Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 15:38
General
- Target 2026-05-11_c52bbc0497a6dce6cbc63df106fdd1ba_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260511-s3fa4sdw5v
- SHA256 bb3aba9511aebac3bdbacf915aecbb76c7963b9f2bd11ee96a16466e5070e620
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_c52bbc0497a6dce6cbc63df106fdd1ba_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_c52bbc0497a6dce6cbc63df106fdd1ba_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecxupnhc.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mkecxupnhc.exeC:\Temp\mkecxupnhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecxupnhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupnhc.exeC:\Temp\i_mkecxupnhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojg.exeC:\Temp\omgeywrojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywrojg.exeC:\Temp\i_omgeywrojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrigbytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytrigbytql.exeC:\Temp\ytrigbytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrigbytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytrigbytql.exeC:\Temp\i_ytrigbytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqljdtnlgd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tqljdtnlgd.exeC:\Temp\tqljdtnlgd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqljdtnlgd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdtnlgd.exeC:\Temp\i_tqljdtnlgd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.exeC:\Temp\ysqkidavsn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavsn.exeC:\Temp\i_ysqkidavsn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfa.exeC:\Temp\kfcxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfa.exeC:\Temp\i_kfcxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcamkecwup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hcamkecwup.exeC:\Temp\hcamkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcamkecwup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hcamkecwup.exeC:\Temp\i_hcamkecwup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhbzuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzuom.exeC:\Temp\xrpjhbzuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhbzuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzuom.exeC:\Temp\i_xrpjhbzuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrmje.exeC:\Temp\ojhbztrmje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojhbztrmje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojhbztrmje.exeC:\Temp\i_ojhbztrmje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jeywqojgbz.exe ups_run2⤵
-
C:\Temp\jeywqojgbz.exeC:\Temp\jeywqojgbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jeywqojgbz.exe ups_ins2⤵
-
C:\Temp\i_jeywqojgbz.exeC:\Temp\i_jeywqojgbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywigbytq.exe ups_run2⤵
-
C:\Temp\geywigbytq.exeC:\Temp\geywigbytq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywigbytq.exe ups_ins2⤵
-
C:\Temp\i_geywigbytq.exeC:\Temp\i_geywigbytq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run2⤵
-
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins2⤵
-
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run2⤵
-
C:\Temp\vtnlfdxvqn.exeC:\Temp\vtnlfdxvqn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins2⤵
-
C:\Temp\i_vtnlfdxvqn.exeC:\Temp\i_vtnlfdxvqn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicavpnif.exe ups_run2⤵
-
C:\Temp\pkicavpnif.exeC:\Temp\pkicavpnif.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicavpnif.exe ups_ins2⤵
-
C:\Temp\i_pkicavpnif.exeC:\Temp\i_pkicavpnif.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snkfdxvpfz.exe ups_run2⤵
-
C:\Temp\snkfdxvpfz.exeC:\Temp\snkfdxvpfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snkfdxvpfz.exe ups_ins2⤵
-
C:\Temp\i_snkfdxvpfz.exeC:\Temp\i_snkfdxvpfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhez.exe ups_run2⤵
-
C:\Temp\kecwupmhez.exeC:\Temp\kecwupmhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhez.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhez.exeC:\Temp\i_kecwupmhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztomgezwr.exe ups_run2⤵
-
C:\Temp\bztomgezwr.exeC:\Temp\bztomgezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztomgezwr.exe ups_ins2⤵
-
C:\Temp\i_bztomgezwr.exeC:\Temp\i_bztomgezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run2⤵
-
C:\Temp\wtomgeywqo.exeC:\Temp\wtomgeywqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins2⤵
-
C:\Temp\i_wtomgeywqo.exeC:\Temp\i_wtomgeywqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrojhbztr.sysC:\Temp\zwrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmgeywqoby.sysC:\Temp\rmgeywqoby.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaytqlid.sysC:\Temp\oigaytqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\axsqkausmk.sysC:\Temp\axsqkausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.sysC:\Temp\smkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcwupmhfzx.sysC:\Temp\hcwupmhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwrp.sysC:\Temp\wuomgezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljetolg.sysC:\Temp\ztrljetolg.sys1⤵
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\fdxvpnifaq.sysC:\Temp\fdxvpnifaq.sys1⤵
-
C:\Temp\ausmkfcxvp.sysC:\Temp\ausmkfcxvp.sys1⤵
-
C:\Temp\rpkhczusmk.sysC:\Temp\rpkhczusmk.sys1⤵
-
C:\Temp\mhezxrpjhb.sysC:\Temp\mhezxrpjhb.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
axsqkausmk.sys
dbvtnlfdyv.exe
dywqoigayt.sys
faxsqkicav.sys
i_dbvtnlfdyv.exe
i_mkecxupnhc.exe
i_omgeywrojg.exe
i_tqljdtnlgd.exe
i_ysqkidavsn.exe
i_ytrigbytql.exe
i_zxrpjhbzur.exe
jecwuomhez.sys
kfcxvpnhfa.exe
mkecxupnhc.exe
oigaytqlid.sys
omgeywrojg.exe
rmgeywqoby.sys
tqljdtnlgd.exe
ysqkidavsn.exe
ytrigbytql.exe
zwrojhbztr.sys
zxrpjhbzur.exe
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
suggestions[1].en-US
memory/636-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/764-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1104-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2260-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2340-96-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2536-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2564-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3184-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3712-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4136-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4152-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4592-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4608-84-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4676-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4756-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4944-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4964-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5092-119-0x0000000000010000-0x0000000000083000-memory.dmp