382f13d8f5651d4931060a55b0febc7edb74475d0ae41abedf3a3e64b6ac69f8

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe
Size 243KB
Sample260930-nzesysvfle
SHA256 382f13d8f5651d4931060a55b0febc7edb74475d0ae41abedf3a3e64b6ac69f8
MD5 469b4198e05e37ed2833934dab13d1ec
SHA1 62a50ee7ca0d6df1c1ee4e7b75cf035be62b9188
SHA512 e105f0e35358eb9515498ebf90356239319d6dc76d5aaa715f222a2b354e2eeee0316d6dfc68645b44e59077f0139fa9dbc75ad436c230f11147e82c248768fe
SSDEEP 3072:VVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:nXP7LQMa3lLNngoqRttA7c
TLSH
T172345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1096	CP.exe
4480	sqlidbvtni.exe
1092	CP.exe
1728	CP.exe
2552	i_sqlidbvtni.exe
180	sqkiysqkid.sys
2628	CP.exe
2332	dxvpnidavs.exe
3956	CP.exe
1804	CP.exe
3836	i_dxvpnidavs.exe
4736	xsqkausmkf.sys
4696	CP.exe
3608	fcxvpnhfzx.exe
2364	CP.exe
2844	CP.exe
4864	i_fcxvpnhfzx.exe
3036	nhfzxspkhc.sys
5044	CP.exe
5736	camkecxupn.exe
1820	CP.exe
2788	CP.exe
3124	i_camkecxupn.exe
4164	bzurmkecwu.sys
6116	CP.exe
1088	usmkecwupm.exe
4500	CP.exe
4496	CP.exe
4396	i_usmkecwupm.exe
5280	mjebwuomge.sys
4896	CP.exe
6024	ezwrpjeywr.exe
5616	CP.exe
2460	CP.exe
5824	i_ezwrpjeywr.exe
5432	jhtrljdbwt.sys
1660	CP.exe
5132	tomgeywroj.exe
5284	CP.exe
5664	CP.exe
4028	i_tomgeywroj.exe
3144	wtomgeywqo.sys
620	CP.exe
6088	gbytqljayt.exe
2168	CP.exe
5152	CP.exe
5580	i_gbytqljayt.exe
5608	lfdyvqoiga.sys
3272	CP.exe
5088	dywqoigayt.exe
4676	CP.exe
4476	CP.exe
2420	i_dywqoigayt.exe
3360	dxvpnifays.sys
1364	CP.exe
5268	vqnigaysqk.exe
3280	CP.exe
2440	CP.exe
4688	i_vqnigaysqk.exe
4308	fdxnifaysq.sys
5692	CP.exe
5876	qkicxvpnhf.exe
2940	CP.exe
1044	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	camkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiusnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kiusnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrlbvtljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrlbvtljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_camkecxupn.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3468	ipconfig.exe
2304	ipconfig.exe
392	ipconfig.exe
4212	ipconfig.exe
5916	ipconfig.exe
3216	ipconfig.exe
4160	ipconfig.exe
1492	ipconfig.exe
4552	ipconfig.exe
3776	ipconfig.exe
5564	ipconfig.exe
4532	ipconfig.exe
4808	ipconfig.exe
1176	ipconfig.exe
4224	ipconfig.exe
4332	ipconfig.exe
4900	ipconfig.exe
4368	ipconfig.exe
832	ipconfig.exe
1528	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281361"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3755719291"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000079a1237bf364a541a8dd2b960cc9368066a611b73aed380fa208a9116f5e0f41000000000e8000000002000020000000de8dbc43a74369ba6e5b6c42b7c6ad88a6d2f298790247504701e0166ff7e7ef20000000a80c406324ca0430d3c49466fea3da21e04a26f8eaef33f35311f56c0abaf80b400000009ba248562f1e6072289502a9f9afa879de663d7f9cd9744330f4dcf5ffa05b2c78b4c5a9630518d885d69af1a38c45397c1abd760dc4c52a078ce8135b585325	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281361"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000055f43a287de1d991c7035abc1380a9270c15bb792d4424822882c872474ede77000000000e8000000002000020000000ea436b256a79125c8b76c10008ef7b7cc4e01bfa7c4dfe3a755a3f1ff11931d7200000003cb3101cf007a28ba539d0e793cf6ffdff4dff1d04f737ed7c69e3d257749dce40000000b6a8701d74ce14452f5d727eb833190d6dc65aaadac378878c7fe2f7799e77140fdb624809ae7b3f278521ab59ce0c59c56c7c3345c3a0aa49d3ae7173253055	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c72042da50dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3752594330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0AFB50B1-BCC5-11F1-8FDF-66DCEFAAD7CC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0511742da50dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497533966"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	i_sqlidbvtni.exe
Token: SeDebugPrivilege	3836	i_dxvpnidavs.exe
Token: SeDebugPrivilege	4864	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	3124	i_camkecxupn.exe
Token: SeDebugPrivilege	4396	i_usmkecwupm.exe
Token: SeDebugPrivilege	5824	i_ezwrpjeywr.exe
Token: SeDebugPrivilege	4028	i_tomgeywroj.exe
Token: SeDebugPrivilege	5580	i_gbytqljayt.exe
Token: SeDebugPrivilege	2420	i_dywqoigayt.exe
Token: SeDebugPrivilege	4688	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1648	i_qkicxvpnhf.exe
Token: SeDebugPrivilege	3720	i_pfzxrpkhcz.exe
Token: SeDebugPrivilege	5420	i_hezxrpjhcz.exe
Token: SeDebugPrivilege	4368	i_cwrpjhbzur.exe
Token: SeDebugPrivilege	4608	i_wrojhbztrl.exe
Token: SeDebugPrivilege	1800	i_wrlbvtljdb.exe
Token: SeDebugPrivilege	1836	i_oigbytrljd.exe
Token: SeDebugPrivilege	848	i_gaysqlidbv.exe
Token: SeDebugPrivilege	880	i_snlfaxsqki.exe
Token: SeDebugPrivilege	4844	i_kiusnkfcxv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5356	iexplore.exe
5356	iexplore.exe
3848	IEXPLORE.EXE
3848	IEXPLORE.EXE
3848	IEXPLORE.EXE
