aeb95dbbda4ce422cd6275283c018fb78fed3f08ef0430eb122ac789cde543f0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe
Size 243KB
Sample260910-z6styagr2t
SHA256 aeb95dbbda4ce422cd6275283c018fb78fed3f08ef0430eb122ac789cde543f0
MD5 f7ccd17b73927fc65cc00e7a3cb428f8
SHA1 d5a5e72ef8e7412d9c935cbb4078eae522de702e
SHA512 f9449dabc357d4e5b8672f37fad72a6ff33274b9e01a61df10f400d01fa605b8d1d7d9a69e05d88707374c66d54d6274712dc02bbd13db29339f59825b66483b
SSDEEP 3072:t2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:twD99LB68zowa3lLNngoqRttA7x
TLSH
T193345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1880	CP.exe
4588	ezpjhbztrm.exe
3720	CP.exe
4832	CP.exe
2240	i_ezpjhbztrm.exe
2368	bztrmjebwu.sys
3144	CP.exe
5020	uojdbwuomg.exe
1884	CP.exe
1100	CP.exe
4732	i_uojdbwuomg.exe
448	qoigbytrlj.sys
4068	CP.exe
3592	jdbvtnlgdy.exe
1936	CP.exe
4512	CP.exe
3924	i_jdbvtnlgdy.exe
1260	dbvtnlgdyw.sys
1712	CP.exe
2124	sqlidbvtnl.exe
4524	CP.exe
3968	CP.exe
4724	i_sqlidbvtnl.exe
64	avtnlfdxvq.sys
4704	CP.exe
1092	ifaysqkida.exe
4788	CP.exe
556	CP.exe
2148	i_ifaysqkida.exe
1700	ifaysqkica.sys
5028	CP.exe
4540	avsnkfdxvp.exe
4604	CP.exe
2236	CP.exe
2848	i_avsnkfdxvp.exe
208	xvpnhfaxsp.sys
3660	CP.exe
856	pkicausmkf.exe
3880	CP.exe
1516	CP.exe
2404	i_pkicausmkf.exe
4432	khczusmkec.sys
4184	CP.exe
4168	cwupmhbusm.exe
1736	CP.exe
4692	CP.exe
4700	i_cwupmhbusm.exe
2868	ezxrpjhbzu.sys
4452	CP.exe
5048	pjecwuomhe.exe
3188	CP.exe
4632	CP.exe
2368	i_pjecwuomhe.exe
3868	wrojhbztrl.sys
2732	CP.exe
1988	pjhbztrmje.exe
816	CP.exe
208	CP.exe
8	i_pjhbztrmje.exe
1212	rojgbztrlj.sys
3832	CP.exe
3996	jdbwtomgey.exe
4380	CP.exe
1480	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhbusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojdbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhbusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojdbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1348	ipconfig.exe
208	ipconfig.exe
4452	ipconfig.exe
1020	ipconfig.exe
2612	ipconfig.exe
1000	ipconfig.exe
1524	ipconfig.exe
4772	ipconfig.exe
3480	ipconfig.exe
2856	ipconfig.exe
5072	ipconfig.exe
3500	ipconfig.exe
2872	ipconfig.exe
4100	ipconfig.exe
2372	ipconfig.exe
1212	ipconfig.exe
2964	ipconfig.exe
4112	ipconfig.exe
3432	ipconfig.exe
620	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1159358899"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1019515313"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277418"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2023f49e7241dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c0fd9e7241dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "495840186"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{67FDD4F2-AD5D-11F1-AA2C-D2489D1A2768} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064fa73ed4a5c0b489b7abdd666e29dec0000000002000000000010660000000100002000000065b3134f98bd0dccfc6f9f2f73d225d6b916bfbf2aa0f144f6ce4007b86646b3000000000e8000000002000020000000868ea5da47360383112e095328961045e4206e226834ce68b5bd0635203958ba200000007bbeab670d152d233937a865d66bf78294630c7854f1eb9b6e1d109611c318f3400000002ff32795741ff9dc00448c0242a146613406ea286b63005ce82759d07444ee5f7a62847fd8b99bd24d8ba4b189bfdd451722ffb7ace50679df14264c31214f78	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064fa73ed4a5c0b489b7abdd666e29dec0000000002000000000010660000000100002000000029c35aec996dbfe3a9599ec4916ad9f90b7574e93f1ee6dfea892994e32b9ab6000000000e8000000002000020000000c5bb3e67e5ba242181bf061923c71aaa879bf623340e1658827fede4d9d8a17f20000000cb092f7c15e787559de7c3359bd3fc94c677997bc2c27e0e073c3f5b7eeb8f8c40000000fae92f383fc36c12b4bb23b4dbb91f5622836e7750b073a56425d43929939c8fe2db76b3bb9e22c34fee3a1067775bb74fbf5cbd113b84a4bcf14a858e793fc5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	i_ezpjhbztrm.exe
Token: SeDebugPrivilege	4732	i_uojdbwuomg.exe
Token: SeDebugPrivilege	3924	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	4724	i_sqlidbvtnl.exe
Token: SeDebugPrivilege	2148	i_ifaysqkida.exe
Token: SeDebugPrivilege	2848	i_avsnkfdxvp.exe
Token: SeDebugPrivilege	2404	i_pkicausmkf.exe
Token: SeDebugPrivilege	4700	i_cwupmhbusm.exe
Token: SeDebugPrivilege	2368	i_pjecwuomhe.exe
Token: SeDebugPrivilege	8	i_pjhbztrmje.exe
Token: SeDebugPrivilege	2392	i_jdbwtomgey.exe
Token: SeDebugPrivilege	400	i_aysqlidbvt.exe
Token: SeDebugPrivilege	3808	i_vqkidavsnl.exe
Token: SeDebugPrivilege	2876	i_ysnlfdxvqn.exe
Token: SeDebugPrivilege	1336	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	4944	i_kecxupnhfz.exe
Token: SeDebugPrivilege	4412	i_bzurmkecwu.exe
Token: SeDebugPrivilege	5060	i_cwuomhezwr.exe
Token: SeDebugPrivilege	1768	i_trljdbwtom.exe
Token: SeDebugPrivilege	3060	i_gbytrljdbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4640	iexplore.exe
4640	iexplore.exe
4192	IEXPLORE.EXE
4192	IEXPLORE.EXE
4192	IEXPLORE.EXE
