Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 17:13
General
- Target 2026-08-09_1069a8c1ce97692956a4d3d9f8e41bb6_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260809-vrf5dasejg
- SHA256 f001bf87715870464b516c583d595194fe24a8f042769f514065c78e9fe3fbd6
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1069a8c1ce97692956a4d3d9f8e41bb6_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1069a8c1ce97692956a4d3d9f8e41bb6_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3268 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywqoj.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\tolgeywqoj.exeC:\Temp\tolgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoj.exeC:\Temp\i_tolgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gdytnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gdytnlfdyv.exeC:\Temp\gdytnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gdytnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gdytnlfdyv.exeC:\Temp\i_gdytnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.exeC:\Temp\kicavsnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kicavsnlfd.exeC:\Temp\i_kicavsnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.exeC:\Temp\zxspkicaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkicaus.exeC:\Temp\i_zxspkicaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_khcausmkec.exeC:\Temp\i_khcausmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhbzurm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhbzurm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jezwrpjhbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jezwrpjhbz.exeC:\Temp\jezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jezwrpjhbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jezwrpjhbz.exeC:\Temp\i_jezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqlidbvtn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytqlidbvtn.exeC:\Temp\ytqlidbvtn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqlidbvtn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytqlidbvtn.exeC:\Temp\i_ytqlidbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run2⤵
-
C:\Temp\faysqkicav.exeC:\Temp\faysqkicav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins2⤵
-
C:\Temp\i_faysqkicav.exeC:\Temp\i_faysqkicav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run2⤵
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins2⤵
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run2⤵
-
C:\Temp\nhfzxrpkhc.exeC:\Temp\nhfzxrpkhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins2⤵
-
C:\Temp\i_nhfzxrpkhc.exeC:\Temp\i_nhfzxrpkhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run2⤵
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins2⤵
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomhez.exe ups_run2⤵
-
C:\Temp\jecwuomhez.exeC:\Temp\jecwuomhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomhez.exe ups_ins2⤵
-
C:\Temp\i_jecwuomhez.exeC:\Temp\i_jecwuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuojdbwto.exe ups_run2⤵
-
C:\Temp\bwuojdbwto.exeC:\Temp\bwuojdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuojdbwto.exe ups_ins2⤵
-
C:\Temp\i_bwuojdbwto.exeC:\Temp\i_bwuojdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run2⤵
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins2⤵
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qlidbvtnlf.exe ups_run2⤵
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qlidbvtnlf.exe ups_ins2⤵
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run2⤵
-
C:\Temp\igaysqkida.exeC:\Temp\igaysqkida.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins2⤵
-
C:\Temp\i_igaysqkida.exeC:\Temp\i_igaysqkida.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ytqljdbvto.sysC:\Temp\ytqljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoiga.sysC:\Temp\lgdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqk.sysC:\Temp\vqnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.sysC:\Temp\causmkfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhezxrpjh.sysC:\Temp\pmhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtolgeywq.sysC:\Temp\bwtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tojgbytrlj.sysC:\Temp\tojgbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
-
C:\Temp\fausnkfcxv.sysC:\Temp\fausnkfcxv.sys1⤵
-
C:\Temp\zusmkecxup.sysC:\Temp\zusmkecxup.sys1⤵
-
C:\Temp\rpjhbzurmk.sysC:\Temp\rpjhbzurmk.sys1⤵
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
-
C:\Temp\jgbytrljeb.sysC:\Temp\jgbytrljeb.sys1⤵
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
-
C:\Temp\tnlfdyvqni.sysC:\Temp\tnlfdyvqni.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqlidbvt.exe
causmkfcxu.sys
gdytnlfdyv.exe
i_aysqlidbvt.exe
i_gdytnlfdyv.exe
i_jezwrpjhbz.exe
i_khcausmkec.exe
i_kicavsnlfd.exe
i_tolgeywqoj.exe
i_xrpjhbzurm.exe
i_zxspkicaus.exe
jezwrpjhbz.exe
kfcxvpnhfz.sys
khcausmkec.exe
kicavsnlfd.exe
lgdyvqoiga.sys
pmhezxrpjh.sys
rpjhbztrmj.sys
tolgeywqoj.exe
vqnifaysqk.sys
xrpjhbzurm.exe
ytqljdbvto.sys
zxspkicaus.exe
suggestions[1].en-US
memory/588-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/700-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/844-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1128-118-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1796-114-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1860-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1920-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2264-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2324-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2620-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2992-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3084-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3252-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3348-88-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3392-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3980-103-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4440-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4564-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4696-14-0x0000000000010000-0x0000000000083000-memory.dmp