3848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5356	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	87
PID 5356 wrote to memory of 3848	5356	iexplore.exe	88
PID 5040 wrote to memory of 1096	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	91
PID 4480 wrote to memory of 1092	4480	sqlidbvtni.exe	94
PID 5040 wrote to memory of 1728	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	102
PID 5040 wrote to memory of 2628	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	114
PID 2332 wrote to memory of 3956	2332	dxvpnidavs.exe	116
PID 5040 wrote to memory of 1804	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	119
PID 5040 wrote to memory of 4696	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	123
PID 3608 wrote to memory of 2364	3608	fcxvpnhfzx.exe	125
PID 5040 wrote to memory of 2844	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	128
PID 5040 wrote to memory of 5044	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	132
PID 5736 wrote to memory of 1820	5736	camkecxupn.exe	134
PID 5040 wrote to memory of 2788	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	137
PID 5040 wrote to memory of 6116	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	144
PID 1088 wrote to memory of 4500	1088	usmkecwupm.exe	146
PID 5040 wrote to memory of 4496	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	149
PID 5040 wrote to memory of 4896	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	154
PID 6024 wrote to memory of 5616	6024	ezwrpjeywr.exe	156
PID 5040 wrote to memory of 2460	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	159
PID 5040 wrote to memory of 1660	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	163
PID 5132 wrote to memory of 5284	5132	tomgeywroj.exe	165
PID 5040 wrote to memory of 5664	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	168
PID 5040 wrote to memory of 620	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	172
PID 6088 wrote to memory of 2168	6088	gbytqljayt.exe	174
PID 5040 wrote to memory of 5152	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	177
PID 5040 wrote to memory of 3272	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	181
PID 5088 wrote to memory of 4676	5088	dywqoigayt.exe	183
PID 5040 wrote to memory of 4476	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	186
PID 5040 wrote to memory of 1364	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	190
PID 5268 wrote to memory of 3280	5268	vqnigaysqk.exe	192
PID 5040 wrote to memory of 2440	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	195
PID 5040 wrote to memory of 5692	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	201
PID 5876 wrote to memory of 2940	5876	qkicxvpnhf.exe	203
PID 5040 wrote to memory of 1044	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	206
PID 5040 wrote to memory of 1136	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	210
PID 4184 wrote to memory of 2780	4184	pfzxrpkhcz.exe	212
PID 5040 wrote to memory of 5780	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	215
PID 5040 wrote to memory of 1604	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	219
PID 2336 wrote to memory of 4640	2336	hezxrpjhcz.exe	221
PID 5040 wrote to memory of 4788	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	224
PID 5040 wrote to memory of 5992	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	228
PID 1476 wrote to memory of 5816	1476	cwrpjhbzur.exe	230
PID 5040 wrote to memory of 4112	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	233
PID 5040 wrote to memory of 4060	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	237
PID 400 wrote to memory of 2872	400	wrojhbztrl.exe	239
PID 5040 wrote to memory of 5608	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	243
PID 5040 wrote to memory of 5760	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	247
PID 4720 wrote to memory of 1468	4720	wrlbvtljdb.exe	249
PID 5040 wrote to memory of 4912	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	252
PID 5040 wrote to memory of 2936	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	256
PID 5792 wrote to memory of 1664	5792	oigbytrljd.exe	258
PID 5040 wrote to memory of 4548	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	261
PID 5040 wrote to memory of 5768	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	265
PID 6136 wrote to memory of 3872	6136	gaysqlidbv.exe	267
PID 5040 wrote to memory of 3992	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	270
PID 5040 wrote to memory of 1400	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	274
PID 4396 wrote to memory of 1648	4396	snlfaxsqki.exe	276
PID 5040 wrote to memory of 4636	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	279
PID 5040 wrote to memory of 5756	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	283
PID 4672 wrote to memory of 5980	4672	kiusnkfcxv.exe	285
PID 5040 wrote to memory of 5432	5040	2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe	288

C:\Users\Admin\AppData\Local\Temp\2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_469b4198e05e37ed2833934dab13d1ec_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5356 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtni.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1096
- - C:\Temp\sqlidbvtni.exe
    C:\Temp\sqlidbvtni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1728
- - C:\Temp\i_sqlidbvtni.exe
    C:\Temp\i_sqlidbvtni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnidavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\dxvpnidavs.exe
    C:\Temp\dxvpnidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnidavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\i_dxvpnidavs.exe
    C:\Temp\i_dxvpnidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2844
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\camkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\camkecxupn.exe
    C:\Temp\camkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_camkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2788
- - C:\Temp\i_camkecxupn.exe
    C:\Temp\i_camkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6116
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjeywr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4896
- - C:\Temp\ezwrpjeywr.exe
    C:\Temp\ezwrpjeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjeywr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\i_ezwrpjeywr.exe
    C:\Temp\i_ezwrpjeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\tomgeywroj.exe
    C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5664
- - C:\Temp\i_tomgeywroj.exe
    C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqljayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:620
- - C:\Temp\gbytqljayt.exe
    C:\Temp\gbytqljayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqljayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5152
- - C:\Temp\i_gbytqljayt.exe
    C:\Temp\i_gbytqljayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3272
- - C:\Temp\dywqoigayt.exe
    C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4476
- - C:\Temp\i_dywqoigayt.exe
    C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5692
- - C:\Temp\qkicxvpnhf.exe
    C:\Temp\qkicxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1044
- - C:\Temp\i_qkicxvpnhf.exe
    C:\Temp\i_qkicxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pfzxrpkhcz.exe ups_run
  2⤵
  PID:1136
- - C:\Temp\pfzxrpkhcz.exe
    C:\Temp\pfzxrpkhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pfzxrpkhcz.exe ups_ins
  2⤵
  PID:5780
- - C:\Temp\i_pfzxrpkhcz.exe
    C:\Temp\i_pfzxrpkhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhcz.exe ups_run
  2⤵
  PID:1604
- - C:\Temp\hezxrpjhcz.exe
    C:\Temp\hezxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhcz.exe ups_ins
  2⤵
  PID:4788
- - C:\Temp\i_hezxrpjhcz.exe
    C:\Temp\i_hezxrpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwrpjhbzur.exe ups_run
  2⤵
  PID:5992
- - C:\Temp\cwrpjhbzur.exe
    C:\Temp\cwrpjhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwrpjhbzur.exe ups_ins
  2⤵
  PID:4112
- - C:\Temp\i_cwrpjhbzur.exe
    C:\Temp\i_cwrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  PID:4060
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  PID:5608
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrlbvtljdb.exe ups_run
  2⤵
  PID:5760
- - C:\Temp\wrlbvtljdb.exe
    C:\Temp\wrlbvtljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrlbvtljdb.exe ups_ins
  2⤵
  PID:4912
- - C:\Temp\i_wrlbvtljdb.exe
    C:\Temp\i_wrlbvtljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  PID:2936
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  PID:4548
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  PID:5768
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  PID:3992
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfaxsqki.exe ups_run
  2⤵
  PID:1400
- - C:\Temp\snlfaxsqki.exe
    C:\Temp\snlfaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfaxsqki.exe ups_ins
  2⤵
  PID:4636
- - C:\Temp\i_snlfaxsqki.exe
    C:\Temp\i_snlfaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kiusnkfcxv.exe ups_run
  2⤵
  PID:5756
- - C:\Temp\kiusnkfcxv.exe
    C:\Temp\kiusnkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kiusnkfcxv.exe ups_ins
  2⤵
  PID:5432
- - C:\Temp\i_kiusnkfcxv.exe
    C:\Temp\i_kiusnkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4844