4192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4640	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	85
PID 4640 wrote to memory of 4192	4640	iexplore.exe	86
PID 4248 wrote to memory of 1880	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	87
PID 4588 wrote to memory of 3720	4588	ezpjhbztrm.exe	90
PID 4248 wrote to memory of 4832	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	93
PID 4248 wrote to memory of 3144	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	97
PID 5020 wrote to memory of 1884	5020	uojdbwuomg.exe	99
PID 4248 wrote to memory of 1100	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	102
PID 4248 wrote to memory of 4068	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	106
PID 3592 wrote to memory of 1936	3592	jdbvtnlgdy.exe	108
PID 4248 wrote to memory of 4512	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	111
PID 4248 wrote to memory of 1712	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	117
PID 2124 wrote to memory of 4524	2124	sqlidbvtnl.exe	119
PID 4248 wrote to memory of 3968	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	124
PID 4248 wrote to memory of 4704	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	134
PID 1092 wrote to memory of 4788	1092	ifaysqkida.exe	136
PID 4248 wrote to memory of 556	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	139
PID 4248 wrote to memory of 5028	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	143
PID 4540 wrote to memory of 4604	4540	avsnkfdxvp.exe	145
PID 4248 wrote to memory of 2236	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	148
PID 4248 wrote to memory of 3660	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	152
PID 856 wrote to memory of 3880	856	pkicausmkf.exe	154
PID 4248 wrote to memory of 1516	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	157
PID 4248 wrote to memory of 4184	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	164
PID 4168 wrote to memory of 1736	4168	cwupmhbusm.exe	166
PID 4248 wrote to memory of 4692	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	169
PID 4248 wrote to memory of 4452	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	173
PID 5048 wrote to memory of 3188	5048	pjecwuomhe.exe	175
PID 4248 wrote to memory of 4632	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	178
PID 4248 wrote to memory of 2732	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	182
PID 1988 wrote to memory of 816	1988	pjhbztrmje.exe	184
PID 4248 wrote to memory of 208	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	187
PID 4248 wrote to memory of 3832	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	191
PID 3996 wrote to memory of 4380	3996	jdbwtomgey.exe	193
PID 4248 wrote to memory of 1480	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	196
PID 4248 wrote to memory of 1576	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	200
PID 1188 wrote to memory of 1296	1188	aysqlidbvt.exe	202
PID 4248 wrote to memory of 2308	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	205
PID 4248 wrote to memory of 2348	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	209
PID 3828 wrote to memory of 2356	3828	vqkidavsnl.exe	211
PID 4248 wrote to memory of 1992	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	214
PID 4248 wrote to memory of 2628	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	218
PID 3372 wrote to memory of 3228	3372	ysnlfdxvqn.exe	220
PID 4248 wrote to memory of 3248	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	223
PID 4248 wrote to memory of 948	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	227
PID 8 wrote to memory of 228	8	snkfdxvpnh.exe	229
PID 4248 wrote to memory of 3924	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	232
PID 4248 wrote to memory of 1484	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	236
PID 2376 wrote to memory of 2728	2376	kecxupnhfz.exe	238
PID 4248 wrote to memory of 1032	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	241
PID 4248 wrote to memory of 416	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	245
PID 3712 wrote to memory of 4292	3712	bzurmkecwu.exe	247
PID 4248 wrote to memory of 4188	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	250
PID 4248 wrote to memory of 3504	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	255
PID 1524 wrote to memory of 2868	1524	cwuomhezwr.exe	257
PID 4248 wrote to memory of 3864	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	260
PID 4248 wrote to memory of 3400	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	264
PID 2596 wrote to memory of 1256	2596	trljdbwtom.exe	266
PID 4248 wrote to memory of 3732	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	269
PID 4248 wrote to memory of 1640	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	273
PID 512 wrote to memory of 2260	512	gbytrljdbv.exe	275
PID 4248 wrote to memory of 1464	4248	2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe	278

