537f1f5f165ac3093249f83c29d40eebe29b037cb1ad3bfe4974a069786c8a50

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
Size 243KB
Sample261007-3f5ycsfx8v
SHA256 537f1f5f165ac3093249f83c29d40eebe29b037cb1ad3bfe4974a069786c8a50
MD5 905978ce6a55ed27a5ee62ef764fb788
SHA1 2b0ecd0c91fad88bfa24d9e46bb66c9fe01f97d4
SHA512 50f383571f4409bb8b5d58210e93efe4c505ee142a482fff0b7fd1de74185e820851a60de027573a295a8fe0e3341f256fc67667b4eafa9e568f529522f62524
SSDEEP 3072:iVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:iXP7LQMa3lLNngoqRttA7n
TLSH
T103345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2608	CP.exe
3520	trmgeywrlj.exe
4332	CP.exe
1344	CP.exe
548	i_trmgeywrlj.exe
1696	rljdbwtoey.sys
3568	CP.exe
2836	ywqojgbztr.exe
3872	CP.exe
5092	CP.exe
3980	i_ywqojgbztr.exe
4160	dywqoigayt.sys
2108	CP.exe
2436	wqoigtqljd.exe
4424	CP.exe
3524	CP.exe
1060	i_wqoigtqljd.exe
2504	sqlidbvtnl.sys
2128	CP.exe
2356	lfdyvqniga.exe
3076	CP.exe
1356	CP.exe
3064	i_lfdyvqniga.exe
2288	lfdxvpnifa.sys
2904	CP.exe
4936	axsqkicaus.exe
1760	CP.exe
4484	CP.exe
1692	i_axsqkicaus.exe
3020	hfaxsqkaus.sys
2288	CP.exe
1608	pkicausmkf.exe
2696	CP.exe
2968	CP.exe
1820	i_pkicausmkf.exe
552	smkecxupnh.sys
2916	CP.exe
1912	cxupnhcwup.exe
1960	CP.exe
4116	CP.exe
5080	i_cxupnhcwup.exe
2372	hfzxrpjhcz.sys
2636	CP.exe
4304	zurmkecwuo.exe
1784	CP.exe
1792	CP.exe
2796	i_zurmkecwuo.exe
3900	ztrmjecwuo.sys
3048	CP.exe
548	omgeywrpjh.exe
2336	CP.exe
3876	CP.exe
2092	i_omgeywrpjh.exe
1820	rljdbwtomg.sys
1220	CP.exe
4328	geywqoigby.exe
2060	CP.exe
2756	CP.exe
2972	i_geywqoigby.exe
3320	tomgeywqoj.sys
3652	CP.exe
1532	bytqljdbvt.exe
2796	CP.exe
3828	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhcwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmgeywrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmgeywrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhcwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1320	ipconfig.exe
3032	ipconfig.exe
2864	ipconfig.exe
3852	ipconfig.exe
4840	ipconfig.exe
3980	ipconfig.exe
4052	ipconfig.exe
2720	ipconfig.exe
4300	ipconfig.exe
3988	ipconfig.exe
3860	ipconfig.exe
2584	ipconfig.exe
1684	ipconfig.exe
744	ipconfig.exe
1196	ipconfig.exe
4516	ipconfig.exe
3484	ipconfig.exe
5040	ipconfig.exe
920	ipconfig.exe
812	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e56300bc56dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282867"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202a5f00bc56dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000729976458adc5d34d4e39b9170b1a49819fa9b5b666a45a5a1059eaff1e7e9d1000000000e80000000020000200000008c448056a2870025cf46e9528c7f8d89bb6f4b3c1a0d4ea34bc9c2616da4047f2000000056167f143cfe44355d984c03a13ca1ff9ab4649a2e3d2f38c5fae413d7172336400000008578fa0106b07ce200dcab7e0a1c26f42e4bd1c466f288883a4aba2a325c08516d15cd876865677dc554dd6be38cf728c2f6e993718b1ef5bbcd1e8ccb616f15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2652504736"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000008c3b6f995c394095f56a445ce5866c64a6bac775fdd1d4656f4c177ea7032e7c000000000e800000000200002000000024ac16673218ca7972a87bbc4b8442c481e051955f17cfe905b96c220aa880e820000000aa69ac154fafe3bf720aac994671795aa4ec55e20508eeb915c5fa2b66d5d86340000000360dcc9c8fb3595e3de40a825e6f44bd8a0df4d65652716f15acf95a7314d015260ee9307c1fb4308c5eef4ab15fab7bf5ec7ed1fefbeaa602f08b07c35d32b8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498180677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282867"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2649068125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C955DEC9-C2A6-11F1-8007-56B788D469C5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	i_trmgeywrlj.exe
Token: SeDebugPrivilege	3980	i_ywqojgbztr.exe
Token: SeDebugPrivilege	1060	i_wqoigtqljd.exe
Token: SeDebugPrivilege	3064	i_lfdyvqniga.exe
Token: SeDebugPrivilege	1692	i_axsqkicaus.exe
Token: SeDebugPrivilege	1820	i_pkicausmkf.exe
Token: SeDebugPrivilege	5080	i_cxupnhcwup.exe
Token: SeDebugPrivilege	2796	i_zurmkecwuo.exe
Token: SeDebugPrivilege	2092	i_omgeywrpjh.exe
Token: SeDebugPrivilege	2972	i_geywqoigby.exe
Token: SeDebugPrivilege	4672	i_bytqljdbvt.exe
Token: SeDebugPrivilege	4324	i_yvqoigaysq.exe
Token: SeDebugPrivilege	3316	i_vsnifaysqk.exe
Token: SeDebugPrivilege	1520	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	1716	i_pfzxrpkhcz.exe
Token: SeDebugPrivilege	3164	i_mkecwupmhf.exe
