Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 03:58
General
- Target 2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260629-ejzzhsdy5j
- SHA256 0b75cb31d0cd4df552c80342f636e28f07446d2c3438b23ca19c8cec09d379cb
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 63 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4004 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupnhfzxs.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\cxupnhfzxs.exeC:\Temp\cxupnhfzxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupnhfzxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhfzxs.exeC:\Temp\i_cxupnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhbzurmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhbzurmkec.exeC:\Temp\mhbzurmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhbzurmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhbzurmkec.exeC:\Temp\i_mhbzurmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwtoeywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbwtoeywqo.exeC:\Temp\dbwtoeywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwtoeywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtoeywqo.exeC:\Temp\i_dbwtoeywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqlidbvtn.exeC:\Temp\ysqlidbvtn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqlidbvtn.exeC:\Temp\i_ysqlidbvtn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnifaxsqk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnifaxsqk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfzxsp.exeC:\Temp\xvpnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfzxsp.exeC:\Temp\i_xvpnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xupmhfzxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xupmhfzxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgezwroj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomgezwroj.exeC:\Temp\uomgezwroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgezwroj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwroj.exeC:\Temp\i_uomgezwroj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrojhbztr.exe ups_run2⤵
-
C:\Temp\zwrojhbztr.exeC:\Temp\zwrojhbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrojhbztr.exe ups_ins2⤵
-
C:\Temp\i_zwrojhbztr.exeC:\Temp\i_zwrojhbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run2⤵
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins2⤵
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run2⤵
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins2⤵
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnifays.exe ups_run2⤵
-
C:\Temp\dxvqnifays.exeC:\Temp\dxvqnifays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnifays.exe ups_ins2⤵
-
C:\Temp\i_dxvqnifays.exeC:\Temp\i_dxvqnifays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnhfaxs.exe ups_run2⤵
-
C:\Temp\dxvpnhfaxs.exeC:\Temp\dxvpnhfaxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins2⤵
-
C:\Temp\i_dxvpnhfaxs.exeC:\Temp\i_dxvpnhfaxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run2⤵
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins2⤵
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run2⤵
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins2⤵
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmjebwuomg.exe ups_run2⤵
-
C:\Temp\rmjebwuomg.exeC:\Temp\rmjebwuomg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmjebwuomg.exe ups_ins2⤵
-
C:\Temp\i_rmjebwuomg.exeC:\Temp\i_rmjebwuomg.exe ups_ins3⤵
-
-
-
C:\Temp\uomhezxrpj.sysC:\Temp\uomhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezojhb.sysC:\Temp\uomgezojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhbztrlje.sysC:\Temp\ojhbztrlje.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnkfdx.sysC:\Temp\icavsnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfzx.sysC:\Temp\ecxupnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhezx.sysC:\Temp\ecwupmhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.sysC:\Temp\jecwuomgez.sys1⤵
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
-
C:\Temp\dbvtolgdyw.sysC:\Temp\dbvtolgdyw.sys1⤵
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
-
C:\Temp\kicavsnkfd.sysC:\Temp\kicavsnkfd.sys1⤵
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
-
C:\Temp\zwrpjhbztr.sysC:\Temp\zwrpjhbztr.sys1⤵
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
cxupnhfzxs.exe
dbwtoeywqo.exe
eywqoigbyt.exe
ezwrpjhbzt.exe
gdywqoigay.sys
i_cxupnhfzxs.exe
i_dbwtoeywqo.exe
i_eywqoigbyt.exe
i_ezwrpjhbzt.exe
i_mhbzurmkec.exe
i_vpnifaxsqk.exe
i_ysqlidbvtn.exe
icavsnkfdx.sys
kidavtnlfd.sys
lgdywqoiga.sys
mhbzurmkec.exe
ojhbztrlje.sys
uomgezojhb.sys
uomhezxrpj.sys
vpnifaxsqk.exe
xvpnhfaxsq.exe
ysqlidbvtn.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
favicon[2].ico
Kno972A.tmp
memory/636-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/924-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1500-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1528-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1576-182-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2204-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2456-190-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2472-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2752-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3720-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4056-171-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4168-116-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4184-186-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4196-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4236-194-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4336-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4512-167-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4572-53-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4976-178-0x0000000000010000-0x0000000000083000-memory.dmp