e95010a4f4eaaf88611d9ae535054f98ee948643cb39f70d205def9ace635c44

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
Size 243KB
Sample260809-k33gmscl8v
SHA256 e95010a4f4eaaf88611d9ae535054f98ee948643cb39f70d205def9ace635c44
MD5 7ae1b0bd40e2828f26f227dcf65b76cf
SHA1 8e8a16f07d2409911cec1dca557284890811d950
SHA512 8ea9d6b22bbad5b32318653be4a65a7b960959d94d3edff0fb697b5e9c9da9dfdea9559cd09f8d307a02560523583b5143c70fb1b7e79ec930fc0a8238f2f89d
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:hvMsLaOa3lLNngoqRttA7A
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4828	CP.exe
1192	rpjhbzurmj.exe
1944	CP.exe
1072	CP.exe
1588	i_rpjhbzurmj.exe
3600	zwrojhbztr.sys
4716	CP.exe
2148	ljebwuomge.exe
3740	CP.exe
2812	CP.exe
5108	i_ljebwuomge.exe
4428	ztrljdbwto.sys
820	CP.exe
5112	oigbvtnlgd.exe
3604	CP.exe
380	CP.exe
408	i_oigbvtnlgd.exe
1868	jdbvtnlgdy.sys
3664	CP.exe
2600	ysqlidbvtn.exe
4200	CP.exe
468	CP.exe
2000	i_ysqlidbvtn.exe
2928	vqoigaysql.sys
2552	CP.exe
2052	aysqkidavs.exe
4772	CP.exe
1680	CP.exe
1820	i_aysqkidavs.exe
4000	ysqkfdxvpn.sys
1812	CP.exe
4628	kicavsnica.exe
1876	CP.exe
4172	CP.exe
4688	i_kicavsnica.exe
2764	icausmkicx.sys
4132	CP.exe
3052	xupnhfzxsp.exe
4376	CP.exe
2700	CP.exe
764	i_xupnhfzxsp.exe
4664	pjhczurmke.sys
2084	CP.exe
2536	ecwupmhfzx.exe
3828	CP.exe
4896	CP.exe
2800	i_ecwupmhfzx.exe
2596	pjhczusmke.sys
1276	CP.exe
4672	wuomhezwrp.exe
4340	CP.exe
4768	CP.exe
1432	i_wuomhezwrp.exe
4712	bztrmjecwu.sys
1884	CP.exe
968	uojhbztrlg.exe
3612	CP.exe
4100	CP.exe
4724	i_uojhbztrlg.exe
2660	qojgbytrlj.sys
4116	CP.exe
2764	jdbwtomgey.exe
3796	CP.exe
420	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojhbztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojhbztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvt.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2504	ipconfig.exe
3428	ipconfig.exe
3232	ipconfig.exe
5008	ipconfig.exe
220	ipconfig.exe
812	ipconfig.exe
1992	ipconfig.exe
1700	ipconfig.exe
3676	ipconfig.exe
4104	ipconfig.exe
2420	ipconfig.exe
3428	ipconfig.exe
888	ipconfig.exe
1996	ipconfig.exe
3700	ipconfig.exe
3192	ipconfig.exe
4580	ipconfig.exe
1800	ipconfig.exe
3060	ipconfig.exe
4840	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3057229053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E0CC3242-93D1-11F1-9D43-FE415EB581C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c05f18e727dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493031497"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3050822535"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270878"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000cb0f7819aa622b8739ac023cec7d0635371a80651c507a49a9ed5fd49a216654000000000e80000000020000200000006849b32881f89213c17cdb41dc09a88e7fc54a415d9857aa81285573f172a7332000000064e65748c42fb264218885d05cc2f5bacb83e0f5ca0cb8c8969cb9c0237613594000000060af9cce90fecb49d05e7588957227a0b10955f5794657d03c07946e8bc233c8f52939ffd7dbb41d0650c4a377d613a06ee3475097a3033319b096aa942d37cf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f74e18e727dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000c47b01c97dece7dcb197c8c3b14ff2b50184892f23e8ba90c6b5a26edeb155f9000000000e8000000002000020000000e7709ad557e1853f0f3ed0000e17fb2468f1d1bb5a1c88b6964c8b06550e874f20000000da904af8e0b3f0f5178c46d9468094dab27228c046f13076de7799a18028b688400000004cd03cd1994e6a2c5c19d17f8d9698238594f872405949a56d845ab7580a817a1fc603f4c438b95269f39dc64efb5b23eb9fe3980e21034de1643ff0ffc82afa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	i_rpjhbzurmj.exe
Token: SeDebugPrivilege	5108	i_ljebwuomge.exe
Token: SeDebugPrivilege	408	i_oigbvtnlgd.exe
Token: SeDebugPrivilege	2000	i_ysqlidbvtn.exe
Token: SeDebugPrivilege	1820	i_aysqkidavs.exe
Token: SeDebugPrivilege	4688	i_kicavsnica.exe
Token: SeDebugPrivilege	764	i_xupnhfzxsp.exe
Token: SeDebugPrivilege	2800	i_ecwupmhfzx.exe
Token: SeDebugPrivilege	1432	i_wuomhezwrp.exe
Token: SeDebugPrivilege	4724	i_uojhbztrlg.exe
Token: SeDebugPrivilege	2364	i_jdbwtomgey.exe
Token: SeDebugPrivilege	5092	i_aytqlidbvt.exe
Token: SeDebugPrivilege	3956	i_sqkidavtnl.exe
Token: SeDebugPrivilege	1664	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	3172	i_pnhfaxspki.exe
Token: SeDebugPrivilege	1528	i_ecwupkhcau.exe
Token: SeDebugPrivilege	1768	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	1280	i_wrpjhbzroj.exe
Token: SeDebugPrivilege	2152	i_omgeywqojg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
4328	IEXPLORE.EXE
