Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/05/2026, 15:55
General
- Target 2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260524-tc4fpadt7z
- SHA256 01bbcf011dbaae8c7aae0161115811744e62a576ddda81bd89a17117c0ce5ee6
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdyvqniga.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqniga.exeC:\Temp\lfdyvqniga.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdyvqniga.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqniga.exeC:\Temp\i_lfdyvqniga.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkidav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faysqkidav.exeC:\Temp\faysqkidav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkidav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faysqkidav.exeC:\Temp\i_faysqkidav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkhcaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkhcaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupnhfzxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzxr.exeC:\Temp\cxupnhfzxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupnhfzxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhfzxr.exeC:\Temp\i_cxupnhfzxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkecjecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\usmkecjecw.exeC:\Temp\usmkecjecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkecjecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecjecw.exeC:\Temp\i_usmkecjecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomhez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.exeC:\Temp\jecwuomhez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomhez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomhez.exeC:\Temp\i_jecwuomhez.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgeztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeztr.exeC:\Temp\bwuomgeztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgeztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeztr.exeC:\Temp\i_bwuomgeztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgdyw.exeC:\Temp\dbvtolgdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgdyw.exeC:\Temp\i_dbvtolgdyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dytqlidbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dytqlidbvt.exeC:\Temp\dytqlidbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dytqlidbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dytqlidbvt.exeC:\Temp\i_dytqlidbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run2⤵
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins2⤵
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run2⤵
-
C:\Temp\avsnkfdxvp.exeC:\Temp\avsnkfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins2⤵
-
C:\Temp\i_avsnkfdxvp.exeC:\Temp\i_avsnkfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run2⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins2⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupmhfzxr.exe ups_run2⤵
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupmhfzxr.exe ups_ins2⤵
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run2⤵
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins2⤵
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run2⤵
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins2⤵
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run2⤵
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins2⤵
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run2⤵
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins2⤵
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.sysC:\Temp\wqoigaytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkic.sysC:\Temp\nifaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpnh.sysC:\Temp\snkfdxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhczu.sysC:\Temp\fzxrpkhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjebwuom.sysC:\Temp\trmjebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztomg.sysC:\Temp\rojhbztomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
-
C:\Temp\qkicavsnkf.sysC:\Temp\qkicavsnkf.sys1⤵
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
-
C:\Temp\rmjecwuomh.sysC:\Temp\rmjecwuomh.sys1⤵
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
-
C:\Temp\tqljdbnlfd.sysC:\Temp\tqljdbnlfd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
cxupnhfzxr.exe
dbvtolgeyw.exe
faysqkidav.exe
fzxrpkhczu.sys
i_cxupnhfzxr.exe
i_dbvtolgeyw.exe
i_faysqkidav.exe
i_jecwuomhez.exe
i_lfdyvqniga.exe
i_olgdywqoig.exe
i_usmkecjecw.exe
i_zxspkhcaus.exe
jecwuomhez.exe
lfdyvqniga.exe
nhfaxspkic.sys
nifaxsqkic.sys
olgdywqoig.exe
snkfdxvpnh.sys
trmjebwuom.sys
usmkecjecw.exe
wqoigaytql.sys
ytrljdbvto.sys
zxspkhcaus.exe
suggestions[1].en-US
memory/60-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1076-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1996-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2092-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2120-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2144-79-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2188-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2212-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2276-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2912-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3016-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3912-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4148-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4168-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4232-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4304-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5244-106-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5412-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5848-102-0x0000000000010000-0x0000000000083000-memory.dmp