C:\Temp\sqkiysqkid.sys
C:\Temp\sqkiysqkid.sys
1⤵
- Executes dropped EXE
PID:180

C:\Temp\xsqkausmkf.sys
C:\Temp\xsqkausmkf.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\nhfzxspkhc.sys
C:\Temp\nhfzxspkhc.sys
1⤵
- Executes dropped EXE
PID:3036

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
- Executes dropped EXE
PID:5280

C:\Temp\jhtrljdbwt.sys
C:\Temp\jhtrljdbwt.sys
1⤵
- Executes dropped EXE
PID:5432

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:5608

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\fdxnifaysq.sys
C:\Temp\fdxnifaysq.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
PID:464

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
PID:5812

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
PID:3144

C:\Temp\mgezwjgbzt.sys
C:\Temp\mgezwjgbzt.sys
1⤵
PID:1288

C:\Temp\eywqojgbyt.sys
C:\Temp\eywqojgbyt.sys
1⤵
PID:4332

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
PID:3928

C:\Temp\nlfdyvqnig.sys
C:\Temp\nlfdyvqnig.sys
1⤵
PID:3300

C:\Temp\lfaysqcaus.sys
C:\Temp\lfaysqcaus.sys
1⤵
PID:5480

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkecwu.sys

Path C:\Temp\bzurmkecwu.sys
Size 141KB
SHA256 61a65f40a07c380989bcbbba283bf343711c4beeb3235637285f4fdd322ef478
MD5 d0177e14daed4f1e1533b12d4143ccfe
SHA1 692283a6af842c2b46fe382fbf6bd28fa8d76b11
SHA512 35bef85498500fe4ff9b528a0d7df3956030d09a561be8fbabae5d6936006a876f3d193033df97a81aa719d7a564d16a2ca3e5e004855a0c4117b1b259427f72
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camkecxupn.exe

Path C:\Temp\camkecxupn.exe
Size 243KB
SHA256 8be38df65d81d7eda40bac0df5875e5ffe1a4d074358f55777d9340f6c19b489
MD5 5a1674193a0e3e505a048aa4937cce6a
SHA1 d0c0f37b06e7fe17c1c1e62e374f97a428ba6c01
SHA512 c089cba336a045b0d440e8a8e9bdd95a0506555a8852ffb787add6832afe2480ea22005a220c9110758bbc97c54d4f6524b25954275e7939d296d888bcf1c09a
SSDEEP 3072:oVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:0XP7LQMa3lLNngoqRttA7h
TLSH
T12A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnidavs.exe

Path C:\Temp\dxvpnidavs.exe
Size 243KB
SHA256 ae4e593266357b3038dcd0972bc48dbcdd32165cf65857a079fae6d891db5ef8
MD5 5bd4b99d2062548500c35dce50de6fbf
SHA1 cf520bb445edc60527d520ea8c82c9c1bfb84e8e
SHA512 386346080740c3b306fd0179e7be892db1f16d946bffd42b5675c0d5a6a8c1f9ad29bc78e2d23f8589fc3625cfad326a99baf207c89560d2d4116f31f9763c1d
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:aXP7LQMa3lLNngoqRttA7L
TLSH
T111345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjeywr.exe

Path C:\Temp\ezwrpjeywr.exe
Size 243KB
SHA256 d704daefd18c8bdfb9e6bbcb2badbe6d52e0c4db4d32790d66792a8bd2a2b0ff
MD5 a8de616127ef8e7bb77c29e7487fa26f
SHA1 eabfa30532bae0a69e9a860c422754ab20db3cc5
SHA512 3a2bb6a14c88d82ed42ec752d0b6987a8a654578b07045034ff07527bb75a1157c175b8f9b7f0f1611d4ce7adf8f527561769cb605a98d822bdb9cde3d1ba03f
SSDEEP 3072:cVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:4XP7LQMa3lLNngoqRttA7R
TLSH
T175345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfzx.exe

Path C:\Temp\fcxvpnhfzx.exe
Size 243KB
SHA256 5cff774e9c71a9ae7b93b307c9155786223af9eea3420938bef239e561d0132a
MD5 f92003b75db388437a8d79d3a17b870a
SHA1 91995031d59f03418e92192e89b9eb3069626c8b
SHA512 11a6659c165f791c447e02742941657a68db605e90d9677a7f8f87e9b6c0533fba592ee3b27c697f4376fdad95ed901a4aa238e710b6bef9660c2dd4db40060a
SSDEEP 3072:eVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:OXP7LQMa3lLNngoqRttA7D
TLSH
T189345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqljayt.exe

Path C:\Temp\gbytqljayt.exe
Size 243KB
SHA256 f9006d52cf50db5e81e0ed5bd5d4c285ffd6ab00b1d632f02b9b3237e879ff66
MD5 6899fcd9488d79b71f1d08a11f7979b3
SHA1 502e2b1d4d4650033b4e09a008f4ac0b3068ad26
SHA512 634206c28d435f5d2521b5dab11cc42f76228616dbcf8acb8b7fca86ba3da0a3c9426f58e4d51aa27410fd2c27ae3e65d23c1f3438ad39102bf9b5e24a506fdd
SSDEEP 3072:IVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:UXP7LQMa3lLNngoqRttA7B
TLSH
T152345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_camkecxupn.exe

Path C:\Temp\i_camkecxupn.exe
Size 243KB
SHA256 fef709a4739bfdffdbc87abfaac30318d9d14dd9997f2db74105b4d3744721ea
MD5 be8337838c81fd627e717d5059fa13b6
SHA1 6e79c9a47ba6d34958deaa29f27adee3e9debbdc
SHA512 d92c71494c0363a7adcad09a4e17db5a34c7d82731cccef130641617395a231bae8e2e7f3372c07a2eabc9433926c464eb75f8d52b3136fd2e3f41680720586c
SSDEEP 3072:0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:wXP7LQMa3lLNngoqRttA79
TLSH
T16D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnidavs.exe

Path C:\Temp\i_dxvpnidavs.exe
Size 243KB
SHA256 c27d4c2f7546afcb4600d42d757d279dd46d6f0a6e3110cc20251343f66f9dba
MD5 9ec312ddf7f10e737094ac6bc30ff54f
SHA1 508a28e75e2bcc9f722bfa416616b7c54ae74fb6
SHA512 611df2b3babe5a89b276b57ec149465c95edcabbf69402f27aacc33e013f4efe3c724c60d056e054fe95eef7e079d96976ad7f4ebbcff779d298b4fd9b3de40a
SSDEEP 3072:JVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:bXP7LQMa3lLNngoqRttA7g
TLSH
T10F345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjeywr.exe

Path C:\Temp\i_ezwrpjeywr.exe
Size 243KB
SHA256 1ff0d09149de0249c63e7501f6996f09bbd60df6c01da53cbd342e7056f547ce
MD5 2c7054650d458e7770532d8a1d773b71
SHA1 3187ee2370d9c419badb5e9f517842aded0c9049
SHA512 3ec29c0c905c3144263775000e2d9525491db8f8d76ed7e35e7ae2dbd133be7a247d0065be1f2bcb9d8d3cfcce70cfd52406d7a28f4d0244576cf28812eda200
SSDEEP 3072:SVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:SXP7LQMa3lLNngoqRttA7/
TLSH
T1B8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfzx.exe

Path C:\Temp\i_fcxvpnhfzx.exe
Size 243KB
SHA256 0f42a96014f2ca11f8ed6427707174d7d1ac8044c97e9a37c7cdd39577e56005
MD5 25e79e7f5d72df104287e43550ed297d
SHA1 d3fcf256fdf9c10222f672a8128446fa119cc53d
SHA512 a3a142c695a3bc5e674b0cb79c839a89233477ac993548f0cab84ed71feb5dfdd08f159a3aad73c4fbb175fae0adf477f110a6df6261131f4adda0204c3a358d
SSDEEP 3072:+VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:uXP7LQMa3lLNngoqRttA7X
TLSH
T1C1345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidbvtni.exe

Path C:\Temp\i_sqlidbvtni.exe
Size 243KB
SHA256 5b32226ceb24604daa022e2749bf8c8bfac429de2ea1105dd2fa41b576280f24
MD5 8716e2ceac8d749babb84674f24c7472
SHA1 70aeab1520d4e7ca26a6d9a4b447d7a24f76a320
SHA512 0373c10e05434df9286241872ee2e0a5bf7b05436db6b2d869d13494aa981f6b682a3e8a0abe31946cf36218004ae0220265f3ac2ce7c703e7e8c78300158055
SSDEEP 3072:E0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a3:XXP7LQMa3lLNngoqRttA7Q
TLSH
T104345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywroj.exe

Path C:\Temp\i_tomgeywroj.exe
Size 243KB
SHA256 355d388cc08f71aebc3dc7fdbabb0e834839eaa9c2f0f6b5797f749b2be67fc6
MD5 2455e8791b22b36e88b42409f46c5176
SHA1 3a4aad0dd7174092dd8fe5b48949298e682dc16c
SHA512 16f88b5148e49d30b85acc2c47d9df563897d12317bcfe8664fdc3103dea2af3c98b7171d3cab5234ce8afc9f401bdc36394dca0a2ff9d5b780c7f8780e82568
SSDEEP 3072:3VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:lXP7LQMa3lLNngoqRttA72
TLSH
T121345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupm.exe

Path C:\Temp\i_usmkecwupm.exe
Size 243KB
SHA256 2ea1c5c5c9f45bc8de3fa184514b0d44e06e88f835ad5ec71916817974ac8069
MD5 4a086bec467e85662ace31406a362e73
SHA1 147795d012499587898be95831901a55fc9650a2
SHA512 b3ab2fde24c0ed4f2faa9b04d5ada37a76489bbf8f6c6d84a0a256e3130f5bbc5fdcccc90618f1b01d17dbe89499ecaacc58a24046778cd91277253d2377a442
SSDEEP 3072:iVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:iXP7LQMa3lLNngoqRttA77
TLSH
T16D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhtrljdbwt.sys

Path C:\Temp\jhtrljdbwt.sys
Size 141KB
SHA256 c80955965f8715eee9c1af65e42a743bffaefff44dfbaad52e1156fc544f5ea1
MD5 1c6004ecc4a5302e8d3dcbd57b4e8671
SHA1 ca78e728665e03ad3b2c5a83b85d707ca37dd055
SHA512 cd7ddff2c34fca2a32f13deb6437bcc6f52f5174c02426dafbb027e054164ddda1239fa006bd2303aad52babb10f06bdf46631f7bbf447ce3eb6fb9aca79aef8
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomge.sys

Path C:\Temp\mjebwuomge.sys
Size 141KB
SHA256 3263b05d279b3af266352042e301da084997f5ed8ab26b5dec6d394c4dcecee9
MD5 37561ba221f3698a1b7c96b76ca22081
SHA1 c1b14b0ce5a652edde47f45b5ace83c38350ce80
SHA512 5bf34996831b0b72b32c1d4cba7919fc2d084cce4df9e4d83fb411c62f8665d9fa5c20ed0ea0aff1d5dcd3407af2c6963c51c46c3e6a2aa96f88f78e334c9a94
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkhc.sys

Path C:\Temp\nhfzxspkhc.sys
Size 141KB
SHA256 a046572755b6d2b1e3791413ba5ccede08401f8e016848fc092a09fcfaa417ac
MD5 39b28f7ce9a4e784f98b945c2821813b
SHA1 38386c39653656dbc71133b887b8808ecc3d9cc9
SHA512 051fa075f3b8dc981908c5de35a0c91bf9dcbed30c6ebc5610ff8b14819923fc2a56fae4b46be83f11adebced3d3018489ece1d7e9926409c5ae60c42a874721
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkiysqkid.sys

Path C:\Temp\sqkiysqkid.sys
Size 141KB
SHA256 b11cc961cdcf4042fb57c06d7e1e44a0fbb9ccf04d1cfc27a43dc7e62da4c07d
MD5 851a10a06837f7cf4ce21b4ac562e35a
SHA1 25ab69a59ad282693d8debfd72d16470ce47af98
SHA512 2cee6902826b701f4443277a4554014c88509e23911a9846166b262175152a5303c0a525b7feb959f6bb388477641927dff6bf398a11a5071a03cc3c89818835
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtni.exe

Path C:\Temp\sqlidbvtni.exe
Size 243KB
SHA256 653d452899c5ffe8ed60946b391545ef533a6e497fe39b1581618fb1158ee30b
MD5 04ff8e7bfcced8080efd80e035e46319
SHA1 c091fa34164eac7ed783707324ab27052d3b931b
SHA512 7234b0153122cdcf5a93509f0344708ea9ec39e98afda2e45e1009dd94a074823c74fe2003a8ff87c9dd564a83d8161cff6146995403d286a47e97ab8040920e
SSDEEP 3072:WVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:GXP7LQMa3lLNngoqRttA7T
TLSH
T117345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.exe

Path C:\Temp\tomgeywroj.exe
Size 243KB
SHA256 8995faa3b6c0851f50008f5df6dd40c3b75a3a10eaad5d9128c77cd14acc76ae
MD5 72b0c7133339e1f90a3249fb25c220da
SHA1 68b3062663c7d8f812dfb8bde88ca854934cce26
SHA512 57eb4b146556a1bd20e114040d750cf2b87932db59e39078ce6edb21294e7f85aefad079d5bbd78575625053dd69170518c2fe3277f72e557d4128cb5151f555
SSDEEP 3072:RVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:DXP7LQMa3lLNngoqRttA7c
TLSH
T1E4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.exe

Path C:\Temp\usmkecwupm.exe
Size 243KB
SHA256 da77b0b91e130772d142054cbba7d63504e569acd5b4a783da0ceac080a50b11
MD5 424662248ed3dd2f35dfb41ba9619d55
SHA1 d315375e1d7103106721d29455179c4d58f13a6b
SHA512 6f7896129b96276d964cce2fc65ebe515e0d0fde4238e2b1c170230947c20f345f3fb15256cd896637ffe9fc69bd95897061dfc092359cf23cbb087563dcb1d3
SSDEEP 3072:XVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:FXP7LQMa3lLNngoqRttA7S
TLSH
T136345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywqo.sys

Path C:\Temp\wtomgeywqo.sys
Size 141KB
SHA256 4741d4e0424d1fc79cbb54ba999848456f420dea21ba516adadbccba534a4d86
MD5 1e0343c854c58c0515d45e05f3264d70
SHA1 c917096d8d62c43c345c20a9fdc1201d2d46f04b
SHA512 c9e8f7206d6ec9872e8640cdbfc5d8ce942c25dc20834dbacb4a19324a9cb8ada23d9c1ae83ce08db3285b06d82511c1f5b2bb73967db94ac0d6ca6bbd8fbb93
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T127E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkausmkf.sys

Path C:\Temp\xsqkausmkf.sys
Size 141KB
SHA256 dec553cf5b45ccdaa68582a0324e4d0e4c87660ed5312156cb31bc5e8e17b0d1
MD5 1f0a76efc63edf42d54135e93e034e4e
SHA1 7d99b44f96f844666d8a38359f7ffe5a740d0298
SHA512 abc5cf97832b7fb934b0265aeaa182dd08de970436fa3c41a096915a6f6510a25831d170506cba4615727b6296d8e04a863173b0b7c7449a9ba912b130db2cbb
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
MD5 c594b726a66926272d1a36f611dbee07
SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
TLSH
T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 6878e11bf9b30ca9e7ff6de18e7f06e6334c7bf6c4c267f720521114557beff8
MD5 e5c647974f66898a4c91dcac7c6c1ffe
SHA1 31bf7367f82f4cdb6696c2c66d8258fb6d20ac66
SHA512 eba70c019792e83f9a90e99809be2190d65513f6a0d7fb61ae64c6542742079da8a27f44c42b166842d2f2850a1807e35c53448f2aea11a1449d71d7e7867106
TLSH
T1F4E0C03821F6411FF1F8D8744BD5742295ADF122241C93F42EE45B04B306540AC12A35
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8OSE262\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/180-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/464-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1288-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3928-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5280-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5432-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5480-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5608-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5988-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads