Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/08/2026, 22:53
General
- Target 2026-08-11_424bbafce9d17441be71ffb5742e773d_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260811-2vcppaem6y
- SHA256 7eaa0f4457bfcd77d0921b1abc862ca495411b7b98f1d95dabd13b5f2138a799
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_424bbafce9d17441be71ffb5742e773d_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_424bbafce9d17441be71ffb5742e773d_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfaxsqkica.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\kfaxsqkica.exeC:\Temp\kfaxsqkica.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfaxsqkica.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfaxsqkica.exeC:\Temp\i_kfaxsqkica.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\spkhcausmk.exeC:\Temp\spkhcausmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_spkhcausmk.exeC:\Temp\i_spkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czurmkecwr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\czurmkecwr.exeC:\Temp\czurmkecwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czurmkecwr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_czurmkecwr.exeC:\Temp\i_czurmkecwr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\toigbytrlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\toigbytrlj.exeC:\Temp\toigbytrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_toigbytrlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_toigbytrlj.exeC:\Temp\i_toigbytrlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnifaysqki.exeC:\Temp\pnifaysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaysqki.exeC:\Temp\i_pnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kshfzxrpjc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kshfzxrpjc.exeC:\Temp\kshfzxrpjc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kshfzxrpjc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kshfzxrpjc.exeC:\Temp\i_kshfzxrpjc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run2⤵
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins2⤵
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wjhbztrmge.exe ups_run2⤵
-
C:\Temp\wjhbztrmge.exeC:\Temp\wjhbztrmge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wjhbztrmge.exe ups_ins2⤵
-
C:\Temp\i_wjhbztrmge.exeC:\Temp\i_wjhbztrmge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run2⤵
-
C:\Temp\omgeywqojg.exeC:\Temp\omgeywqojg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins2⤵
-
C:\Temp\i_omgeywqojg.exeC:\Temp\i_omgeywqojg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtolgdy.exe ups_run2⤵
-
C:\Temp\jdbvtolgdy.exeC:\Temp\jdbvtolgdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtolgdy.exe ups_ins2⤵
-
C:\Temp\i_jdbvtolgdy.exeC:\Temp\i_jdbvtolgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run2⤵
-
C:\Temp\avtnlfdyvq.exeC:\Temp\avtnlfdyvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins2⤵
-
C:\Temp\i_avtnlfdyvq.exeC:\Temp\i_avtnlfdyvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\davtndxvpn.exe ups_run2⤵
-
C:\Temp\davtndxvpn.exeC:\Temp\davtndxvpn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_davtndxvpn.exe ups_ins2⤵
-
C:\Temp\i_davtndxvpn.exeC:\Temp\i_davtndxvpn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\spkicausnk.exe ups_run2⤵
-
C:\Temp\spkicausnk.exeC:\Temp\spkicausnk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_spkicausnk.exe ups_ins2⤵
-
C:\Temp\i_spkicausnk.exeC:\Temp\i_spkicausnk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhczusmkec.exe ups_run2⤵
-
C:\Temp\nhczusmkec.exeC:\Temp\nhczusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhczusmkec.exe ups_ins2⤵
-
C:\Temp\i_nhczusmkec.exeC:\Temp\i_nhczusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run2⤵
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins2⤵
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\fausmkecxu.sysC:\Temp\fausmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.sysC:\Temp\cwuomhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebwuomge.sysC:\Temp\mjebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvq.sysC:\Temp\avsnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.sysC:\Temp\vpnhfaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.sysC:\Temp\usmkecxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkeuomhezx.sysC:\Temp\pkeuomhezx.sys1⤵
-
C:\Temp\ecwuomgezw.sysC:\Temp\ecwuomgezw.sys1⤵
-
C:\Temp\ztrljebwto.sysC:\Temp\ztrljebwto.sys1⤵
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
-
C:\Temp\qoigaykida.sysC:\Temp\qoigaykida.sys1⤵
-
C:\Temp\oigaysqlid.sysC:\Temp\oigaysqlid.sys1⤵
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
-
C:\Temp\xspkhcauke.sysC:\Temp\xspkhcauke.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bvtnlgdywq.exe
bztrljdbwt.sys
cwuomhezxr.sys
czurmkecwr.exe
ezwrpjhbzt.exe
fausmkecxu.sys
i_bvtnlgdywq.exe
i_czurmkecwr.exe
i_ezwrpjhbzt.exe
i_jhbztrmjec.exe
i_kfaxsqkica.exe
i_spkhcausmk.exe
i_tnlfdxvqni.exe
i_toigbytrlj.exe
igaytqljdb.sys
igbytqljdb.sys
jhbztrmjec.exe
kfaxsqkica.exe
mjebwuomge.sys
mkecxupnhf.sys
spkhcausmk.exe
tnlfdxvqni.exe
toigbytrlj.exe
suggestions[1].en-US
memory/568-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/632-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/988-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1216-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1448-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1776-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2140-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3204-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3304-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3332-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3796-88-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4112-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4196-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4604-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4664-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4772-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4948-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5008-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5088-106-0x0000000000010000-0x0000000000083000-memory.dmp