C:\Users\Admin\AppData\Local\Temp\2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_f7ccd17b73927fc65cc00e7a3cb428f8_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4640 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1880
- - C:\Temp\ezpjhbztrm.exe
    C:\Temp\ezpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4832
- - C:\Temp\i_ezpjhbztrm.exe
    C:\Temp\i_ezpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uojdbwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3144
- - C:\Temp\uojdbwuomg.exe
    C:\Temp\uojdbwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uojdbwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\i_uojdbwuomg.exe
    C:\Temp\i_uojdbwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4068
- - C:\Temp\jdbvtnlgdy.exe
    C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\i_jdbvtnlgdy.exe
    C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\ifaysqkida.exe
    C:\Temp\ifaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:556
- - C:\Temp\i_ifaysqkida.exe
    C:\Temp\i_ifaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\avsnkfdxvp.exe
    C:\Temp\avsnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2236
- - C:\Temp\i_avsnkfdxvp.exe
    C:\Temp\i_avsnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1516
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhbusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\cwupmhbusm.exe
    C:\Temp\cwupmhbusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhbusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\i_cwupmhbusm.exe
    C:\Temp\i_cwupmhbusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjecwuomhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Temp\pjecwuomhe.exe
    C:\Temp\pjecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjecwuomhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Temp\i_pjecwuomhe.exe
    C:\Temp\i_pjecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2732
- - C:\Temp\pjhbztrmje.exe
    C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:208
- - C:\Temp\i_pjhbztrmje.exe
    C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3832
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1480
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  PID:1576
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  PID:2308
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkidavsnl.exe ups_run
  2⤵
  PID:2348
- - C:\Temp\vqkidavsnl.exe
    C:\Temp\vqkidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkidavsnl.exe ups_ins
  2⤵
  PID:1992
- - C:\Temp\i_vqkidavsnl.exe
    C:\Temp\i_vqkidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysnlfdxvqn.exe ups_run
  2⤵
  PID:2628
- - C:\Temp\ysnlfdxvqn.exe
    C:\Temp\ysnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysnlfdxvqn.exe ups_ins
  2⤵
  PID:3248
- - C:\Temp\i_ysnlfdxvqn.exe
    C:\Temp\i_ysnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:948
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:3924
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run
  2⤵
  PID:1484
- - C:\Temp\kecxupnhfz.exe
    C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins
  2⤵
  PID:1032
- - C:\Temp\i_kecxupnhfz.exe
    C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmkecwu.exe ups_run
  2⤵
  PID:416
- - C:\Temp\bzurmkecwu.exe
    C:\Temp\bzurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmkecwu.exe ups_ins
  2⤵
  PID:4188
- - C:\Temp\i_bzurmkecwu.exe
    C:\Temp\i_bzurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezwr.exe ups_run
  2⤵
  PID:3504
- - C:\Temp\cwuomhezwr.exe
    C:\Temp\cwuomhezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezwr.exe ups_ins
  2⤵
  PID:3864
- - C:\Temp\i_cwuomhezwr.exe
    C:\Temp\i_cwuomhezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  PID:3400
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  PID:3732
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  PID:1640
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  PID:1464
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3060

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
- Executes dropped EXE
PID:2368

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:448

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:64

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:208

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:4432

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
- Executes dropped EXE
PID:3868

C:\Temp\rojgbztrlj.sys
C:\Temp\rojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:5004

C:\Temp\oidbvtnlgd.sys
C:\Temp\oidbvtnlgd.sys
1⤵
PID:3752

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
PID:4296

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
PID:1748

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
PID:176

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:1136

C:\Temp\mgezwrpjhb.sys
C:\Temp\mgezwrpjhb.sys
1⤵
PID:4264

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
PID:2368

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnkfdxvp.exe

Path C:\Temp\avsnkfdxvp.exe
Size 243KB
SHA256 55153398842dbdbfccbdb37e3e2f31423792a022b333c08b609fbd52ace2b1dd
MD5 9e1180599615db8a6b19cb5e2751c19e
SHA1 1d88970e427ba373a26f682b0490c8668bf6a2a4
SHA512 2e6d953ed9a795aa82fc098f43455c06723bfac15927bd994b2e32878e5c5fd8c9369986c15e94d9590f4fede52a5bed37c1722f25f02394bf05cb04929addd7
SSDEEP 3072:j2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:jwD99LB68zowa3lLNngoqRttA7/
TLSH
T1BA345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvq.sys

Path C:\Temp\avtnlfdxvq.sys
Size 141KB
SHA256 ecfc68938ee0c59e312da12a906c3b81af511213f8db89cca54e517719e6152a
MD5 bbf41706cc2e267e1ebc546f04bc0f20
SHA1 10ef2cdb5c073f4fc4cb631189e00810e1777d1e
SHA512 5319bc5273e611b862c79048021ce8e49eb468890f6a47b5d1ab646299513bd1c547cf682293084d3ab9b4e58ef120128c300d9bb8fb4533f3d9310f7627c119
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebwu.sys

Path C:\Temp\bztrmjebwu.sys
Size 141KB
SHA256 1e5e237355413721f4e3f3b623e93f411a5f711ca15b37b077e10dabe61e05e9
MD5 ee68c4e9a4ef64e5d1ba9a5a178b20ea
SHA1 71b73adffeb96cf5de1cf8d0d345c569ff76ab1f
SHA512 e4833273dcce479557154ddf345a3c028ee368ce8346db076fee4ac9ca3b45c06485501e8af29b65752030642030f9ae588830990d927635e323a0f609c23f80
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhbusm.exe

Path C:\Temp\cwupmhbusm.exe
Size 243KB
SHA256 bdac4d548836cf6176a102a802a0bd07022a2c5ca19af63cccedd36af899d921
MD5 977cfc44dcad4b31fde1c5baa10567d4
SHA1 bf92277ed1ee32a6701f6595c1c5f25a0410ef12
SHA512 d3ab75386893e97973f168efc985566152ff6b1977e06c6ec227875f6611c573951a8f881c077fd6ca54108e1f30813188ce0afae8a4bdbcdbab26aba702ac70
SSDEEP 3072:12z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:1wD99LB68zowa3lLNngoqRttA71
TLSH
T145345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyw.sys

Path C:\Temp\dbvtnlgdyw.sys
Size 141KB
SHA256 da4a73ff4eb960cdeb91883b6bf888b7926962b62386b6a91715584b3b871b36
MD5 07ffd48d8d9a00184f95a8be9d3d0120
SHA1 c8d3cd88d54ada1c5d6ab41c5b634dc4c7819a96
SHA512 fa680ed0df3809f922035df92235b0646aca42e0d07c97de0b29a6752568ea0ade270634c17d22682dfc7ea12b7cb4304dce45a4a3617344b1daa684388099bd
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezpjhbztrm.exe

Path C:\Temp\ezpjhbztrm.exe
Size 243KB
SHA256 7e82247897ebd05e891289c15b54ffeb266f393e197b1bae7f1881d694abdb92
MD5 1647c2e1fc479c5b1a994a4d97532509
SHA1 bfbb540a8ddd10053f376f72f4535030f26d54e3
SHA512 70fca926a146f8de4aef643c83bb879da920d02d4a0aff2ec8a9b889be01e4bcad98e1835f7ea69a0f1a290d2e41dec70fb5b4ec1c3f787f50babf108ff36a00
SSDEEP 3072:h2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:hwD99LB68zowa3lLNngoqRttA7d
TLSH
T12D345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnkfdxvp.exe

Path C:\Temp\i_avsnkfdxvp.exe
Size 243KB
SHA256 ab8b8101309813184317fee545631107c9fc6398824178a771113af6c30f418c
MD5 fa59939618eb28106ca5928e558e5e78
SHA1 c410828b7f17526df4c1816d4d974b7b1d17aacc
SHA512 f85aa68cd70b60cd293d038123322e65baf706366b3acb22f87c684ccfa35cdb5c40116cf04d1eedcb9926d11d368d6b6b0329108afea596123a9626e6283ec1
SSDEEP 3072:m2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:mwD99LB68zowa3lLNngoqRttA7y
TLSH
T1C6345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezpjhbztrm.exe

Path C:\Temp\i_ezpjhbztrm.exe
Size 243KB
SHA256 be0344fd95ef69b09d34a7cb95244beb4cd1c5f41abfbaa9329804f7a68e8ca2
MD5 440a40c94457671d2e9b1f09f95aa961
SHA1 06f2bd05bd7b8b28b085f6688fa124567c957885
SHA512 8d2d1be6bfe7b426b6abef2d60c8c0558cd386ce5c0688d7923fa2547c9c03ab47651e463d82ac83b2869b9ea4c94da700c722fd34f464c9781b8a4a02e2ab77
SSDEEP 3072:U2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:UwD99LB68zowa3lLNngoqRttA70
TLSH
T185345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkida.exe

Path C:\Temp\i_ifaysqkida.exe
Size 243KB
SHA256 519156d8c6ca446a1589a03945912402dba1f4a7d6fd923c83e36e52239ed494
MD5 a411139ab4fdaef35ff435c137a58112
SHA1 b59f2f20554fbb8b484c15e0b2593cc7533ba9d7
SHA512 7be674c9dadd85f9097bc5e32d7a1d9dd5bad543d6dcb718d17dd305330a1b8a47e61335754f8f8c431f6052148e0527186849f5a5217f6097be8973a6af4be3
SSDEEP 3072:O2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:OwD99LB68zowa3lLNngoqRttA7W
TLSH
T15C345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnlgdy.exe

Path C:\Temp\i_jdbvtnlgdy.exe
Size 243KB
SHA256 f8e2e5f43bb9a933b5c0684f4af15e4dc5f4069cc242afbd501a3f15157b5337
MD5 ce4208fe351a29c7329d88cefde519d2
SHA1 e21e315d17136be7d1ddb38d07aeaad65fbc813e
SHA512 b1152f8d5c5aa1a1cb981aa7f2238f3e9e4662d9a495a34e93d7a34f7c93825abfc3c0dc8e48fe7a16d4e042439b6bcfe5b340248753bccec0bfa52419abf19c
SSDEEP 3072:T2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:TwD99LB68zowa3lLNngoqRttA7r
TLSH
T15C345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausmkf.exe

Path C:\Temp\i_pkicausmkf.exe
Size 243KB
SHA256 f7d7e2e5fc310e32c700438f3e4a970f5e38d1952c83cee7557bf9e3f5305c23
MD5 23d0e81f084cfc5936159fce8cf1283b
SHA1 c4132d35567f19bc4b53ddd5b13266b0e8ff926c
SHA512 55993632641388a795dab612abf644ed6fb4790d7eab01c5e41ac6bd52bf9b1793fcc0966242dc70499a5723381248656054f47311baa42ce142b94f569f0a01
SSDEEP 3072:T2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:TwD99LB68zowa3lLNngoqRttA7v
TLSH
T17E345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidbvtnl.exe

Path C:\Temp\i_sqlidbvtnl.exe
Size 243KB
SHA256 1fa70f230b786309943387ba2f127574dbee39ea2db379739650295cbdc0e31e
MD5 745dd6ae6f8416e905d3a832d88c3374
SHA1 2f96417eddb8faefa3a6db2e4f6b81b243d43786
SHA512 8f3b8410944ab535c3cdb5b29142cfd6838fda9a6964747dbc3e02e00d3c83db2baec36548104e5efc892f2ce3463498db05d3fe8d1d3f781a04b82eed5ecc01
SSDEEP 3072:K2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:KwD99LB68zowa3lLNngoqRttA7y
TLSH
T1B6345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uojdbwuomg.exe

Path C:\Temp\i_uojdbwuomg.exe
Size 243KB
SHA256 ee97267271ad685b798c9cfd778ff17622b4e7e11fdf375d6037e9baaa747dfd
MD5 54b38c5a89b73f087ae9624345694b32
SHA1 1e691e69f74d0821fad60e877437900996d3d49b
SHA512 ac652573782963c9c2dcc17de5631667d4714fc7f12ec21ec6b23be86b9b0369b02f4cdce589bd66ce2aeae8edcb3456b53b3038b49a46d1a63d96573ce85915
SSDEEP 3072:l2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:lwD99LB68zowa3lLNngoqRttA7V
TLSH
T1B0345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.sys

Path C:\Temp\ifaysqkica.sys
Size 141KB
SHA256 be04e01896532510af39043f7662f3763e9d73c407f9a04c98ae74e95532c931
MD5 2e3c7d72c064719d4108bcfeae5db3ec
SHA1 979c1a924f4b016987624e39b5d3ca4e77fb1c23
SHA512 088f556a48eea7c17aed3124117ad6b9c63589cf5f8243a2d406e1c029250a52cef00287d800354cef78db919d35dc9b8e2021e199e545c3f6086ec5326dbf08
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T133E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkida.exe

Path C:\Temp\ifaysqkida.exe
Size 243KB
SHA256 c510a310a13fda04f492f0197b19828a58fd87390b49d0cfc909869dfe2d5ad7
MD5 61796ce75e92e72fb6dfe652c75d0ed2
SHA1 47b1d59eeb511055b9a7c946c223c15ddacd3849
SHA512 f5add8d71e80bad452c5ba9a074c28c49c861759cd2564dc80be4f135306b080a6c309c8220f78d9644a28c51d14b48107a9f76f9ae040fb9b14433f7149b589
SSDEEP 3072:22z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:2wD99LB68zowa3lLNngoqRttA7C
TLSH
T1B8345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.exe

Path C:\Temp\jdbvtnlgdy.exe
Size 243KB
SHA256 33fac25bc7e02bbeb7623c50528d42140bb4f2e7fb832627df4059bf35ead5e8
MD5 ec66b69ce50f6bea1991349fa6d33687
SHA1 728b5af7984c7b8e9379cbef35e9cb5479eb0b73
SHA512 675b785c3834726b24de0dbee8eba19820c1f99927125f0338bf2f598ae0a2b538a9e1f6c4fdc5b11acda4984c43a82af219ea3771b151593a7b4ae643a3cea3
SSDEEP 3072:l2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:lwD99LB68zowa3lLNngoqRttA7x
TLSH
T1C5345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmkec.sys

Path C:\Temp\khczusmkec.sys
Size 141KB
SHA256 dea356f4d9efd1e5ec1521ca73ed882b9d6f60d6e995c0aebedd4be6334cca0f
MD5 0380ff4a38e149d94bb1716b269ab1be
SHA1 730b788244b3127e699fcdd6139c099dab70353f
SHA512 33f548c72296aa1a08d0951480392c1ac1d9aa7828989acd6670f22d19f4a6db6f60702dcb263e7c59ad2c320ab9a12fd474871bd431b63ee04cff1e40e92fc1
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkf.exe

Path C:\Temp\pkicausmkf.exe
Size 243KB
SHA256 747bac022f5bd98e4bab08f226099088c6ec0aab54a60f448129dccdf564c5e3
MD5 82503430d8ea29cca4db29f8b36f3179
SHA1 ca35b48aaf6074ef67facaee5dfbacea1d7bd485
SHA512 6e65833e265f1e14a445544ba6a6121f7bedc2bc5c23f31ca3631bd26a8464f01654cd26d2a04358c4aa37511859c6ad9af97b731c87baf5d587d3e8d80cdfe1
SSDEEP 3072:92z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:9wD99LB68zowa3lLNngoqRttA7F
TLSH
T162345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytrlj.sys

Path C:\Temp\qoigbytrlj.sys
Size 141KB
SHA256 681f8627507114b2baaad4c67d20c37737fa403423e438c969d1f6c2f3a40723
MD5 b4683ad7e656ffe671d00c525983a649
SHA1 a9e1ac5007f188f187e145b8fa1a7d999457f659
SHA512 4a009b0cebc4c9f4e95e86a6facf401c5fc6daa8fd6a2e88c56fdab9fddb16522a1906d54946e9ea5e45dbf58aeb73bf33c8332d9d3b3e1673256a5e6a46fd38
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtnl.exe

Path C:\Temp\sqlidbvtnl.exe
Size 243KB
SHA256 6ac33ca3065cfba0c5a7ac9ee290c7fb96cd83604b4a54b58a0a205bc23746fb
MD5 866ef424c84b65d57b95a6c5c173a56a
SHA1 56e4677eaa556ca710fdb3007d02369f44a148bf
SHA512 8235ebf2eeeaa44c43dccdfb59657be1eb41827f69c384320e76c4d877d7875552eb95bde4e10eea2054099b4d819895bb933c3524150acba877e9ef89bde6b1
SSDEEP 3072:qt2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74f:8wD99LB68zowa3lLNngoqRttA7Q
TLSH
T146345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uojdbwuomg.exe

Path C:\Temp\uojdbwuomg.exe
Size 243KB
SHA256 2f74c69732fe6e7ffac7bf495c317d1e935126f8b9f9b5059c4be74cc3769bff
MD5 cc7e4af496ee0284ef82c0586de1314b
SHA1 e7cac9a1eaf4e774c7d1c3a41e26a8c7065ecba5
SHA512 464ec2ff128f1754c918cc03e56d6ea69e2fb6d8decc18f82101336191d6f0d1e24c8aaaed87ff03067056b52cb7e95eee09dc66ba95beb0bce62d3be323b29e
SSDEEP 3072:s2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:swD99LB68zowa3lLNngoqRttA7s
TLSH
T1FA345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsp.sys

Path C:\Temp\xvpnhfaxsp.sys
Size 141KB
SHA256 577d4017a0c71cd808e7f27c84b037f4adebe266c59a13df5c1d9f5b1635cbc3
MD5 a18f85a438704c14e90ebee9f0f08197
SHA1 40981b686cb8fe0d81fd11091a67765abbb85890
SHA512 13638fc7194856d85b3f770901abfd5adf0d9f8ec8c37faf0423db92494d266c8f6d1bbf7d904c3d51ce3201c69b03d72195a76664a30d1606ebb160b72b632f
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 055ffd93c2d3fd466d1f3aa1ee9108002901e49cbe657717b90931ae6a2e1d43
MD5 fbed877bd90147bbd0cdd6f5678f1f2a
SHA1 bbda3aeb14036ba873041bc1be7fd9ede0c662e6
SHA512 47fb87e06532096f73bb68ab1d6d59528d00a837684c7b2f39970ed59ae6805ad7111a05736b006e91eb071ec5f8061e2077a95e31217cb179d4b7439c8098fa
TLSH
T1BEF0D4C2E13DF5B21A6385DC125C45A53031643F1554455B903842F409573BDB716135
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 317b1b2b6d5505106f05692f569b1197465b376b9059b901cc38811a5e505560
MD5 14f53267732dd543ff351147b7157c15
SHA1 a06da984fa731f6c4fe7cb544a2383360eabc81f
SHA512 ecf30a45938af61d71fff30fe3f7a5aee81121e106bd5befdfde88493bc61dfcfd5c3f5f40e778d8a3b71145171e2a05abbfdd7343ee4c679ca3a49f1df2e3eb
TLSH
T1D1E0C03411FA856EE5F9E0754BD5B42194FFF227082DA3B42FC48B04A702600DE03A39
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/176-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/208-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/448-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1036-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1136-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1212-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1260-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-72-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-85-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1748-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3752-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4264-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4296-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-97-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads