Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 14:20
General
- Target 2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260727-rnfsnavbkf
- SHA256 057b65c3ad15f77f91be12cd9e55e81c022451f43927fd37988ef61adff4f3d3
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrmjeyw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbztrmjeyw.exeC:\Temp\gbztrmjeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrmjeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrmjeyw.exeC:\Temp\i_gbztrmjeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtolgeywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.exeC:\Temp\bvtolgeywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtolgeywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgeywq.exeC:\Temp\i_bvtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaysqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.exeC:\Temp\igaysqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaysqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlidb.exeC:\Temp\i_igaysqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavsn.exeC:\Temp\ysqkidavsn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavsn.exeC:\Temp\i_ysqkidavsn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkfcxvpnhf.exeC:\Temp\mkfcxvpnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkfcxvpnhf.exeC:\Temp\i_mkfcxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczup.exeC:\Temp\zxrpjhczup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczup.exeC:\Temp\i_zxrpjhczup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusjhbzurm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusjhbzurm.exeC:\Temp\zusjhbzurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusjhbzurm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusjhbzurm.exeC:\Temp\i_zusjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbwqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbwqo.exeC:\Temp\ywqojgbwqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbwqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgbwqo.exeC:\Temp\i_ywqojgbwqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaytqlg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlg.exeC:\Temp\qoigaytqlg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaytqlg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqlg.exeC:\Temp\i_qoigaytqlg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run2⤵
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins2⤵
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run2⤵
-
C:\Temp\lfdxvqniga.exeC:\Temp\lfdxvqniga.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins2⤵
-
C:\Temp\i_lfdxvqniga.exeC:\Temp\i_lfdxvqniga.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run2⤵
-
C:\Temp\xvpnhfzxsp.exeC:\Temp\xvpnhfzxsp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins2⤵
-
C:\Temp\i_xvpnhfzxsp.exeC:\Temp\i_xvpnhfzxsp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run2⤵
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins2⤵
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run2⤵
-
C:\Temp\upnhfzxrpk.exeC:\Temp\upnhfzxrpk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins2⤵
-
C:\Temp\i_upnhfzxrpk.exeC:\Temp\i_upnhfzxrpk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbzurmjecw.exe ups_run2⤵
-
C:\Temp\hbzurmjecw.exeC:\Temp\hbzurmjecw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbzurmjecw.exe ups_ins2⤵
-
C:\Temp\i_hbzurmjecw.exeC:\Temp\i_hbzurmjecw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljebwuom.exe ups_run2⤵
-
C:\Temp\trljebwuom.exeC:\Temp\trljebwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljebwuom.exe ups_ins2⤵
-
C:\Temp\i_trljebwuom.exeC:\Temp\i_trljebwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbvto.exe ups_run2⤵
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrljdbvto.exe ups_ins2⤵
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aytqljdbnl.exe ups_run2⤵
-
C:\Temp\aytqljdbnl.exeC:\Temp\aytqljdbnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aytqljdbnl.exe ups_ins2⤵
-
C:\Temp\i_aytqljdbnl.exeC:\Temp\i_aytqljdbnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdywq.sysC:\Temp\bvtolgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxupnh.sysC:\Temp\smkfcxupnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjecwuom.sysC:\Temp\trmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwqoigaytq.sysC:\Temp\bwqoigaytq.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\icausnkfdx.sysC:\Temp\icausnkfdx.sys1⤵
-
C:\Temp\kfdxvpnhfa.sysC:\Temp\kfdxvpnhfa.sys1⤵
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
-
C:\Temp\eywqojgbzt.sysC:\Temp\eywqojgbzt.sys1⤵
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtolgdywq.sys
bvtolgeywq.exe
faxsqkicav.sys
gbztrmjeyw.exe
hbzurmkecw.sys
i_bvtolgeywq.exe
i_gbztrmjeyw.exe
i_igaysqlidb.exe
i_igaytqljdb.exe
i_mkfcxvpnhf.exe
i_ysqkidavsn.exe
i_zusjhbzurm.exe
i_zxrpjhczup.exe
igaysqlidb.exe
igaytqljdb.exe
lgeywqojgb.sys
mkfcxvpnhf.exe
qnigaysqki.sys
smkfcxupnh.sys
xsqkicausn.sys
ysqkidavsn.exe
zusjhbzurm.exe
zxrpjhczup.exe
suggestions[1].en-US
CP.exe
memory/412-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/760-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/964-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1484-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1572-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1600-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2716-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2744-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2892-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3176-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3240-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3264-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3508-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3604-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3776-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4136-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4616-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5020-113-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5088-79-0x0000000000010000-0x0000000000083000-memory.dmp