4328	IEXPLORE.EXE
4328	IEXPLORE.EXE
4328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2272	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	85
PID 2272 wrote to memory of 4328	2272	iexplore.exe	86
PID 2324 wrote to memory of 4828	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	87
PID 1192 wrote to memory of 1944	1192	rpjhbzurmj.exe	90
PID 2324 wrote to memory of 1072	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	94
PID 2324 wrote to memory of 4716	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	100
PID 2148 wrote to memory of 3740	2148	ljebwuomge.exe	102
PID 2324 wrote to memory of 2812	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	105
PID 2324 wrote to memory of 820	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	109
PID 5112 wrote to memory of 3604	5112	oigbvtnlgd.exe	111
PID 2324 wrote to memory of 380	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	114
PID 2324 wrote to memory of 3664	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	118
PID 2600 wrote to memory of 4200	2600	ysqlidbvtn.exe	120
PID 2324 wrote to memory of 468	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	123
PID 2324 wrote to memory of 2552	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	130
PID 2052 wrote to memory of 4772	2052	aysqkidavs.exe	132
PID 2324 wrote to memory of 1680	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	135
PID 2324 wrote to memory of 1812	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	139
PID 4628 wrote to memory of 1876	4628	kicavsnica.exe	141
PID 2324 wrote to memory of 4172	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	144
PID 2324 wrote to memory of 4132	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	148
PID 3052 wrote to memory of 4376	3052	xupnhfzxsp.exe	150
PID 2324 wrote to memory of 2700	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	153
PID 2324 wrote to memory of 2084	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	157
PID 2536 wrote to memory of 3828	2536	ecwupmhfzx.exe	159
PID 2324 wrote to memory of 4896	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	162
PID 2324 wrote to memory of 1276	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	166
PID 4672 wrote to memory of 4340	4672	wuomhezwrp.exe	168
PID 2324 wrote to memory of 4768	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	171
PID 2324 wrote to memory of 1884	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	179
PID 968 wrote to memory of 3612	968	uojhbztrlg.exe	181
PID 2324 wrote to memory of 4100	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	187
PID 2324 wrote to memory of 4116	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	191
PID 2764 wrote to memory of 3796	2764	jdbwtomgey.exe	193
PID 2324 wrote to memory of 420	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	196
PID 2324 wrote to memory of 900	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	200
PID 4976 wrote to memory of 3880	4976	aytqlidbvt.exe	202
PID 2324 wrote to memory of 4760	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	205
PID 2324 wrote to memory of 3508	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	209
PID 1992 wrote to memory of 3188	1992	sqkidavtnl.exe	211
PID 2324 wrote to memory of 1600	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	214
PID 2324 wrote to memory of 1096	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	218
PID 4532 wrote to memory of 1596	4532	vsnkfdxvpn.exe	220
PID 2324 wrote to memory of 1088	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	223
PID 2324 wrote to memory of 4948	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	227
PID 3976 wrote to memory of 1588	3976	pnhfaxspki.exe	229
PID 2324 wrote to memory of 2584	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	232
PID 2324 wrote to memory of 3692	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	236
PID 2796 wrote to memory of 1048	2796	ecwupkhcau.exe	238
PID 2324 wrote to memory of 372	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	241
PID 2324 wrote to memory of 4880	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	245
PID 1012 wrote to memory of 4108	1012	xrpjhbzurm.exe	247
PID 2324 wrote to memory of 4972	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	250
PID 2324 wrote to memory of 456	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	254
PID 2172 wrote to memory of 2192	2172	wrpjhbzroj.exe	256
PID 2324 wrote to memory of 3956	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	259
PID 2324 wrote to memory of 3776	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	263
PID 4684 wrote to memory of 1800	4684	omgeywqojg.exe	265
PID 2324 wrote to memory of 1816	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	268
PID 2324 wrote to memory of 2208	2324	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	272
PID 3600 wrote to memory of 3164	3600	ytnlgdywqo.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4828
- - C:\Temp\rpjhbzurmj.exe
    C:\Temp\rpjhbzurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1072
- - C:\Temp\i_rpjhbzurmj.exe
    C:\Temp\i_rpjhbzurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4716
- - C:\Temp\ljebwuomge.exe
    C:\Temp\ljebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Temp\i_ljebwuomge.exe
    C:\Temp\i_ljebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:820
- - C:\Temp\oigbvtnlgd.exe
    C:\Temp\oigbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:380
- - C:\Temp\i_oigbvtnlgd.exe
    C:\Temp\i_oigbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\ysqlidbvtn.exe
    C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:468
- - C:\Temp\i_ysqlidbvtn.exe
    C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Temp\aysqkidavs.exe
    C:\Temp\aysqkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\i_aysqkidavs.exe
    C:\Temp\i_aysqkidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1812
- - C:\Temp\kicavsnica.exe
    C:\Temp\kicavsnica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Temp\i_kicavsnica.exe
    C:\Temp\i_kicavsnica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\xupnhfzxsp.exe
    C:\Temp\xupnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2700
- - C:\Temp\i_xupnhfzxsp.exe
    C:\Temp\i_xupnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2084
- - C:\Temp\ecwupmhfzx.exe
    C:\Temp\ecwupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4896
- - C:\Temp\i_ecwupmhfzx.exe
    C:\Temp\i_ecwupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Temp\wuomhezwrp.exe
    C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_wuomhezwrp.exe
    C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uojhbztrlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1884
- - C:\Temp\uojhbztrlg.exe
    C:\Temp\uojhbztrlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uojhbztrlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\i_uojhbztrlg.exe
    C:\Temp\i_uojhbztrlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:420
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqlidbvt.exe ups_run
  2⤵
  PID:900
- - C:\Temp\aytqlidbvt.exe
    C:\Temp\aytqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqlidbvt.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_aytqlidbvt.exe
    C:\Temp\i_aytqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  PID:3508
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  PID:1600
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvpn.exe ups_run
  2⤵
  PID:1096
- - C:\Temp\vsnkfdxvpn.exe
    C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
  2⤵
  PID:1088
- - C:\Temp\i_vsnkfdxvpn.exe
    C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxspki.exe ups_run
  2⤵
  PID:4948
- - C:\Temp\pnhfaxspki.exe
    C:\Temp\pnhfaxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxspki.exe ups_ins
  2⤵
  PID:2584
- - C:\Temp\i_pnhfaxspki.exe
    C:\Temp\i_pnhfaxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupkhcau.exe ups_run
  2⤵
  PID:3692
- - C:\Temp\ecwupkhcau.exe
    C:\Temp\ecwupkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupkhcau.exe ups_ins
  2⤵
  PID:372
- - C:\Temp\i_ecwupkhcau.exe
    C:\Temp\i_ecwupkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbzurm.exe ups_run
  2⤵
  PID:4880
- - C:\Temp\xrpjhbzurm.exe
    C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
  2⤵
  PID:4972
- - C:\Temp\i_xrpjhbzurm.exe
    C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzroj.exe ups_run
  2⤵
  PID:456
- - C:\Temp\wrpjhbzroj.exe
    C:\Temp\wrpjhbzroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzroj.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_wrpjhbzroj.exe
    C:\Temp\i_wrpjhbzroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:3776
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:1816
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlgdywqo.exe ups_run
  2⤵
  PID:2208
- - C:\Temp\ytnlgdywqo.exe
    C:\Temp\ytnlgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:3600

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Temp\ysqkfdxvpn.sys
C:\Temp\ysqkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:4000

C:\Temp\icausmkicx.sys
C:\Temp\icausmkicx.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:2596

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4712

C:\Temp\qojgbytrlj.sys
C:\Temp\qojgbytrlj.sys
1⤵
- Executes dropped EXE
PID:2660

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:3412

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
PID:2080

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
PID:3872

C:\Temp\avsnkfdxvp.sys
C:\Temp\avsnkfdxvp.sys
1⤵
PID:3844

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:1084

C:\Temp\mkecxupnhf.sys
C:\Temp\mkecxupnhf.sys
1⤵
PID:1952

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
PID:444

C:\Temp\ztrljebwto.sys
C:\Temp\ztrljebwto.sys
1⤵
PID:5008

C:\Temp\jeywqoigby.sys
C:\Temp\jeywqoigby.sys
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavs.exe

Path C:\Temp\aysqkidavs.exe
Size 243KB
SHA256 c241a16365bb8aa5615e653f7937844d9047ce2e7e199b04af50a404c28c9df3
MD5 7bb3188bd14425d9684feea73f1c9bfb
SHA1 3640c02b7c40c16046b251738e47013034402759
SHA512 df538e3f045b2ea78451e59b9d8dca0a56f3f92738bdcbb2695559e0411ebaee352ebf80f640eb229eb0e4e195d07cbf199d08bb1ed7407a3577c04b793045cf
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:TvMsLaOa3lLNngoqRttA72
TLSH
T177345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupmhfzx.exe

Path C:\Temp\ecwupmhfzx.exe
Size 243KB
SHA256 2f6dac29b8fb17ff1b669ec3110d7825fcf1009258676d3d68339c9ac6be5d6d
MD5 6be938ba33f8e59fd6e5b8496bf745f2
SHA1 af275b8ba33004725d5fa6837f470338629e7c2d
SHA512 407101103c312781e6af911ff8c4a28a30b732ef04209e359a4698a7ed6c6fb89acc56b9c1f76c45019310060c5652a9015b5d6c847dc4694b97b9267a8c031d
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:bvMsLaOa3lLNngoqRttA7u
TLSH
T107345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkidavs.exe

Path C:\Temp\i_aysqkidavs.exe
Size 243KB
SHA256 bd21b9a8ade56d029e518eb43270ef9ef2939d0757c7376221a42bb33304adac
MD5 4342bb2d747ef974efa98b0f450a4c09
SHA1 01d7ae43b807e910c84981974e37d887ae979ea1
SHA512 4a53ba934fe036ce3b30a69f9669b4f32ed7647315cd489341233eebbe1cabaabcd5ee37bfb1e54e0396841634b8ac121a333d7bf281340c8501589849c25812
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:1vMsLaOa3lLNngoqRttA7c
TLSH
T13E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavsnica.exe

Path C:\Temp\i_kicavsnica.exe
Size 243KB
SHA256 d7eddf887ef0b49f5fbcd1fa23e9277e70cae974abe3525c0c119c660a55d16a
MD5 28fd42d393975ba62d51341f65a62b1a
SHA1 914afb4047c70c4ca93524f717fa920929cbed73
SHA512 59e9ac9a1385002f391190b41b2c7a8d7e34d50da0734494009fe4cd9e47edf3da879922c96a5efb2ea48db0c4b7e3b51129aa46ad11224b5d7573d59c61c639
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:7vMsLaOa3lLNngoqRttA7G
TLSH
T10F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebwuomge.exe

Path C:\Temp\i_ljebwuomge.exe
Size 243KB
SHA256 3f5e5acf8a874514054055fa269fa2013288b9c2790884c9e8e838c572b62505
MD5 6e28d52afac61e4ee8a574c0bfa2857d
SHA1 21b85ab5387cddff1c417f4d22db43fe86ad1d97
SHA512 3121ec173f06a5be4319acbd201ce3ec0ef1b66dedc8174f7a5a0493beaf76f22ab3e464480458f729883a30dd64de7fc799f464880fc18c298d396f7da8a68d
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:fvMsLaOa3lLNngoqRttA7O
TLSH
T14C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbvtnlgd.exe

Path C:\Temp\i_oigbvtnlgd.exe
Size 243KB
SHA256 d82ca0b7d26a4a1f0c72a58a2ccbe515861f3824e1b080b3fd74c937a5a86fbe
MD5 5c3f20903f5fd360b6503ee3830e9954
SHA1 bc016ff379047297218ac66b312047342ebe58fc
SHA512 d8c12fefc6d2e67635d4860a0890928880ba03e57af6d36896c9744e2d091a3e648e98ce04910b822eaedf869c965c0c2055e17c3e92761d3c1df464946a60cc
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:4vMsLaOa3lLNngoqRttA7L
TLSH
T124345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzurmj.exe

Path C:\Temp\i_rpjhbzurmj.exe
Size 243KB
SHA256 36f9180aa20d707729e077eee4e78b1e2e12ec16a700ebee13ba7f9cb07b2417
MD5 4f8bd903b605e60e3bad888f982bc79a
SHA1 12bf1fe13249fb003f29f02acd06e622b9dd5c81
SHA512 c79f1fa0210d98cc1deb6f684bfc4f7fe4691c2f9368e7a855f05c92ca728ed03d2b2f0a7edf033eba127a4f96122311775da486aab1ee223eb7ca21cc4896c1
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:+vMsLaOa3lLNngoqRttA7B
TLSH
T18D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupnhfzxsp.exe

Path C:\Temp\i_xupnhfzxsp.exe
Size 243KB
SHA256 b7adc4ad5014b854ab179655e2b2595147d59f79ba11574ba228a098b4c1d86e
MD5 8df66a04bb266e106746162b49bcbfaa
SHA1 54aabcffc12916f0d84f8a724393aaa522d01d09
SHA512 c23625b557c75b8d47444dd6569089648b892687c3dc11a31ce8085c4baf914fee4058e9b35a0145d8919cd84c69702bdb8a23f8c89228e75785c0e39f2dd21a
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:2vMsLaOa3lLNngoqRttA7p
TLSH
T1FB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidbvtn.exe

Path C:\Temp\i_ysqlidbvtn.exe
Size 243KB
SHA256 cc2a83b80e37dfabd9396582958c0d7eb7156fa87223ee03bcd3b76dbd7b3f70
MD5 e5d289a184b5fe778201f56a2f11ec05
SHA1 ef23e25112f29381c737225abb7f55e37595714f
SHA512 1ffd795fb2a8a29929642461e724a36f390591cb9c8c4c3152fd46e691dec57d13ad0d21981644b44f9dc03a5592c83da4af2be0a0e3635334561efe426473f6
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:+vMsLaOa3lLNngoqRttA79
TLSH
T184345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkicx.sys

Path C:\Temp\icausmkicx.sys
Size 141KB
SHA256 7f9858b571c9b4dc0b77a363138d5f9c7e6150befea6b847f33a3b2b6d28f597
MD5 d15eb2695bbbde04a834a87b805a1734
SHA1 baac5ace76891534fdd55db38e18be0551cecbb2
SHA512 36960a0a7180b78c9d7f78f0229d0f484d1c81a53381c00664e55e83569e2d0bee1a1f1015fdd3dc1b4a147ada3af2fbe3b62a11fb4aac66192049e985434d45
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.sys

Path C:\Temp\jdbvtnlgdy.sys
Size 141KB
SHA256 3be8d16ca3e2540803de0b83d9d4416069a843be77e77ccaa0bfee9b1085123a
MD5 447282793247ed18161bd5ad723205cd
SHA1 2316782a0d05fe0dc39e4934166d7ed5c5fbd704
SHA512 664b9042bd8afbc828eb1e7780544ee54780c22834e31f3b1f91e6b5c00e0e7508633cef708988b3df41b5db1c95134c81809a6bba4e57e071543667dfcb6ed6
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T152E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnica.exe

Path C:\Temp\kicavsnica.exe
Size 243KB
SHA256 d89a61e13a072840040c99f40c63921377b95d3c361befb8f48c69f9fc49a2ae
MD5 533fdae6e5300371ed0633eaf333ad86
SHA1 648d788fe4568991534809daffbfa274a461f0b9
SHA512 64383bbe7580f4073d98142407acbf878dc8a8d318bd479394d7858e9358341f7617def43efd14a80b8898f3db44c99b40095d270bea95efbf884a2e4e568aaa
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:wvMsLaOa3lLNngoqRttA7v
TLSH
T181345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomge.exe

Path C:\Temp\ljebwuomge.exe
Size 243KB
SHA256 d5288de42e1b1d9cb06b708470f418734988dbc0089ffc4a2d2f3aa0d4d7128e
MD5 6d4df4ffd9f07a32df845c222b730434
SHA1 919d0ab93902c13132ccd1145bd97315c76633ae
SHA512 8a15a9fc6f429b60ab5e3bc589a9f020dcb0ce1cc6b314e4757b9c04d0c26cce99c8bd686614fc6a62937d2fcaf8184e5407628ad48ad7eaa84fafeb63c6ce97
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:DvMsLaOa3lLNngoqRttA7a
TLSH
T19F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbvtnlgd.exe

Path C:\Temp\oigbvtnlgd.exe
Size 243KB
SHA256 22bd57bdcb523b95bc70fa154604829de73d74d7187351dcad711dcacb494beb
MD5 3173132bf074511fe5d260e826e670c8
SHA1 df0c791fc652a4c39b8c069934b2142c21666455
SHA512 0a392afcd3cfc4d40425d1efdceee5fb629daef138e0d01a31158c6a128d5e599177380bb0633d4ccf0b93eb24d37b75f3ba90a470bc8af361089ef3f7cb607e
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:hvMsLaOa3lLNngoqRttA7A
TLSH
T19F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurmke.sys

Path C:\Temp\pjhczurmke.sys
Size 141KB
SHA256 c43df90769ee3cb144c88e82d040a644721e63dc9cdd1e8dd50983174c523f93
MD5 4ca13d5db280a24d1b5e684fb9604705
SHA1 84fc2e7ceb69af4116e80438b42c98f58f5571c1
SHA512 e427469a1d10dcd2633a8427e869aca8cfe81f9cf555badd04128a98ef0bca9ca2ff6835ae7527df423b2526ea05fbe7a06e533855ebf80e36cc509f5df2e8ec
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzurmj.exe

Path C:\Temp\rpjhbzurmj.exe
Size 243KB
SHA256 c284a6cca3804a32347e7163a8aafdbfb9b268dfaa4aa0acd34d884e5012329d
MD5 b57e7037289927574561552611f75b94
SHA1 872f8e682be367bfb2300da7b9df2b61259467de
SHA512 4ba309f0893d3654b6807c285cb2fd6b0c3623fd654502d5edb8373c9973bc48ded9caccb947ed43f7c66c7c631d6b419567bfeb51f6d32138e1ec7773bba3d3
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:OvMsLaOa3lLNngoqRttA7d
TLSH
T1C1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.sys

Path C:\Temp\vqoigaysql.sys
Size 141KB
SHA256 40cd4d7ec3c0cfc918960f96e605f968c841fcf4362b42d392215cd097cca555
MD5 a92a19e83d73cad9794471cf27ef5027
SHA1 ce4dc8e9507fd41afb8df1e7e53cd5452def6c8f
SHA512 2434eeb1b07be8830eb38de53fecfb565ff84df8ac1f9a5d7484656b3862e022560f6072805f4adce95f06d4a797d0c64a9b5cbd571f084ab5c0817a3cb5e756
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxsp.exe

Path C:\Temp\xupnhfzxsp.exe
Size 243KB
SHA256 987441792d3058ebf936cbef236f81d5cb8c8d4355ff4365d635f68b6b3b3ca6
MD5 7f59dc9e2e4accbf68073fb7da3a689e
SHA1 4cfd81f1c465959a4e3487d8820c5406b8a0c95f
SHA512 6daf6a266117cbca93e9f938d5628ad014cb9017eaae7d8ef715ebaaff4f7e001fdca08952f16adcd16227dc19a79a6bfe16a794ef75f0971cf265c83d32a49d
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:avMsLaOa3lLNngoqRttA7B
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkfdxvpn.sys

Path C:\Temp\ysqkfdxvpn.sys
Size 141KB
SHA256 beb7d32ae80b465ec626e71ad21b00627b64aa8631036fdb20ac2c5a858385d3
MD5 06477a3ef72d0529465d69ea08627ddc
SHA1 99cf651dc096d7cf061d6ac1e78b92cca650784b
SHA512 f97806e171e0fa0bf83f33a36dd959afc5918d2f9372d75e119ba302eaa012338aa70aed4a733b6719aebc96308e8f2a487e22618b051b375db805cb0bc723d1
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.exe

Path C:\Temp\ysqlidbvtn.exe
Size 243KB
SHA256 2e54c95e29d3965dadf19f3a8cb6f87985acd22fcec92b6d68836903e8dc5e23
MD5 f3e63ca4f596e5b0909b192d138fbf78
SHA1 93a791fe779c3a0a2af3453b0f74853ec5389124
SHA512 3f0b34781aebd42f85aa8f70699fb924950f42e3ef4190279e83eb0fdc669a6261e5bc5bb45aef9a666fc4d98ca8fd30d32902e8e0fea5db124600291ef16966
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:XvMsLaOa3lLNngoqRttA7W
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 5465e41425d59bec386157df9652e9ff6aacc37b8800aa8b5a88034ff8f931a4
MD5 20839747ef5653698a6390f46137290e
SHA1 0444b37f8911aacfa102f61deced99f152700347
SHA512 90962e7492f9d473c3b3e60e7f03e5736e9060180b1ec81f66222fcab7b060d5e120ff7dc731da7b37ea3c38ebaf2f66123aed6494acf19e8b33b7705feac583
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojhbztr.sys

Path C:\Temp\zwrojhbztr.sys
Size 141KB
SHA256 e1951b1706e307940ff3593365178cd2726c22ba2dd077e4d311add94797d295
MD5 4d45c5fc2fab3756d9b8d6026adb583e
SHA1 9c3a5a12f97da38e2e3823630185189d296b6ec6
SHA512 c59edbc2e4caa8d1d0f330d9f1044e5c50ac4118ce901243fe4e33ed1ff4574c1d3dc083c668a0bdfa902c691a9894db25aa1d721ae14787242da38f78d13a3e
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 b6fd7591c4a27973ec150915ee89be0a402ac65c33854932505027be356b21d1
MD5 6b6f64e3af4dbdd5a64117c06537d852
SHA1 53f0b19cd838af32c90f5519a6429d06512a8fbb
SHA512 87e156e0442445736309cdcd077156f256cd99aadf67eeae677c887aff9758df978f861fbb32fabfdfab0f4f94e80ca96128f3fade0c5d4051a3b55423ed8acf
TLSH
T167F0DCD180BCE870AAE0F8FC21B4D6F030B0D8AE0844561AB028A1F10E52BB97F1F475
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 faf321bfad0cb113978da157992a358260b2d672b8759d137f85b9eb4a02a7ee
MD5 d77824a589880861f16b58d4d0ae919e
SHA1 341b036f7c753b6c547be0f7c21b623121dea954
SHA512 45264830aef8e7017e732638ef2a78daa3c319c726311b8ff40c5831eab3bbdf8001cb94f65373ff3a3467244944ac37a0098e0263e9e7cd3a51ce0236443ce2
TLSH
T14AE0C03815FA411FF0F7D4354BCD742642B9F03A3029A2B42EE65B08B7069809C03B29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\76M6ZWYJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1868-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2512-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2596-104-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-115-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2764-83-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2928-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3412-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3600-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3872-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4000-71-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4664-95-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4712-111-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5008-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads