db2392f78abb31166089b4dcc0374911f7e8b60ae59e452d6e8817e8a637770b

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-tpjxtaxblc
SHA256 db2392f78abb31166089b4dcc0374911f7e8b60ae59e452d6e8817e8a637770b
MD5 3d7e2ea631a3c9e6003d7b8f576c9431
SHA1 7ff61e1546a093871f4847d7dd52c8d4b6f1eb2b
SHA512 162528a3db9b8af7c78f00776309fa479449e29d5b326f673ff85c3652b840f5ebbd13d89917082e77f1f37c13c4b70a0c2220cf0730d3de52e6ee768f690196
SSDEEP 3072:RBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:Tb3TfLAUa3lLNngoqRttA75
TLSH
T1DE34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
344	CP.exe
3356	ysqlidbvtn.exe
1040	CP.exe
440	CP.exe
2888	i_ysqlidbvtn.exe
3164	kfdxvpnifa.sys
4640	CP.exe
4672	xvpnhfaxsq.exe
676	CP.exe
1864	CP.exe
2168	i_xvpnhfaxsq.exe
1072	nhfaxsqkic.sys
4480	CP.exe
4204	cxvpnhcxvp.exe
2152	CP.exe
5064	CP.exe
3068	i_cxvpnhcxvp.exe
1776	cxupnhfzxr.sys
5072	CP.exe
4736	nhczusmkec.exe
1936	CP.exe
212	CP.exe
2860	i_nhczusmkec.exe
4304	mhezxrpjhb.sys
3080	CP.exe
400	fzurmkecwu.exe
4020	CP.exe
2004	CP.exe
4932	i_fzurmkecwu.exe
3744	ywrpjhbzur.sys
3716	CP.exe
4332	omgeywrojh.exe
364	CP.exe
4368	CP.exe
1728	i_omgeywrojh.exe
5004	gbztrljebw.sys
3328	CP.exe
1072	wtomgeywqo.exe
3396	CP.exe
4776	CP.exe
220	i_wtomgeywqo.exe
4448	ztrljdbwlg.sys
1588	CP.exe
3744	gdywqoigay.exe
4444	CP.exe
1892	CP.exe
1976	i_gdywqoigay.exe
4620	oigaysqlid.sys
3372	CP.exe
2556	davtnlxvqn.exe
3856	CP.exe
1584	CP.exe
2068	i_davtnlxvqn.exe
4304	cavsnlfdxv.sys
1684	CP.exe
756	vqnifaysqk.exe
176	CP.exe
1188	CP.exe
792	i_vqnifaysqk.exe
2916	xspkicausn.sys
2400	CP.exe
536	mkfcxvpnhf.exe
2300	CP.exe
3068	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
744	ipconfig.exe
2400	ipconfig.exe
4752	ipconfig.exe
4688	ipconfig.exe
1388	ipconfig.exe
4720	ipconfig.exe
4860	ipconfig.exe
2212	ipconfig.exe
4448	ipconfig.exe
1080	ipconfig.exe
2496	ipconfig.exe
2604	ipconfig.exe
3768	ipconfig.exe
4304	ipconfig.exe
2568	ipconfig.exe
220	ipconfig.exe
3976	ipconfig.exe
1468	ipconfig.exe
4284	ipconfig.exe
3704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281801"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000a52404a8191d699b84b502b966fcef8e89a40cbec8131e12c455279836c6606a000000000e80000000020000200000004b06edbf4c6b3b67cdc35093618f9f441c907551337ffb305be058a8292b38ba20000000a1b831b0b5ff2e3f7cef0de2fd4a40e44789315d71045529c26e84ad49f87d5040000000376e1ec74c96433801bbff18eaec0b13ec8e5e6beb3b929fdda53575054995fcd9c34bf236ba6d3984fb397f85e5e46859cd38bcd1801e1f48c05da8ccb3959b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e3107c9152dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281801"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "430448523"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{44C2981F-BE7C-11F1-895E-7AAFC66160C5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497722611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "426541791"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c5157c9152dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000d8316bda81592dae16c156a870ffc9bb602c411aef954930fa00ca1c47c6de40000000000e80000000020000200000009a8fcf732f7f7b59dbca400282a44ba0a2b4bd5ee93b851a339884e4d241d6ed200000002fc4ff8b9977504f6af8373f22653f93dbf89f7122f6c4d5c6b434f061fa017540000000560fc5d5062e8be094815bd6f3bd88910ffdb88463e5517865267d453a60359e2576a4d5203704bdac83ccb12284c24fe28072ecf793fbb792c89155577bccef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	i_ysqlidbvtn.exe
Token: SeDebugPrivilege	2168	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	3068	i_cxvpnhcxvp.exe
Token: SeDebugPrivilege	2860	i_nhczusmkec.exe
Token: SeDebugPrivilege	4932	i_fzurmkecwu.exe
Token: SeDebugPrivilege	1728	i_omgeywrojh.exe
Token: SeDebugPrivilege	220	i_wtomgeywqo.exe
Token: SeDebugPrivilege	1976	i_gdywqoigay.exe
Token: SeDebugPrivilege	2068	i_davtnlxvqn.exe
Token: SeDebugPrivilege	792	i_vqnifaysqk.exe
Token: SeDebugPrivilege	4164	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	4884	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	2740	i_ecxupmhfrp.exe
Token: SeDebugPrivilege	2500	i_uomhezxrpj.exe
Token: SeDebugPrivilege	1720	i_ljdbwtomge.exe
Token: SeDebugPrivilege	2916	i_bytqljdbvt.exe
Token: SeDebugPrivilege	4824	i_vtnlgdyvqo.exe
Token: SeDebugPrivilege	5044	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	2584	i_qkicausnkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4240	iexplore.exe
4240	iexplore.exe
3248	IEXPLORE.EXE
3248	IEXPLORE.EXE
3248	IEXPLORE.EXE
3248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4240	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	88
PID 4240 wrote to memory of 3248	4240	iexplore.exe	89
PID 2360 wrote to memory of 344	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	93
PID 3356 wrote to memory of 1040	3356	ysqlidbvtn.exe	96
PID 2360 wrote to memory of 440	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	101
PID 2360 wrote to memory of 4640	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	107
PID 4672 wrote to memory of 676	4672	xvpnhfaxsq.exe	109
PID 2360 wrote to memory of 1864	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	113
PID 2360 wrote to memory of 4480	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	124
PID 4204 wrote to memory of 2152	4204	cxvpnhcxvp.exe	126
PID 2360 wrote to memory of 5064	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	129
PID 2360 wrote to memory of 5072	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	133
PID 4736 wrote to memory of 1936	4736	nhczusmkec.exe	135
PID 2360 wrote to memory of 212	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	138
PID 2360 wrote to memory of 3080	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	144
PID 400 wrote to memory of 4020	400	fzurmkecwu.exe	146
PID 2360 wrote to memory of 2004	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	149
PID 2360 wrote to memory of 3716	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	153
PID 4332 wrote to memory of 364	4332	omgeywrojh.exe	155
PID 2360 wrote to memory of 4368	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	158
PID 2360 wrote to memory of 3328	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	163
PID 1072 wrote to memory of 3396	1072	wtomgeywqo.exe	165
PID 2360 wrote to memory of 4776	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	168
PID 2360 wrote to memory of 1588	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	172
PID 3744 wrote to memory of 4444	3744	gdywqoigay.exe	174
PID 2360 wrote to memory of 1892	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	177
PID 2360 wrote to memory of 3372	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	181
PID 2556 wrote to memory of 3856	2556	davtnlxvqn.exe	183
PID 2360 wrote to memory of 1584	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	186
PID 2360 wrote to memory of 1684	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	190
PID 756 wrote to memory of 176	756	vqnifaysqk.exe	192
PID 2360 wrote to memory of 1188	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	195
PID 2360 wrote to memory of 2400	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	199
PID 536 wrote to memory of 2300	536	mkfcxvpnhf.exe	201
PID 2360 wrote to memory of 3068	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	204
PID 2360 wrote to memory of 4620	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	208
PID 4256 wrote to memory of 4544	4256	fzxrpkhcau.exe	210
PID 2360 wrote to memory of 4864	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	215
PID 2360 wrote to memory of 1232	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	219
PID 1176 wrote to memory of 4604	1176	ecxupmhfrp.exe	221
PID 2360 wrote to memory of 4928	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	224
PID 2360 wrote to memory of 1356	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	228
PID 744 wrote to memory of 4580	744	uomhezxrpj.exe	230
PID 2360 wrote to memory of 4952	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	233
PID 2360 wrote to memory of 4496	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	237
PID 3616 wrote to memory of 4848	3616	ljdbwtomge.exe	239
PID 2360 wrote to memory of 4168	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	242
PID 2360 wrote to memory of 4732	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	246
PID 3772 wrote to memory of 3448	3772	bytqljdbvt.exe	248
PID 2360 wrote to memory of 1700	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	251
PID 2360 wrote to memory of 4108	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	258
PID 4608 wrote to memory of 1884	4608	vtnlgdyvqo.exe	260
PID 2360 wrote to memory of 1032	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	263
PID 2360 wrote to memory of 4684	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	267
PID 3104 wrote to memory of 1828	3104	vsnlfdxvqn.exe	269
PID 2360 wrote to memory of 3776	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	272
PID 2360 wrote to memory of 5048	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	276
PID 4504 wrote to memory of 2468	4504	qkicausnkf.exe	278
PID 2360 wrote to memory of 2340	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	281
PID 2360 wrote to memory of 2916	2360	2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe	285
PID 456 wrote to memory of 4164	456	usmkecxupn.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d7e2ea631a3c9e6003d7b8f576c9431_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4240 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:344
- - C:\Temp\ysqlidbvtn.exe
    C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Temp\i_ysqlidbvtn.exe
    C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1864
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhcxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Temp\cxvpnhcxvp.exe
    C:\Temp\cxvpnhcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhcxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\i_cxvpnhcxvp.exe
    C:\Temp\i_cxvpnhcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\nhczusmkec.exe
    C:\Temp\nhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:212
- - C:\Temp\i_nhczusmkec.exe
    C:\Temp\i_nhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3080
- - C:\Temp\fzurmkecwu.exe
    C:\Temp\fzurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2004
- - C:\Temp\i_fzurmkecwu.exe
    C:\Temp\i_fzurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\wtomgeywqo.exe
    C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4776
- - C:\Temp\i_wtomgeywqo.exe
    C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1892
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\davtnlxvqn.exe
    C:\Temp\davtnlxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1584
- - C:\Temp\i_davtnlxvqn.exe
    C:\Temp\i_davtnlxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnifaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Temp\vqnifaysqk.exe
    C:\Temp\vqnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnifaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\i_vqnifaysqk.exe
    C:\Temp\i_vqnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2400
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  PID:4620
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  PID:4864
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupmhfrp.exe ups_run
  2⤵
  PID:1232
- - C:\Temp\ecxupmhfrp.exe
    C:\Temp\ecxupmhfrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupmhfrp.exe ups_ins
  2⤵
  PID:4928
- - C:\Temp\i_ecxupmhfrp.exe
    C:\Temp\i_ecxupmhfrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run
  2⤵
  PID:1356
- - C:\Temp\uomhezxrpj.exe
    C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins
  2⤵
  PID:4952
- - C:\Temp\i_uomhezxrpj.exe
    C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run
  2⤵
  PID:4496
- - C:\Temp\ljdbwtomge.exe
    C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins
  2⤵
  PID:4168
- - C:\Temp\i_ljdbwtomge.exe
    C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  PID:4732
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  PID:1700
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run
  2⤵
  PID:4108
- - C:\Temp\vtnlgdyvqo.exe
    C:\Temp\vtnlgdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins
  2⤵
  PID:1032
- - C:\Temp\i_vtnlgdyvqo.exe
    C:\Temp\i_vtnlgdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  PID:4684
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  PID:3776
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:5048
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:2340
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  PID:2916
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3976

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:3164

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
- Executes dropped EXE
PID:1072

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\ywrpjhbzur.sys
C:\Temp\ywrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\gbztrljebw.sys
C:\Temp\gbztrljebw.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\ztrljdbwlg.sys
C:\Temp\ztrljdbwlg.sys
1⤵
- Executes dropped EXE
PID:4448

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\xspkicausn.sys
C:\Temp\xspkicausn.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\usnkfdxvpf.sys
C:\Temp\usnkfdxvpf.sys
1⤵
PID:4108

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
PID:4536

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
PID:1052

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
PID:3484

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
PID:4236

C:\Temp\oidbvtnlgd.sys
C:\Temp\oidbvtnlgd.sys
1⤵
PID:1944

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
PID:4324

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
PID:2712

C:\Temp\kfzxspkica.sys
C:\Temp\kfzxspkica.sys
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.sys

Path C:\Temp\cxupnhfzxr.sys
Size 141KB
SHA256 3a53817deb9a9d1d537198f9e949617c088088b703bb14506f60fbbb4b92964f
MD5 cb469d137d2b7e07089481b3a7c695fd
SHA1 573f9648a2f21986935758f940b4c40a1b9ccbf5
SHA512 1b8325d304b1b441d7d3d0c67e0d96627f378e7d64443ae1770b579e9cb9b2b052acb68cc15d2ed14ccdbadafa809b33298195a2690697203de772ad1d923d85
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhcxvp.exe

Path C:\Temp\cxvpnhcxvp.exe
Size 243KB
SHA256 801fa805bb0499219044b468199bed8f22a9d4ecd82272ebba958416ce206116
MD5 d7ca883c3c949fed4019c4e58a28503b
SHA1 825855ba0813496e03f555f6bc62611da3652eea
SHA512 79a898333901406a351a0608515ff70a860b7c80af830f062ef66673be74d327aec9d24ffe85e7c805ee1007d576d6853a219e39defd76db0961303b8c30cd7e
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:Ub3TfLAUa3lLNngoqRttA7Y
TLSH
T1AF344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzurmkecwu.exe

Path C:\Temp\fzurmkecwu.exe
Size 243KB
SHA256 54e46a7e3533efe6beb5675ae62d9d026fd4b6e228d25a9501cc4bef414a8722
MD5 bb69fbc4cce9c996c4ffdd4fa3bf5488
SHA1 df7a1c3ceb154398f9264b7206963bfdaa83bada
SHA512 1592f84d19ac3afd1a1ae000f5474391786b7c4983dc5951bfe59a1cc62dc0cbbb9f7ae92df20b6f9bf20209e26fbf9e89ec175575e8c95b955d6926cfad0fe0
SSDEEP 3072:HBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:hb3TfLAUa3lLNngoqRttA7z
TLSH
T1E034490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljebw.sys

Path C:\Temp\gbztrljebw.sys
Size 141KB
SHA256 69d400f84f9e2176987b850fca4b9d2445f24d8803a7a9da8e71ed6c659d4471
MD5 1cf8c1cecc767ad8faa6845cbfdba529
SHA1 b37430437779968ce4bd88fa0373d28250fbbbad
SHA512 7c19491a2cceae4b0ee1c2859cc7b1d967f445e624279cc8162355e49ab9b0834a70c63cab0ed4526819f430b7251c028f8ead91081b44607920e3cf6e7212b8
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T114E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.exe

Path C:\Temp\gdywqoigay.exe
Size 243KB
SHA256 7a86c21cb7138b18eaea134b2c3b632c904264f2258a942b165e828266f67964
MD5 483077c298b2c32a8486043e4fbbb2de
SHA1 3afa1d4792993a013dad0f43668212770d53445a
SHA512 c325283ecd54501627f2f54014393ff74843dc3b0003835436ad7a76e8446104f70e503513abb6ab696bd666c63c96f0a605e3c33d9d967e35dc845ed0628454
SSDEEP 3072:RBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:Tb3TfLAUa3lLNngoqRttA7p
TLSH
T12E34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhcxvp.exe

Path C:\Temp\i_cxvpnhcxvp.exe
Size 243KB
SHA256 1823f63e5eae0aaae4aa09ab430b8e5d71d6fd34a3e9c903e5f18f806f9adfe1
MD5 061affbd458bd2cfe9dad4ca0fffd702
SHA1 1efab3f5ceb4dbe6f4591c1f7dc4978b3083f757
SHA512 78a057d2755f1362345d9835490566060992bd2f919bb5ea342850d2a81892c24e64d0a5b161f19555679be70d925fa90008a25050f80c131427443277bdb336
SSDEEP 3072:7Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:Nb3TfLAUa3lLNngoqRttA7b
TLSH
T145344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzurmkecwu.exe

Path C:\Temp\i_fzurmkecwu.exe
Size 243KB
SHA256 abc276ecb19fd0e17d9d06ca67b910f06ff56f873e665332f734931da77045f2
MD5 840b79d006d52240dd58b78aec9fdca2
SHA1 38759e9b23cb79b76addbca7d8dd2998d4ca3dc7
SHA512 dac9e5e9ce11fc5d24e68f4314d132d44a423d65ca21cbea1b5b6e63454398c0ceb6e8051c4713abc4f84f03ec765757ecf40d703ef51bd96bf61309b4283621
SSDEEP 3072:RBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:Tb3TfLAUa3lLNngoqRttA7V
TLSH
T13F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhczusmkec.exe

Path C:\Temp\i_nhczusmkec.exe
Size 243KB
SHA256 32578d4bf0fd0e6909623ce21e333aef29035da420386b6bed222db1eb504e80
MD5 e5d59893f0b01e3a9e7aebba02651762
SHA1 d5580cff5f59ad6e7fc2447aca881d96a71fab70
SHA512 0c6a6a6692e0dc0c1a272063f0a64111f9873e3834e5a4e059a28884e2e0f80bf8fc09c979090758ef8f2a181a58b09acbb15427e38d074b96005a7ac7bd223b
SSDEEP 3072:SBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:Kb3TfLAUa3lLNngoqRttA72
TLSH
T15F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywrojh.exe

Path C:\Temp\i_omgeywrojh.exe
Size 243KB
SHA256 18866758b45ac9d9b5fd0b915087e4f27463492896f2257796de2c97b7fdfd85
MD5 e229bbd7f39e82b6836701308c7d9e93
SHA1 ab9301f3672c990b9ecc8476e08dfc6eb0a3b747
SHA512 ebfdded1b8ed7612d6f1879fc1bb48b2f77f2bc58bfe158cd4b117ace6a100c2e3216e8b2dcc6ee4d7be5c65cba150a3b1c9ec2bdac81e66d1a41f56dc807093
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:Ub3TfLAUa3lLNngoqRttA7g
TLSH
T1C834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtomgeywqo.exe

Path C:\Temp\i_wtomgeywqo.exe
Size 243KB
SHA256 ce1c4930b0a6b1c44ff2208ce1f08919708af0707fad26dc62ea6483956f4f71
MD5 ed808fdafb29048c6cce029d3dc7d076
SHA1 daec48d480797bf995702edf87b84e4800bd36c9
SHA512 5526a01396a225b32d1ae69b24efd3b6fff0ccb1a40d562edcecb49e8f132277c3c2fa3eaa0c9a3cb973d20b82f4790e5c70c9d6ff927ae1c02c9ceb8208c4e5
SSDEEP 3072:6Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:Sb3TfLAUa3lLNngoqRttA72
TLSH
T13434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfaxsq.exe

Path C:\Temp\i_xvpnhfaxsq.exe
Size 243KB
SHA256 f3d266dbbfe6f8918f35060f0899940c714650637c89280c98352610297410aa
MD5 609bed750bf1fd1d5654e609245cc616
SHA1 d26ab35ac1ef3e1f12fa9a8a644a03e42cef8464
SHA512 a496f87a3211629f0bee9eb61ee7542b1b56290ec8ff198be7214ad6470a32d82a98fdb2594601337694bfda2fc51e9b325f97a4a21dd7727c18205d009d8e69
SSDEEP 3072:yBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:qb3TfLAUa3lLNngoqRttA7u
TLSH
T14A34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidbvtn.exe

Path C:\Temp\i_ysqlidbvtn.exe
Size 243KB
SHA256 095ab3da86f8b16ba4c06e7c90b4d0b38a15e1f8ae261d8043581d58b9ac6d2b
MD5 29fa0d3657146e4c25881bbe0d541703
SHA1 d9850357e97b1b0fb2b3f1e46cd1eef3acbbe973
SHA512 5f98cd260ff54b61295e73e124d53daf46de244cd6950f55c88b3ba5475c70bd5267e725dbede9ac06bf1b71e9ae5d37b68f8d286028b0fd76712a4ab490fabd
SSDEEP 3072:KBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:Cb3TfLAUa3lLNngoqRttA7a
TLSH
T1E834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnifa.sys

Path C:\Temp\kfdxvpnifa.sys
Size 141KB
SHA256 60fc453f6e57c6d475f061172913230e68df6521c11f71fd513513b31f920b5c
MD5 b2ebd112fbfbd0250a09b24857e16d75
SHA1 f02e6a343df48088191b35efc674695c53834067
SHA512 f3da394203e788a68cb648d097b5bb0de86c5aeffd4f1fe5975f5ed902e3d2c6d9537030fcb21ea692d5e6927263029078cdb000288dc963bc0533b2c3c96b36
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.sys

Path C:\Temp\mhezxrpjhb.sys
Size 141KB
SHA256 19aca3b14ba2e3dffafcf75e9d26b5cc38fe0539feefdcebc60396dc7d7b78d8
MD5 5f167201807018341cc7e60a4aaf8ce5
SHA1 a052f16298656f46ec7693309855ef6f1ec590a3
SHA512 c016d29c303d556b4a3a7996330dff15f58970ae3b9dc53c56565b4223366e47d7b32135b10b0e7aa838d1a19fb0986f79a4a3243801bb40d562246dba5d9987
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhczusmkec.exe

Path C:\Temp\nhczusmkec.exe
Size 243KB
SHA256 a32a1ae94ea217fd2fe255f9ad4232f6c713b3e27654d890848f4a56b6ad8b5c
MD5 9f149b192b70efc4bf2ca9e6fbe3bb2f
SHA1 12f98c42d44d5061d37fc553f73c1a1651a54e5f
SHA512 84d8073e7bfbf26f5583d7758335315e5a4fecec0c77e851e13c80eeb70c807005e78832a41d63bd4eec03b0843386b499b6460fc6d51789d73c4c69822cd591
SSDEEP 3072:IBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:4b3TfLAUa3lLNngoqRttA7U
TLSH
T12F344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxsqkic.sys

Path C:\Temp\nhfaxsqkic.sys
Size 141KB
SHA256 a13b74e6a520bf9b3e308c3ad580d48f54d2f2b6f0a48c97ce43df3724710e11
MD5 7dfd1f0da66bf48eea3c58e5d652b84c
SHA1 05a469a2b59dd254ad63853d5e949931a1293195
SHA512 c9b61a08e9aeff933bd0ae4a75b9a13828c8d226823d808129c90672d051dbf7e53f1ff1ba1611b427771d981a146a425d4ec280f316272ae68836e9d5ee0163
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojh.exe

Path C:\Temp\omgeywrojh.exe
Size 243KB
SHA256 a29b9e96dc1a79ff60fe2b6f032dda3c5e30a0da37d560b99c12e795233f999b
MD5 dd99694afbb4d778f3d404cb346b204e
SHA1 559469a0b03ea0ecdc74bcd8cd514b0b248f9711
SHA512 0e9e2e7c05eb3352e8afa49ecf5cbe1908771f8e659ad23f2535dfd5db5b7da323cc3a1a37e1c6b839d80821e04f8084fa0ada82fc705bb2e6c764405988e9a1
SSDEEP 3072:eBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:eb3TfLAUa3lLNngoqRttA7u
TLSH
T10C34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywqo.exe

Path C:\Temp\wtomgeywqo.exe
Size 243KB
SHA256 6611541faab40d38c9796647f51a8fb5bf763d1eba343a627e6655468be1fdc2
MD5 ae22591f9af9d04aaa5e87600655bee6
SHA1 36b9c15162a172d8f984ecb7a8ce16cc245b9093
SHA512 d5a2c2acd5ec627f154a5bff48d3d52c0fb7dc02cfc1d504d54f64fba1ab8602c1f5c07ba171337c6c251d87233bbf6d96c8f8eccd0ece80a37bce1ddc092106
SSDEEP 3072:QBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:Ab3TfLAUa3lLNngoqRttA7w
TLSH
T13E34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsq.exe

Path C:\Temp\xvpnhfaxsq.exe
Size 243KB
SHA256 088d7c7cf73f748bc62a1732c05b4f5288d95548496f0d61f711aaeeb6d5f220
MD5 c0e8bba6300c64a036b8dc7eed179b9e
SHA1 63319f6770bfd272a38f07ac016c9742d2646afa
SHA512 53ede1089b7995860a3aada96b53f03ebbaebfc76771e1e7554c08d25e4b5a310f0a1fa19e073a72a4781406e0718796750424b88c1f5ce024644ec081bc33c9
SSDEEP 3072:PBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:Jb3TfLAUa3lLNngoqRttA7v
TLSH
T18B34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.exe

Path C:\Temp\ysqlidbvtn.exe
Size 243KB
SHA256 e2ec456cef0f872484b2a511aef8bbb24f804cfa209e019691a7d40b8912ca86
MD5 812941c93be851a8dce34320a9672511
SHA1 db624398e040fab7ffe12cd01b905ad2678cd496
SHA512 6d15cf41262fdcf3f7ee49cbaac0261321d2acd12b470c594fd7fa050d7358d5423dd07b2650cd934086d432df182587e551eb70d7f97bce26dfad39df981f06
SSDEEP 3072:IBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:4b3TfLAUa3lLNngoqRttA7s
TLSH
T1F434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrpjhbzur.sys

Path C:\Temp\ywrpjhbzur.sys
Size 141KB
SHA256 1dc752e7ceb27b386de93305f8ee190df23e46edf54a053a4fab7d608bbb5816
MD5 1fcb08e4312cdd1d3343be9b6cf39279
SHA1 5c9463fc5c336b884c1a9caf7ed3818bb5a8720e
SHA512 74238f31f6d2906a18918a98d04b24b5e00825bf2c9cc8c13b0ac25acdeb98dd24993ee674427aa5a17fee63c313098bd8587bed1be214be9b957aa20acca170
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T174E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwlg.sys

Path C:\Temp\ztrljdbwlg.sys
Size 141KB
SHA256 2cfa91dbf99ba12572d2721edc8b68db08a3cf6daa65c342b969f9763552bde2
MD5 22a60449ad3ea5259bf9cb4d3d056630
SHA1 4997d5a09ae3af7b19936b090f6348cf4160c1d9
SHA512 53e9c627e5eea9de05f74408e16ab76935776213fcec64a05b2b996b4e4f9ddfc458bd2489d068540eace8919f5893e382e249c6ec0f72e8aa8fb4e30084b466
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 531a37ca2ce25917d5e4b08091e92b8fd6daa4c8d74ad2537f7279baf1d41396
MD5 3f682675bac8468d0563156feb5e46a6
SHA1 6551a2a64854909356fc07f2d57599831ad251ca
SHA512 b0acef0d79d3e63508a031f4025946cad7c9cf2dd0a84c5bd027b28e89c283e2c5a55d89a382ac611f93e20d8dd523ea60eb0ca07aa2b55fb1ff76f46ad21fc6
TLSH
T1BAE0C03411F6025FE4F4D4348BEB74318469F1260418A6B42AC59B04A703A40AC03E25
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1072-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1776-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1944-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-162-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3484-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3884-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4236-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4324-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads