1edeb6e0c6c86aa58fcb000000000e8000000002000020000000cc4df6e0b813e49b02b52d7c7d4c3e91e138913d36bfa484710ccdfe5a038fe420000000f77d1d0276be483a481f41ba90e568a1700f1d24b5e13a73908aa305d246bc1c4000000033a69bdc7083b38a52537bb6e2bfd561218006a35be6a96f9b11a58c4b8cf570d724efa485795c4910e11ba42aa4eda292d076c22d5ccb453b10fd028c3ca0cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "975804396"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270381"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492817813"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	i_uomhbztrdb.exe
Token: SeDebugPrivilege	2820	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	3880	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	1872	i_ysqkicavsn.exe
Token: SeDebugPrivilege	4172	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	3404	i_hcxsmkecxu.exe
Token: SeDebugPrivilege	3124	i_rpjhczusmk.exe
Token: SeDebugPrivilege	3328	i_eywrjhbztr.exe
Token: SeDebugPrivilege	2236	i_rojhbztrlj.exe
Token: SeDebugPrivilege	4340	i_oigbytrljd.exe
Token: SeDebugPrivilege	4600	i_gdyvqoigay.exe
Token: SeDebugPrivilege	1452	i_ysqlidavtn.exe
Token: SeDebugPrivilege	4952	i_pkicausnkf.exe
Token: SeDebugPrivilege	3388	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	400	i_pkhcausmke.exe
Token: SeDebugPrivilege	3160	i_czurmkecwu.exe
Token: SeDebugPrivilege	204	i_trljdbwtom.exe
Token: SeDebugPrivilege	2544	i_wqojgbztrl.exe
Token: SeDebugPrivilege	3220	i_gbvtolgdyw.exe
Token: SeDebugPrivilege	824	i_ysqlidbvtk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1592	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1592	iexplore.exe
1592	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1592	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	85
PID 1592 wrote to memory of 2064	1592	iexplore.exe	86
PID 1040 wrote to memory of 2316	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	91
PID 3152 wrote to memory of 3164	3152	uomhbztrdb.exe	94
PID 1040 wrote to memory of 4876	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	97
PID 1040 wrote to memory of 628	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	101
PID 2508 wrote to memory of 1604	2508	ytqljdbvtn.exe	103
PID 1040 wrote to memory of 4676	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	106
PID 1040 wrote to memory of 3356	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	110
PID 3224 wrote to memory of 3148	3224	lfdyvqoiga.exe	112
PID 1040 wrote to memory of 2580	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	115
PID 1040 wrote to memory of 5112	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	119
PID 4740 wrote to memory of 1072	4740	ysqkicavsn.exe	121
PID 1040 wrote to memory of 4892	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	124
PID 1040 wrote to memory of 1436	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	130
PID 1108 wrote to memory of 1544	1108	kfdxvpnhfa.exe	132
PID 1040 wrote to memory of 3948	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	135
PID 1040 wrote to memory of 3436	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	139
PID 2152 wrote to memory of 2480	2152	hcxsmkecxu.exe	141
PID 1040 wrote to memory of 1552	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	144
PID 1040 wrote to memory of 748	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	148
PID 4328 wrote to memory of 2600	4328	rpjhczusmk.exe	150
PID 1040 wrote to memory of 2644	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	153
PID 1040 wrote to memory of 1872	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	158
PID 4440 wrote to memory of 4444	4440	eywrjhbztr.exe	160
PID 1040 wrote to memory of 2028	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	163
PID 1040 wrote to memory of 316	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	167
PID 2436 wrote to memory of 924	2436	rojhbztrlj.exe	169
PID 1040 wrote to memory of 760	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	172
PID 1040 wrote to memory of 2820	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	176
PID 1536 wrote to memory of 2808	1536	oigbytrljd.exe	178
PID 1040 wrote to memory of 1972	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	181
PID 1040 wrote to memory of 808	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	185
PID 2012 wrote to memory of 4000	2012	gdyvqoigay.exe	187
PID 1040 wrote to memory of 4108	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	190
PID 1040 wrote to memory of 2660	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	194
PID 1424 wrote to memory of 3672	1424	ysqlidavtn.exe	196
PID 1040 wrote to memory of 2728	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	199
PID 1040 wrote to memory of 4844	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	203
PID 3044 wrote to memory of 4280	3044	pkicausnkf.exe	205
PID 1040 wrote to memory of 2236	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	208
PID 1040 wrote to memory of 2120	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	212
PID 3880 wrote to memory of 1192	3880	usnkfcxvpn.exe	214
PID 1040 wrote to memory of 4552	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	217
PID 1040 wrote to memory of 2032	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	225
PID 4360 wrote to memory of 1720	4360	pkhcausmke.exe	227
PID 1040 wrote to memory of 3596	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	230
PID 1040 wrote to memory of 2656	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	234
PID 3636 wrote to memory of 4424	3636	czurmkecwu.exe	236
PID 1040 wrote to memory of 4316	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	239
PID 1040 wrote to memory of 4984	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	243
PID 4152 wrote to memory of 3128	4152	trljdbwtom.exe	245
PID 1040 wrote to memory of 4532	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	248
PID 1040 wrote to memory of 2472	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	252
PID 2492 wrote to memory of 5116	2492	wqojgbztrl.exe	254
PID 1040 wrote to memory of 4400	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	257
PID 1040 wrote to memory of 4608	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	261
PID 2944 wrote to memory of 372	2944	gbvtolgdyw.exe	263
PID 1040 wrote to memory of 1180	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	266
PID 1040 wrote to memory of 564	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	270
PID 4784 wrote to memory of 2960	4784	ysqlidbvtk.exe	272
PID 1040 wrote to memory of 2144	1040	2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe	275

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a201fa5dddc67c8083e4249753289218_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1592 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhbztrdb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2316
- - C:\Temp\uomhbztrdb.exe
    C:\Temp\uomhbztrdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhbztrdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4876
- - C:\Temp\i_uomhbztrdb.exe
    C:\Temp\i_uomhbztrdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4676
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\lfdyvqoiga.exe
    C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2580
- - C:\Temp\i_lfdyvqoiga.exe
    C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcxsmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3436
- - C:\Temp\hcxsmkecxu.exe
    C:\Temp\hcxsmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcxsmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\i_hcxsmkecxu.exe
    C:\Temp\i_hcxsmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Temp\rpjhczusmk.exe
    C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2644
- - C:\Temp\i_rpjhczusmk.exe
    C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrjhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\eywrjhbztr.exe
    C:\Temp\eywrjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrjhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2028
- - C:\Temp\i_eywrjhbztr.exe
    C:\Temp\i_eywrjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:316
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:760
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2820
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:808
- - C:\Temp\gdyvqoigay.exe
    C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\i_gdyvqoigay.exe
    C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidavtn.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\ysqlidavtn.exe
    C:\Temp\ysqlidavtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidavtn.exe ups_ins
  2⤵
  PID:2728
- - C:\Temp\i_ysqlidavtn.exe
    C:\Temp\i_ysqlidavtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  PID:4844
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  PID:2236
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
  2⤵
  PID:2120
- - C:\Temp\usnkfcxvpn.exe
    C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
  2⤵
  PID:4552
- - C:\Temp\i_usnkfcxvpn.exe
    C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  PID:2032
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  PID:3596
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecwu.exe ups_run
  2⤵
  PID:2656
- - C:\Temp\czurmkecwu.exe
    C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecwu.exe ups_ins
  2⤵
  PID:4316
- - C:\Temp\i_czurmkecwu.exe
    C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  PID:4984
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  PID:4532
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run
  2⤵
  PID:2472
- - C:\Temp\wqojgbztrl.exe
    C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins
  2⤵
  PID:4400
- - C:\Temp\i_wqojgbztrl.exe
    C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbvtolgdyw.exe ups_run
  2⤵
  PID:4608
- - C:\Temp\gbvtolgdyw.exe
    C:\Temp\gbvtolgdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbvtolgdyw.exe ups_ins
  2⤵
  PID:1180
- - C:\Temp\i_gbvtolgdyw.exe
    C:\Temp\i_gbvtolgdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtk.exe ups_run
  2⤵
  PID:564
- - C:\Temp\ysqlidbvtk.exe
    C:\Temp\ysqlidbvtk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtk.exe ups_ins
  2⤵
  PID:2144
- - C:\Temp\i_ysqlidbvtk.exe
    C:\Temp\i_ysqlidbvtk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:824

C:\Temp\jdbvtolgey.sys
C:\Temp\jdbvtolgey.sys
1⤵
- Executes dropped EXE
PID:116

C:\Temp\sqlidavtnl.sys
C:\Temp\sqlidavtnl.sys
1⤵
- Executes dropped EXE
PID:1600

C:\Temp\fdxvqnifay.sys
C:\Temp\fdxvqnifay.sys
1⤵
- Executes dropped EXE
PID:2936

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:1732

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Temp\ojhbzurmje.sys
C:\Temp\ojhbzurmje.sys
1⤵
- Executes dropped EXE
PID:2848

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\qljdbvtnlg.sys
C:\Temp\qljdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\faysqkidav.sys
C:\Temp\faysqkidav.sys
1⤵
PID:3588

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
PID:2376

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
PID:4312

C:\Temp\xupmhfzxrp.sys
C:\Temp\xupmhfzxrp.sys
1⤵
PID:3252

C:\Temp\mhbzurmjec.sys
C:\Temp\mhbzurmjec.sys
1⤵
PID:2116

C:\Temp\mgezwrpjhb.sys
C:\Temp\mgezwrpjhb.sys
1⤵
PID:3504

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:3396

C:\Temp\qljdbvtolg.sys
C:\Temp\qljdbvtolg.sys
1⤵
PID:2164

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.sys

Path C:\Temp\axsqkicavs.sys
Size 141KB
SHA256 edf3e6f9d5160cd4e74ca897122718fa11a45734804cf2968053f1e593b60ccb
MD5 2c6db3fbd744ba525095f3639343c912
SHA1 9ef4a17f3247c26f8c8b46c02d3f37576bf011e2
SHA512 c7b108fcdaaa5b2e2eb203cfd4b7f0af86fcd0543986ee016df37b89b8fc878d3e91a5b0e3824567283c62b4c7d4d6cce01af78c231d6fda09ba6dc2634cf551
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T161E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmhfzxr.sys

Path C:\Temp\cxupmhfzxr.sys
Size 141KB
SHA256 ecba9e1ab98c0c5c37ef5f828263da6737cbffa498c13a12c841e7613915295e
MD5 ca76f9d2e617d2cd5e468c65f97dbe63
SHA1 51d4c1bdc8a24126e3598acd6b2c7aa4f6eb18d7
SHA512 5783a3f22d7540f7d8d05e768ca860c209921e505721cd2c2325423575c015c6c3e542000d56c29563ffe3945337a8ee7d19fa9c48f1afa42f1cc42a15c62413
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrjhbztr.exe

Path C:\Temp\eywrjhbztr.exe
Size 243KB
SHA256 9444093b1a515c82f5bbd99c881920eeb03d25fca89c3084101566110b518803
MD5 f79e7c581081372767ca038d1f1951da
SHA1 865c7d567f26d6d9edfcab2865ee82dfeaa6b481
SHA512 6c4d7a7c3bf20e5f6faf4cca703fedd59c6578652d1c81293b0e81ffb2354e4ea7eb9004541debaea6b2457330e7effeb8a4fdb8f7eebbdf286da716a5da8410
SSDEEP 3072:OVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:+XP7LQMa3lLNngoqRttA77
TLSH
T138345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifay.sys

Path C:\Temp\fdxvqnifay.sys
Size 141KB
SHA256 4a842ee2450e5622764d0c10385ed9a4616781da18fb9f23f1318e1497469e5f
MD5 1196f058bb26c4d276273bcbef2da5c4
SHA1 a1ec827499114b7a17c976a6d55eef027fa5eacb
SHA512 f457834d89856717763b1317b1d9e34fe1a9c20967a0b65f6d02e097352ad5440270afab82580a4848c20fc4aca42a0457b342aeb81834fbffc67ddd4b07e180
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcxsmkecxu.exe

Path C:\Temp\hcxsmkecxu.exe
Size 243KB
SHA256 7fc2c49440e0c06ea4baefe8c943daf18bbd036c2c1906976c32f1896f166ec5
MD5 93fa0ba74af76a49ec940d23819b9d04
SHA1 378323fcf48cbb2d906d46fa2c6f914513d88e8a
SHA512 03bd71737986d6f0c3e0cfbebce16df51f6b8f689ec25ab302234eb6e6cf12ebdadfdd1d65f6be8ff58c7e7f1f3931998b3baf9daf2ed8e6d34e6ae38777743d
SSDEEP 3072:gVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:MXP7LQMa3lLNngoqRttA7l
TLSH
T17D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcxsmkecxu.exe

Path C:\Temp\i_hcxsmkecxu.exe
Size 243KB
SHA256 892a173894742af7e9145b568981a4c40e22aa712146e05c5b3396649e7095fb
MD5 a7d9345c11d41a5a5101dda6b91b8d10
SHA1 35426416b6d728170fdee44fdd8fca1678f622bd
SHA512 d2842d889b28cbd06a9027af79c1a287ba4dc52e5f5acb59fa705ffb97d08cae9a7cd0c5d1d639a7648f0efa2bd71e2b76550ca674328a5db08b13b5a5175109
SSDEEP 3072:ZVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:rXP7LQMa3lLNngoqRttA7A
TLSH
T1AC345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvpnhfa.exe

Path C:\Temp\i_kfdxvpnhfa.exe
Size 243KB
SHA256 75d201badd3d021cab0ef73f094a45ac0a3d662b87974347107692d06320e639
MD5 afe1d6ff1e118a20a06da7939623e29d
SHA1 0107416a039a4c0722996c732e60e19d7c9e3ee1
SHA512 9d6a6eb9b99ffaefc1cf7f7372a6c2839ef569fb9a4a7191fdc22102fe7526763aba88940e4e192798f52562ec95f58d7066da5dbe303a8f90fceb2708da55ba
SSDEEP 3072:UVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:QXP7LQMa3lLNngoqRttA71
TLSH
T189345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqoiga.exe

Path C:\Temp\i_lfdyvqoiga.exe
Size 243KB
SHA256 23024c9ad6ad778aef8a3dcec7c76ccb40c11dcf93de32f14fbe1b000e3bee01
MD5 7830e04aadcf0f736d2e511f2da8b74a
SHA1 29b5594097bff6f149d322696efbcb7ed9568c47
SHA512 97b9477432960f7d5a347ebf3495928b920dc7022a894ad5c30f18b49da6ad1a461446c31166a1790186612064d7c6e18a5cc6366ba529accbe5999a770c2860
SSDEEP 3072:UVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:QXP7LQMa3lLNngoqRttA7B
TLSH
T15C345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczusmk.exe

Path C:\Temp\i_rpjhczusmk.exe
Size 243KB
SHA256 15f6fa78caadbbc8fd0795360cfd200f6b6dade0503f27676f249b27fdda918f
MD5 1d1acae41481982a0594afdbb68ec038
SHA1 ea8d3a3cb0ddb36858f0a3890e2ea7aff5c9a1dd
SHA512 ffb65336f1eb72f0ca6aacc6faf1f2bf47b115fb9365253e32e4742742c8231788813245e73308ad35918243c3ef97dddddc6dc186b534ce0ef1d718058cecbf
SSDEEP 3072:XVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:FXP7LQMa3lLNngoqRttA7W
TLSH
T1B7345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhbztrdb.exe

Path C:\Temp\i_uomhbztrdb.exe
Size 243KB
SHA256 f6d8ef188184378f128e633a2b512d48888a52773eab8780ec491c5c0b5351ac
MD5 c55d58d51f6f0f74fc16b91fdf8bb877
SHA1 ea859150e736c08bf95fb00766a4558081244a71
SHA512 ded3f8e49e4c00f22a52bf3edb34f71797bf061ec5d5625a1d5c32d782f7bf915c08ae232b996f8168403e92f7da98eec21dd00622788e0db9b95e1cad2cad59
SSDEEP 3072:jVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:xXP7LQMa3lLNngoqRttA7i
TLSH
T194345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavsn.exe

Path C:\Temp\i_ysqkicavsn.exe
Size 243KB
SHA256 93eda4a83398ec541d18c0cb9e6b590f288ef4806785190683ccd0d8b359615d
MD5 085a3b0c06cda5107673304cf576044f
SHA1 f6f481e3814c15173d621573224419387cdf1305
SHA512 b8f65bab6f29a4f8d72b9f3d3833f2b62983a63843f48f874e1b13b2010c75f85229c55eddd693dcd9c23c432b82332704e9a7f1ba17c3bba57ff570e08c9226
SSDEEP 3072:bVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:pXP7LQMa3lLNngoqRttA7u
TLSH
T17C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqljdbvtn.exe

Path C:\Temp\i_ytqljdbvtn.exe
Size 243KB
SHA256 5afbeaffa7d3da59cd52a108114356fd8135bde376b5650ead7b51f32e86a1ca
MD5 691947d8124a68993feaa863141abae8
SHA1 d3b26f145e6ad3b0a30cf3dd1c68daf7757a795f
SHA512 cc287472ef8ddb5b789ab1716aff53292c5e1170278c65fe6d15db79ba7146d6df87a540d8822552c874b5161ee98c28e7d979908e3ad543caae9e9524f7aef3
SSDEEP 3072:lVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:3XP7LQMa3lLNngoqRttA7c
TLSH
T18F345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgey.sys

Path C:\Temp\jdbvtolgey.sys
Size 141KB
SHA256 0b6ff068806bc2d23376e4025f748a06a809cbbe75465ac73e56705fd9a1036c
MD5 6b10273b595e9963938a71ab418cebe6
SHA1 f953c2b0a9ddfbcd4b2e77af0db75e0be426fbc8
SHA512 b59943a915173c51d4daa52e4ab1355783350651994d4d2fe1948cfbf6454429b4172077cf4d9714fe3cd087371e2b6ee7f27dc3f148ddbd0012a27119c36fdb
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T141E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.exe

Path C:\Temp\kfdxvpnhfa.exe
Size 243KB
SHA256 5206805bba8d7372faaddadcb6db8a99a1973d436bda9a1c28bdcb5518b1c6ed
MD5 eba7090fc8529689610f6d2fd85e5b7f
SHA1 86ca0fd046deebdd889a85156ff944c56b05adc8
SHA512 19e24a313740ad7ace21b600dab1c6e28738e49654f6ca64d338dfcd2b00172dc9b8748e1e56c5aff7e4de362ddf0d8e6ef4559e996c48ff60426074e8b27704
SSDEEP 3072:5VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:LXP7LQMa3lLNngoqRttA7c
TLSH
T1D8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoiga.exe

Path C:\Temp\lfdyvqoiga.exe
Size 243KB
SHA256 75f343e57bfbd4d2a8ea0e2e0ccb43c6f0c0758b2c13a329bfa14d40c6bd0e6b
MD5 5c0547d336f4d15f340209cf6ac92c4e
SHA1 0505f6943a6cea72536ae99993c3f92f9c229b78
SHA512 21e8a371801af7611b1f664627bf505e086f6a7af3a45f2ba389503075c4ddfff1ae374f8b01171b582d902823d6dd845bd941914fca9588f548854d74dbe1cb
SSDEEP 3072:HVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:1XP7LQMa3lLNngoqRttA76
TLSH
T1F5345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbzurmje.sys

Path C:\Temp\ojhbzurmje.sys
Size 141KB
SHA256 0cb586154fee9fec471c30ac04b6dfe644b8125133caf8a6901b60a0308e2070
MD5 4c63bded07024d4d4da3bf07e07c751a
SHA1 fb8edf54443a9b67b88e49f27e4827209ef88f3f
SHA512 d9b8ed84c7d683c291fc30f74ab2b1455a18c8984d00a3b5bc674400a30f1ebd89ae3bb0d600cf20961f71b1fd33666523993ba585feee926b6cd1e0621cdf07
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.sys

Path C:\Temp\pnhfzxspki.sys
Size 141KB
SHA256 0c354617b1637ee8c7ccd92f303ead304a88f36e0e821669e005ba992a9a4ae9
MD5 28d95cddfe787d1fb36ae08dfe44b6e6
SHA1 69c7986c393761269f6c7169831acb1fb50ec5ee
SHA512 036e64cf57591305c280b08a4328df8319ccf3df091de15719b8c76f619c03f3a2a00fa3ba3bdfb01c7fd6e0569559af4c9ec5842da16670bf21ca98d3d33848
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T117E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczusmk.exe

Path C:\Temp\rpjhczusmk.exe
Size 243KB
SHA256 c7b43d2b57b1f8489d56168058f5e3582279bfc4f9d999586f9dd4eeb6e6003a
MD5 5b16b7f7f552dab5c2081d600dab548d
SHA1 0ffecd448a303e8ab85e8fb4dea0417474d31957
SHA512 1e437e0a9352f31eec3db3bc6523c383026f5529db83ee04386654848f102ee9dce6501b4b19f43aede7d5f2f80c8376721a27271ff044dd9073ac9be5d0c808
SSDEEP 3072:cVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:4XP7LQMa3lLNngoqRttA7l
TLSH
T185345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidavtnl.sys

Path C:\Temp\sqlidavtnl.sys
Size 141KB
SHA256 637775f815b6165e9588ad8501bbcb33d7e7305684a88de500b31efe38e61ddb
MD5 7ffa0d88ccc5a82def14ab49fec83e76
SHA1 0e0d7fbb5c15990065438b6c9996889d6a79f48b
SHA512 2112d76818dd961580e7d77e53fe30ae3d715da7db202d22eff55c95b1c0410c226812c7b1b9e9c65026e5be309edaa29708805053eea56ff945e85ae1f2f91b
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhbztrdb.exe

Path C:\Temp\uomhbztrdb.exe
Size 243KB
SHA256 d78b29de5bf9faa05ff80f73d3b422fbfcf5121a17d14975071b28a6b90320a3
MD5 fdc2bd36cf9513a81cdf2749ab91e11b
SHA1 8743312d1b218ec916199722d978648885952f65
SHA512 38abcbeb61d6351683b05639677e98fc7459c94c6cb1012bfae652e861fa1f771bf4bc8d75e3d23ed40ef8bd064c6528cf1cf9b9d4fe223730eaf26d3c7e5651
SSDEEP 3072:3VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:lXP7LQMa3lLNngoqRttA7i
TLSH
T138345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.exe

Path C:\Temp\ysqkicavsn.exe
Size 243KB
SHA256 9614f25c9c99cc1c36de98ecc4908dd8dac8d7fab8ce3c8a54bb6e43e6974f2f
MD5 ce009a377d0f6a5fb43ef59dcc95ef8f
SHA1 0d0222dcdcc143aeeeb200a39cd92b57b5d54a6f
SHA512 f83125bf05176b34e7a20b581a5cad9038db32af8f86797df27cc46cf9604e223fb51c774b7ea0ed0b4a8da71a3cd208697a902b47592ec6eae6bd2331ecba80
SSDEEP 3072:YVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:kXP7LQMa3lLNngoqRttA7R
TLSH
T101345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.exe

Path C:\Temp\ytqljdbvtn.exe
Size 243KB
SHA256 b30bace109725efca3ca2633f3dd782408cfaf3628af1e5462995c8c67db3381
MD5 19e153127c13602afb78743f7acb3932
SHA1 6252aad7f7e6058cc5685edc6c3142df0716ce70
SHA512 1132b870c700530266e55a8046a67fdd8ed670636675b00286d94a00e57113f14c364add2e13ebcf98ea32cf8487028acab8df5209ddcedbbdd1c2b3dade049c
SSDEEP 3072:eVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:OXP7LQMa3lLNngoqRttA7/
TLSH
T10C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 3cfd17ccb547a4d72075ec997c31d1d3cb12aeabcf0554ae39b830105b17b348
MD5 f96cd688ef230e41b4108b6a5d1d0a49
SHA1 c290a569fe7f894d8e064fdde4a5f356c8a7c541
SHA512 42dc3cdb38e2eca045a3f0043499d1049dfa9a369917aac4377435c72cbb5d07ad8432a515f932f8d193586069a74f049b3ae055d9747f497e9b94b39a7857c4
TLSH
T182F0D4A2847EC8D03945F4CC155D8F773010D06354A500676078D8D141E579DD68AD34
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 9bc488fea8e564787e7553ae8d21b97f1a62c7fd9a997bd659142dc629d1bec9
MD5 35b3f96177a3786aea52bd47835a5f7a
SHA1 441938a5117f1874af3a36dd77c5f3a4e0ef1a60
SHA512 2d1a7785e6e28fd9967b36c920b274b2082af21aadd7edb1aea6babac914f5bf7b6f08393139a5eec7a41f9043382f11020c724561c42790fe94b950989f5dcb
TLSH
T1CCE0C03425FA411FF0E4E43A4FD5742285AFF026152D93B43AC85B04E74AA40FC13929
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KF3E8S94\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/996-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1732-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2164-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2376-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2848-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3252-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3504-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3588-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3716-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4820-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads