Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/07/2026, 01:28
General
- Target 2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260707-bvtp4act5j
- SHA256 e183b0d40e19d29e16696e7ee47e4ec70e51f9b13a9cea106ce0c9b1a0f53b1f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxspkfcxu.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxspkfcxu.exeC:\Temp\fzxspkfcxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxspkfcxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkfcxu.exeC:\Temp\i_fzxspkfcxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwuomgezoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezoj.exeC:\Temp\cwuomgezoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwuomgezoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomgezoj.exeC:\Temp\i_cwuomgezoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlfdxvifay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qlfdxvifay.exeC:\Temp\qlfdxvifay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlfdxvifay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qlfdxvifay.exeC:\Temp\i_qlfdxvifay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnicaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dxvpnicaus.exeC:\Temp\dxvpnicaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnicaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnicaus.exeC:\Temp\i_dxvpnicaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzxspk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxspk.exeC:\Temp\upnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzxspk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxspk.exeC:\Temp\i_upnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupezw.exeC:\Temp\mkecwupezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupezw.exeC:\Temp\i_mkecwupezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run2⤵
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins2⤵
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljeytrlj.exe ups_run2⤵
-
C:\Temp\trljeytrlj.exeC:\Temp\trljeytrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljeytrlj.exe ups_ins2⤵
-
C:\Temp\i_trljeytrlj.exeC:\Temp\i_trljeytrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run2⤵
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins2⤵
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idavtnlxvq.exe ups_run2⤵
-
C:\Temp\idavtnlxvq.exeC:\Temp\idavtnlxvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idavtnlxvq.exe ups_ins2⤵
-
C:\Temp\i_idavtnlxvq.exeC:\Temp\i_idavtnlxvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnifays.exe ups_run2⤵
-
C:\Temp\dxvqnifays.exeC:\Temp\dxvqnifays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnifays.exe ups_ins2⤵
-
C:\Temp\i_dxvqnifays.exeC:\Temp\i_dxvqnifays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run2⤵
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins2⤵
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhczusmk.exe ups_run2⤵
-
C:\Temp\rpkhczusmk.exeC:\Temp\rpkhczusmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhczusmk.exe ups_ins2⤵
-
C:\Temp\i_rpkhczusmk.exeC:\Temp\i_rpkhczusmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wupmhfzxrp.exe ups_run2⤵
-
C:\Temp\wupmhfzxrp.exeC:\Temp\wupmhfzxrp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wupmhfzxrp.exe ups_ins2⤵
-
C:\Temp\i_wupmhfzxrp.exeC:\Temp\i_wupmhfzxrp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezwrpj.exe ups_run2⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezwrpj.exe ups_ins2⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhbzurmjec.sysC:\Temp\mhbzurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.sysC:\Temp\cwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigsq.sysC:\Temp\gdywqoigsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzpj.sysC:\Temp\cxupnhfzpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmje.sysC:\Temp\pjhbzurmje.sys1⤵
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
-
C:\Temp\bwtolgeywi.sysC:\Temp\bwtolgeywi.sys1⤵
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
-
C:\Temp\icavsnkfdx.sysC:\Temp\icavsnkfdx.sys1⤵
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
-
C:\Temp\hcausmkecx.sysC:\Temp\hcausmkecx.sys1⤵
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausmkecxup.sys
cwuomgezoj.exe
cwuomgezwr.sys
dxvpnicaus.exe
dywqoigayt.exe
fzxspkfcxu.exe
gdywqoigsq.sys
hbzurmkecw.exe
i_cwuomgezoj.exe
i_dywqoigayt.exe
i_fzxspkfcxu.exe
i_hbzurmkecw.exe
i_qlfdxvifay.exe
i_qlidbvtnlg.exe
i_rojhbztrlj.exe
kicavsnlfd.sys
mhbzurmjec.sys
ojgbytrljd.sys
qlfdxvifay.exe
qlidbvtnlg.exe
rojhbztrlj.exe
yvqoigaysq.sys
8A7891822FCFF127E4EADADE9757112B
8A7891822FCFF127E4EADADE9757112B
suggestions[1].en-US
memory/8-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/452-89-0x0000000000010000-0x0000000000083000-memory.dmp
memory/900-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/900-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/928-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1068-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1808-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2176-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2288-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2880-31-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3068-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3232-142-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3232-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3312-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3332-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3444-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3476-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4284-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4580-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4616-101-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5008-146-0x0000000000010000-0x0000000000083000-memory.dmp