Token: SeDebugPrivilege	4880	i_gezwuojhbz.exe
Token: SeDebugPrivilege	4428	i_eywqojgbzt.exe
Token: SeDebugPrivilege	1652	i_jdbwtomywq.exe
Token: SeDebugPrivilege	372	i_dyvqoigayt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3024	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	87
PID 3024 wrote to memory of 2540	3024	iexplore.exe	88
PID 3784 wrote to memory of 2608	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	92
PID 3520 wrote to memory of 4332	3520	trmgeywrlj.exe	95
PID 3784 wrote to memory of 1344	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	102
PID 3784 wrote to memory of 3568	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	107
PID 2836 wrote to memory of 3872	2836	ywqojgbztr.exe	110
PID 3784 wrote to memory of 5092	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	114
PID 3784 wrote to memory of 2108	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	118
PID 2436 wrote to memory of 4424	2436	wqoigtqljd.exe	120
PID 3784 wrote to memory of 3524	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	123
PID 3784 wrote to memory of 2128	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	127
PID 2356 wrote to memory of 3076	2356	lfdyvqniga.exe	129
PID 3784 wrote to memory of 1356	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	132
PID 3784 wrote to memory of 2904	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	137
PID 4936 wrote to memory of 1760	4936	axsqkicaus.exe	139
PID 3784 wrote to memory of 4484	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	143
PID 3784 wrote to memory of 2288	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	153
PID 1608 wrote to memory of 2696	1608	pkicausmkf.exe	155
PID 3784 wrote to memory of 2968	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	158
PID 3784 wrote to memory of 2916	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	162
PID 1912 wrote to memory of 1960	1912	cxupnhcwup.exe	164
PID 3784 wrote to memory of 4116	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	167
PID 3784 wrote to memory of 2636	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	171
PID 4304 wrote to memory of 1784	4304	zurmkecwuo.exe	173
PID 3784 wrote to memory of 1792	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	176
PID 3784 wrote to memory of 3048	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	180
PID 548 wrote to memory of 2336	548	omgeywrpjh.exe	182
PID 3784 wrote to memory of 3876	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	185
PID 3784 wrote to memory of 1220	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	189
PID 4328 wrote to memory of 2060	4328	geywqoigby.exe	191
PID 3784 wrote to memory of 2756	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	194
PID 3784 wrote to memory of 3652	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	200
PID 1532 wrote to memory of 2796	1532	bytqljdbvt.exe	202
PID 3784 wrote to memory of 3828	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	205
PID 3784 wrote to memory of 4144	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	209
PID 2512 wrote to memory of 4400	2512	yvqoigaysq.exe	211
PID 3784 wrote to memory of 3456	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	214
PID 3784 wrote to memory of 4112	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	218
PID 2976 wrote to memory of 4496	2976	vsnifaysqk.exe	220
PID 3784 wrote to memory of 4168	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	223
PID 3784 wrote to memory of 4664	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	227
PID 2600 wrote to memory of 1708	2600	nkfcxvpnhf.exe	229
PID 3784 wrote to memory of 968	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	232
PID 3784 wrote to memory of 1188	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	236
PID 1752 wrote to memory of 3476	1752	pfzxrpkhcz.exe	238
PID 3784 wrote to memory of 756	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	242
PID 3784 wrote to memory of 1640	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	246
PID 368 wrote to memory of 4872	368	mkecwupmhf.exe	248
PID 3784 wrote to memory of 2116	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	251
PID 3784 wrote to memory of 4888	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	255
PID 3756 wrote to memory of 5060	3756	gezwuojhbz.exe	257
PID 3784 wrote to memory of 4276	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	260
PID 3784 wrote to memory of 3188	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	264
PID 3144 wrote to memory of 4892	3144	eywqojgbzt.exe	266
PID 3784 wrote to memory of 3344	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	269
PID 3784 wrote to memory of 3592	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	273
PID 2596 wrote to memory of 3172	2596	jdbwtomywq.exe	275
PID 3784 wrote to memory of 1952	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	278
PID 3784 wrote to memory of 4232	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	282
PID 2348 wrote to memory of 3392	2348	dyvqoigayt.exe	284
PID 3784 wrote to memory of 4356	3784	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmgeywrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2608
- - C:\Temp\trmgeywrlj.exe
    C:\Temp\trmgeywrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmgeywrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1344
- - C:\Temp\i_trmgeywrlj.exe
    C:\Temp\i_trmgeywrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3568
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5092
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigtqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Temp\wqoigtqljd.exe
    C:\Temp\wqoigtqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigtqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Temp\i_wqoigtqljd.exe
    C:\Temp\i_wqoigtqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2128
- - C:\Temp\lfdyvqniga.exe
    C:\Temp\lfdyvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\i_lfdyvqniga.exe
    C:\Temp\i_lfdyvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2288
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhcwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\cxupnhcwup.exe
    C:\Temp\cxupnhcwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhcwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\i_cxupnhcwup.exe
    C:\Temp\i_cxupnhcwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1792
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\omgeywrpjh.exe
    C:\Temp\omgeywrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3876
- - C:\Temp\i_omgeywrpjh.exe
    C:\Temp\i_omgeywrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Temp\geywqoigby.exe
    C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2756
- - C:\Temp\i_geywqoigby.exe
    C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3652
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run
  2⤵
  PID:4144
- - C:\Temp\yvqoigaysq.exe
    C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins
  2⤵
  PID:3456
- - C:\Temp\i_yvqoigaysq.exe
    C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnifaysqk.exe ups_run
  2⤵
  PID:4112
- - C:\Temp\vsnifaysqk.exe
    C:\Temp\vsnifaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnifaysqk.exe ups_ins
  2⤵
  PID:4168
- - C:\Temp\i_vsnifaysqk.exe
    C:\Temp\i_vsnifaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  PID:4664
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  PID:968
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pfzxrpkhcz.exe ups_run
  2⤵
  PID:1188
- - C:\Temp\pfzxrpkhcz.exe
    C:\Temp\pfzxrpkhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pfzxrpkhcz.exe ups_ins
  2⤵
  PID:756
- - C:\Temp\i_pfzxrpkhcz.exe
    C:\Temp\i_pfzxrpkhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  PID:1640
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  PID:2116
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwuojhbz.exe ups_run
  2⤵
  PID:4888
- - C:\Temp\gezwuojhbz.exe
    C:\Temp\gezwuojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwuojhbz.exe ups_ins
  2⤵
  PID:4276
- - C:\Temp\i_gezwuojhbz.exe
    C:\Temp\i_gezwuojhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  PID:3188
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  PID:3344
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomywq.exe ups_run
  2⤵
  PID:3592
- - C:\Temp\jdbwtomywq.exe
    C:\Temp\jdbwtomywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomywq.exe ups_ins
  2⤵
  PID:1952
- - C:\Temp\i_jdbwtomywq.exe
    C:\Temp\i_jdbwtomywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run
  2⤵
  PID:4232
- - C:\Temp\dyvqoigayt.exe
    C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins
  2⤵
  PID:4356
- - C:\Temp\i_dyvqoigayt.exe
    C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:372

C:\Temp\rljdbwtoey.sys
C:\Temp\rljdbwtoey.sys
1⤵
- Executes dropped EXE
PID:1696

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\sqlidbvtnl.sys
C:\Temp\sqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:2504

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:2288

C:\Temp\hfaxsqkaus.sys
C:\Temp\hfaxsqkaus.sys
1⤵
- Executes dropped EXE
PID:3020

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
- Executes dropped EXE
PID:552

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
- Executes dropped EXE
PID:1820

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:1284

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
PID:2116

C:\Temp\faqkicausn.sys
C:\Temp\faqkicausn.sys
1⤵
PID:2404

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
PID:3344

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
PID:3052

C:\Temp\rmjecwuomh.sys
C:\Temp\rmjecwuomh.sys
1⤵
PID:824

C:\Temp\wrpjhcwuge.sys
C:\Temp\wrpjhcwuge.sys
1⤵
PID:4244

C:\Temp\uojgbztrlj.sys
C:\Temp\uojgbztrlj.sys
1⤵
PID:1552

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicaus.exe

Path C:\Temp\axsqkicaus.exe
Size 243KB
SHA256 ea96648c529248b240c0d87dbcdd242bc8981459d2f1967fbd31cee1ffa0fb51
MD5 1415fc4618ecbe4ad14169130a5e7c32
SHA1 42158804ce994b1632002902affe61f7f96bd769
SHA512 ce80e226a163e76eb2cc2c031998115af1b053b8797fb9410966f6cce23b06823cf10d84addb0c8c885af01146e1f1f5615896f4baf7da8e503cb55735a48bb8
SSDEEP 3072:dVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:vXP7LQMa3lLNngoqRttA7Y
TLSH
T146345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhcwup.exe

Path C:\Temp\cxupnhcwup.exe
Size 243KB
SHA256 03c6541f894e7317caeb9d7a609b915f3966272bc50b70880bdde1955a942e79
MD5 181c80391c72d1ad607254aa3620aad6
SHA1 9a18ee9f24ba93153094bb29f735d4f5703f9459
SHA512 041b3940c1f06ba500e91ac3f8517e62fd98956835d656008b40dc63822f9337484bfd9945a93f9acf8f09686233af145befbb092634879811c534fb90c66d46
SSDEEP 3072:eVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:OXP7LQMa3lLNngoqRttA7L
TLSH
T16A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 141KB
SHA256 1bb70a622811b84eb3def6a970f3ab423f705f1cdcf9ca31faed9b03d9009524
MD5 096153263dca301482ecc570357726e0
SHA1 3633638f7106c3d01e757cc3f5f461d8b597ea0b
SHA512 415a2c4d11d14c110275a1d04a133ff2c2746f64dd94eaf322010aacac64f38718a5ef6aaa97c3bd2a254cb802c77576e76998a69f209320395b809e888b6ff8
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkaus.sys

Path C:\Temp\hfaxsqkaus.sys
Size 141KB
SHA256 17b3d766fbde6bf6bc18b053816b4b2ba4ddb31f7519d62ba758ed9cc7fbbaef
MD5 fd3e264170a0aa3803a0f5b3ddbb1c71
SHA1 18aceff25131262f33f1722279fb303728263aea
SHA512 dbbd515557ee9baed299959e11c08994d2922c996e39756093a6e84cea5d133879833d95b1314c14832ede0b75548de8f69a31141355eb5053c16c953d6b2f6c
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhcz.sys

Path C:\Temp\hfzxrpjhcz.sys
Size 141KB
SHA256 e8a7f3a744230a4cf175b26f18305bb9b0eadc764fad16e762366c7421fa7b06
MD5 f97530602774ee26944ceea9268ceec6
SHA1 c794ae135308c36f20fface8c7ddfda5ec3873cc
SHA512 9f7a222384c1cb8a4cbe5959502b6a16be1c1cc21e4ae2a71ecc48e8473600714a40c3fd3c2e84c2952accabce23a8dd1dade3c3af7973b850980291e09a1c92
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicaus.exe

Path C:\Temp\i_axsqkicaus.exe
Size 243KB
SHA256 c87b9ff5a06939e63feb4ce8a55bc6bd33f19ef61b6d2a3d7fe7ed8ee5c00554
MD5 766c0e2154100d20514f8da40d9745ec
SHA1 0a4bfd3c36f29a805b8568ee17682126963cdd75
SHA512 62cacb26ca3f2a6d09adec6c5400a9d37870836e18ebee4cb456886cce97ec34e79022985ded67951ce467d5c932e44baa03d6cadcdea6f111fcdd803a00af96
SSDEEP 3072:EVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:AXP7LQMa3lLNngoqRttA79
TLSH
T11F345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupnhcwup.exe

Path C:\Temp\i_cxupnhcwup.exe
Size 243KB
SHA256 0d3546820e8eef519e2b9505dbbab2e4580fa0b7e100ddb886caef6ec0b0cdf7
MD5 1d8715235833ffd1614294a33d64196c
SHA1 036c978256f0c232a8eaea1ec2ce0db7a6f10bc8
SHA512 8125ad2b3ffc209ca2749a40555ec034f87db7682c6d8f5567471a01105ca5c05337c0a32c7e6b805049ca543d63e7ae5ec7f868d3808af214691a5e74bc30a0
SSDEEP 3072:JVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:bXP7LQMa3lLNngoqRttA7Q
TLSH
T191345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqniga.exe

Path C:\Temp\i_lfdyvqniga.exe
Size 243KB
SHA256 b959942017f8e857732c8fe9191f6d8dfbce495efad330d6e351270162f2baad
MD5 bd7b53047762b8a7928e7537c666d07c
SHA1 22814ed6715e4f124822f40c302f1f478438ab43
SHA512 3aab9f4ae98d00af513302250bc2b622aa82eec37a65327bf7f2de1d0ce739e3468b2ca59da01a210f38d168735fd150332b0f205f2d0c372de66bce8becdaca
SSDEEP 3072:eVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:OXP7LQMa3lLNngoqRttA7T
TLSH
T108345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausmkf.exe

Path C:\Temp\i_pkicausmkf.exe
Size 243KB
SHA256 3201693f0618c464cc3b18d5d54a6cc10f7c51c566b4d73566d48fdd69fbd191
MD5 9d57ab66f551ef8e3ebc69e78d3bcee8
SHA1 e6f6c98939123cc29c41c986f15c692b1e7e31c4
SHA512 8102dc6fca0d1378f03531ab191b1877413db6e699f28be24555f56c7ffb3144f48222a226840866334ff783c5ce64802d1cfeac9779f4c2673115046a97b81c
SSDEEP 3072:2VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:mXP7LQMa3lLNngoqRttA7/
TLSH
T146345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmgeywrlj.exe

Path C:\Temp\i_trmgeywrlj.exe
Size 243KB
SHA256 4d1abd67053be1f2429a28fe2993d540e14913ebb15e38695f0231f4296bce77
MD5 142ca266ff800fdcc340706c3a65bc6a
SHA1 8c7e62df2401f58df999f68c9abe8899318062ca
SHA512 e72e4d6df1dfec2a087b734f7a687dcb9d7ea53b566179ac26e9fe905b4eb56569251de0b17dd104ade348631bf1b67af8dda766064a2f87c009eb7f095fcab6
SSDEEP 3072:HVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:1XP7LQMa3lLNngoqRttA7K
TLSH
T12C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoigtqljd.exe

Path C:\Temp\i_wqoigtqljd.exe
Size 243KB
SHA256 ad294dbff280444490394be41f34d98705db65abcca533e31cc0d5269bbbec9e
MD5 b3144bb300c1a666e88dec1fc230c318
SHA1 969e121521a7826779e5a6a984f941a2ff8e5d67
SHA512 dab446b4d9374a7b34369b6b46b50e0b3d300a2a11a6a948514be6ba3ed1f5b01144a715e4c5060bd533a385625c3dc9172060fae3d3d03710e4b01193c4e9c9
SSDEEP 3072:GVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:2XP7LQMa3lLNngoqRttA7X
TLSH
T14E345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqojgbztr.exe

Path C:\Temp\i_ywqojgbztr.exe
Size 243KB
SHA256 83e45c26206060b972fced7e219fa97cfd7a119901bfa6054f5f372631e0fc72
MD5 713a1b4d2b19e81bf22039b8122eed53
SHA1 8cc39219a062a0f47691323a6e1ffe0e32dba7f3
SHA512 3dec992ac34eae5729e4cb0219635b9a4be24370e65ad06d427d4fa75de181fb5812cc75e541c47a7a20c7d59b217a59aadb7b4bf7a38365ab6149919ba2b6dc
SSDEEP 3072:2VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:mXP7LQMa3lLNngoqRttA7z
TLSH
T12A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.sys

Path C:\Temp\lfdxvpnifa.sys
Size 141KB
SHA256 3aa817c5d375a484a5e8980a8a640cab808844f955bbd42b341ba42484ad7778
MD5 86fc863a3366f899d8a7eb593a28ecd6
SHA1 0ff860349821d082e426a98db0dc7eca678bb3b8
SHA512 c66e472c403c598aa02f7588492cc65f3885129cb5c1402d97355e88fb8785ee58a082323eeea685452ead2d774bc472bf63c1aa4addfadc042cc2c17468a1f5
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqniga.exe

Path C:\Temp\lfdyvqniga.exe
Size 243KB
SHA256 d53548a999320aa705809528c67b179858c72460185e0af728784faae8270ee3
MD5 8fbc9a93ab6e6f1e5657e0ee0e0ac472
SHA1 2f106a9b05739c8e1173a2c30bbf14ebab036b4a
SHA512 5edebcdb1c0d2f285fa06c494fcbf19d4757d090a1d655d5a240b533d85141c22768a1febe7a3481a45c48f18cafcd10ffcd63f24bd7915ce6bd8b4389f879fd
SSDEEP 3072:wVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:cXP7LQMa3lLNngoqRttA7l
TLSH
T1F4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkf.exe

Path C:\Temp\pkicausmkf.exe
Size 243KB
SHA256 87f3445d062ceacc760f88bb0fc8469b6d64a1ab3e6278bad7dcbd34a58811ac
MD5 10827b779a071664ac5813f3c3b722db
SHA1 9348efc3b6fdb14f439213fec28567f19acf8e43
SHA512 7e2e8eed2e9ff14a19f3025d6bf0ed3a683f1d74f0dc7ad67d1a24281aee8f417d2683680f2a5de91593ca1f0049db81e6b184e03f801d29775e266ca1370654
SSDEEP 3072:FVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:XXP7LQMa3lLNngoqRttA7s
TLSH
T18D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtoey.sys

Path C:\Temp\rljdbwtoey.sys
Size 141KB
SHA256 0b6ff068806bc2d23376e4025f748a06a809cbbe75465ac73e56705fd9a1036c
MD5 6b10273b595e9963938a71ab418cebe6
SHA1 f953c2b0a9ddfbcd4b2e77af0db75e0be426fbc8
SHA512 b59943a915173c51d4daa52e4ab1355783350651994d4d2fe1948cfbf6454429b4172077cf4d9714fe3cd087371e2b6ee7f27dc3f148ddbd0012a27119c36fdb
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T141E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupnh.sys

Path C:\Temp\smkecxupnh.sys
Size 141KB
SHA256 c439c65e0fedac931cddd8988ef8f03866dfaf8936d7a75e85efee14440bb694
MD5 a8838133466fb37a02a720c722570ab3
SHA1 4b34764422d9ba5894c1fb0e281ef2aae162043d
SHA512 ecae9e898058508b2640f49ec7188a4e9640320912f09b805f37a5141ee17f5f065cca5cce3eff74f588d097d3d9b7f9f5647f851ab80ad04da777f71a91a579
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtnl.sys

Path C:\Temp\sqlidbvtnl.sys
Size 141KB
SHA256 a2c0b554c1d82eebc5a51e1a92e74be261f51836884216f5d966d208868aed36
MD5 5f229524b5654dd2eee7a1c478ce7389
SHA1 52f9e4aa6ec42b344a3fcd82d6965a5c63f07092
SHA512 23cce82ed4ec97d9bcde3ded369777668fd4b00114bac4dfa3007daacb31b91875fbc77a8cc9b09f99b1402ff4218a744bb828979ad8c0be4dd8e1b62ab571fd
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmgeywrlj.exe

Path C:\Temp\trmgeywrlj.exe
Size 243KB
SHA256 c2be6794a375f00256fb841a6d4e0d005048449caccce605d19fea28c5add0ef
MD5 065d740ba46e5038e45c953b774810c1
SHA1 936a3a8adab8e1b662c0811e2e24a153e696e091
SHA512 0fc132c66748307e5b62c0e80ea9209c13811f61130a32745917332a69100eb6184fcc5c39c869f5c71dcd57f9bd1d8df32c4605c6c0a2e39a6ca2e85b0ebf80
SSDEEP 3072:nVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:VXP7LQMa3lLNngoqRttA7G
TLSH
T150345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigtqljd.exe

Path C:\Temp\wqoigtqljd.exe
Size 243KB
SHA256 e4160e5a63dc80b6e3763fc0242aa15d0fa61a129db54600062edf8848d07d60
MD5 8a192e4dc74898d3db1dcf5dc93b3cb6
SHA1 f831daaa377d586373858572e89e0c7fa6e97baa
SHA512 ec5523e4414ce0903c5417a5ece6e0821668db77fd6f9303283f6130c592755f77390edc8e15fc4295b1a02255f74695b68319cb29f34a86edffe214f1306cd3
SSDEEP 3072:dVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:vXP7LQMa3lLNngoqRttA7I
TLSH
T18E345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.exe

Path C:\Temp\ywqojgbztr.exe
Size 243KB
SHA256 d19aa2bce119544445f322683de1a613e3050ac81a007dec79798ee81a74d639
MD5 b20cc1352827ae3e8616e7bea34fe7f4
SHA1 c0cde06b40c3f520eee74519c3e00aa09403afa6
SHA512 ecd1e0caf0469b8f3a42553386ffd4c0cf28809d3245316f3fd430b5ec1f29806e350d3839cfaa5fecdc1af681f1773ba1ebaabe51dcf5116ad95a0e1b147395
SSDEEP 3072:EVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:AXP7LQMa3lLNngoqRttA7t
TLSH
T149345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.exe

Path C:\Temp\zurmkecwuo.exe
Size 243KB
SHA256 31125f2c8a8ed247c632182992137da77cfa74a5a9781aebd75b258f983e2643
MD5 332e01f8aede1c594e0e04899b73daaf
SHA1 0438e6ab03967d395bc84f2cbcbd7031bf17ee9d
SHA512 8e137c141b1acd0223d478b7aab7a73539b9aed75af73d268036790069cc738562e9936793675ab215c0a23351e60044929f8cf119f5353ebad977dbbddff023
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:ZXP7LQMa3lLNngoqRttA7C
TLSH
T1E6345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 aff87962dd01735df750d04adfbb314a12bd20993b4af6867655fc6aeada6b66
MD5 60194371b5e9140bcb38cad0dd57d537
SHA1 5e508363815deb39ec394b8983a86ebc7810e621
SHA512 5f123beeee65f7ff283f0d7552f2611857a0d03376e127dfa4ed7d1bd251db2a7e04a489682619a6c4b24c79fe71aa3bae1b799e01b64a8943b5b8d86f919811
TLSH
T1A3F0978280ADF4E1BA82B9DC4A6E595AB030BA4E0089C203606C4AE909A42672F59636
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 33a51cac30abf439cfbb6716c9daf8f71092f26c93a0116e92888980475aa6a9
MD5 eb4d24d885838f2968f70db66aedc2ba
SHA1 bface0336c4fa34b5d1bdae851003edf910782f3
SHA512 48954e3bfeb0feeadbc3fa02b867e08a64dd0e9d841b0b29f581ccb6d2b43f28ec16d8d108d8525acd96af72a1758bd69a887aef230bdd17b8a7bbe40d9d4a26
TLSH
T110E0682415FB821FE5A9D4344AC5742584A9F032092AA3B429C99B08E603A009C02A2A
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0OIDP0T3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/824-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1284-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1820-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2288-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2404-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2504-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3020-74-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3052-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3344-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4244-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads