Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 23:58
General
- Target 2026-08-05_a7867b1dd29ed5bdaf38fed9f54a120c_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260805-31ftzayeph
- SHA256 3c9473e0928c0403a792faaeb1b04094f7a89e1b5c97a969befbe19d563766cd
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_a7867b1dd29ed5bdaf38fed9f54a120c_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_a7867b1dd29ed5bdaf38fed9f54a120c_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecxrp.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zusmkecxrp.exeC:\Temp\zusmkecxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecxrp.exeC:\Temp\i_zusmkecxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgezojhbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omgezojhbz.exeC:\Temp\omgezojhbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgezojhbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omgezojhbz.exeC:\Temp\i_omgezojhbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigbvtolge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigbvtolge.exeC:\Temp\oigbvtolge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigbvtolge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigbvtolge.exeC:\Temp\i_oigbvtolge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqlidavt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqlidavt.exeC:\Temp\aysqlidavt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqlidavt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidavt.exeC:\Temp\i_aysqlidavt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sicavsnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sicavsnlfd.exeC:\Temp\sicavsnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sicavsnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sicavsnlfd.exeC:\Temp\i_sicavsnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkhcxupn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xspkhcxupn.exeC:\Temp\xspkhcxupn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkhcxupn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhcxupn.exeC:\Temp\i_xspkhcxupn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecxupmhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecxupmhf.exeC:\Temp\mkecxupmhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecxupmhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupmhf.exeC:\Temp\i_mkecxupmhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\secwuomhez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\secwuomhez.exeC:\Temp\secwuomhez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_secwuomhez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_secwuomhez.exeC:\Temp\i_secwuomhez.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbzuomgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbzuomgey.exeC:\Temp\jhbzuomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbzuomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbzuomgey.exeC:\Temp\i_jhbzuomgey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run2⤵
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins2⤵
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run2⤵
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins2⤵
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlavtnlfay.exe ups_run2⤵
-
C:\Temp\qlavtnlfay.exeC:\Temp\qlavtnlfay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlavtnlfay.exe ups_ins2⤵
-
C:\Temp\i_qlavtnlfay.exeC:\Temp\i_qlavtnlfay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkidav.exe ups_run2⤵
-
C:\Temp\faysqkidav.exeC:\Temp\faysqkidav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkidav.exe ups_ins2⤵
-
C:\Temp\i_faysqkidav.exeC:\Temp\i_faysqkidav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsqkfcxspn.exe ups_run2⤵
-
C:\Temp\xsqkfcxspn.exeC:\Temp\xsqkfcxspn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsqkfcxspn.exe ups_ins2⤵
-
C:\Temp\i_xsqkfcxspn.exeC:\Temp\i_xsqkfcxspn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mherpjhczu.exe ups_run2⤵
-
C:\Temp\mherpjhczu.exeC:\Temp\mherpjhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mherpjhczu.exe ups_ins2⤵
-
C:\Temp\i_mherpjhczu.exeC:\Temp\i_mherpjhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run2⤵
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins2⤵
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljebwtomg.exe ups_run2⤵
-
C:\Temp\rljebwtomg.exeC:\Temp\rljebwtomg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljebwtomg.exe ups_ins2⤵
-
C:\Temp\i_rljebwtomg.exeC:\Temp\i_rljebwtomg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdtnlgd.sysC:\Temp\tqljdtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\snifaxsqki.sysC:\Temp\snifaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausnkfdx.sysC:\Temp\icausnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\camkecwupm.sysC:\Temp\camkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtolge.sysC:\Temp\ljdbwtolge.sys1⤵
-
C:\Temp\jdbwlgeywq.sysC:\Temp\jdbwlgeywq.sys1⤵
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
-
C:\Temp\nlfdxvqnig.sysC:\Temp\nlfdxvqnig.sys1⤵
-
C:\Temp\fcxvpnifzx.sysC:\Temp\fcxvpnifzx.sys1⤵
-
C:\Temp\causmcxupn.sysC:\Temp\causmcxupn.sys1⤵
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
-
C:\Temp\ezwrojhbzt.sysC:\Temp\ezwrojhbzt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqlidavt.exe
gaysqlidbv.sys
i_aysqlidavt.exe
i_icausnkfdx.exe
i_oigbvtolge.exe
i_omgezojhbz.exe
i_sicavsnlfd.exe
i_ywqojgbztr.exe
i_zusmkecxrp.exe
icausnkfdx.exe
icausnkfdx.sys
jhbztrljeb.sys
oigbvtolge.exe
omgezojhbz.exe
sicavsnlfd.exe
snifaxsqki.sys
tqljdtnlgd.sys
xspkhcxupn.exe
ytrljdbwto.sys
ywqojgbztr.exe
zusmkecxrp.exe
zxrpjhbzur.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/1576-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1656-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2456-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2652-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2900-53-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3480-84-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3756-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3808-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4160-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4332-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4344-164-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4388-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4452-96-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4476-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4476-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4560-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4576-112-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4576-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4600-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4768-72-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4984-131-0x0000000000010000-0x0000000000083000-memory.dmp