Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/08/2026, 11:18
General
- Target 2026-08-15_3a9836996f8c761bb789f86f1206b7c2_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260815-ner8jsvdld
- SHA256 7b7e70fde94b47507bd91f07acc0ce6b89bee8f2ddb6ab1e2a86fc663e2351fe
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_3a9836996f8c761bb789f86f1206b7c2_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3a9836996f8c761bb789f86f1206b7c2_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlfdxvic.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vtnlfdxvic.exeC:\Temp\vtnlfdxvic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlfdxvic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdxvic.exeC:\Temp\i_vtnlfdxvic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnifavsnk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vpnifavsnk.exeC:\Temp\vpnifavsnk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnifavsnk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifavsnk.exeC:\Temp\i_vpnifavsnk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxvpnhfax.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecxvpnhfax.exeC:\Temp\ecxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxvpnhfax.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecxvpnhfax.exeC:\Temp\i_ecxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwuomhe.exeC:\Temp\mkecwuomhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwuomhe.exeC:\Temp\i_mkecwuomhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgezwrojh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omgezwrojh.exeC:\Temp\omgezwrojh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgezwrojh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwrojh.exeC:\Temp\i_omgezwrojh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwrojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jebwrojgbz.exeC:\Temp\jebwrojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwrojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jebwrojgbz.exeC:\Temp\i_jebwrojgbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztolgeywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztolgeywqo.exeC:\Temp\ztolgeywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztolgeywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztolgeywqo.exeC:\Temp\i_ztolgeywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgdyvqoiga.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoiga.exeC:\Temp\lgdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgdyvqoiga.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgdyvqoiga.exeC:\Temp\i_lgdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysqlidav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidav.exeC:\Temp\gaysqlidav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysqlidav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqlidav.exeC:\Temp\i_gaysqlidav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkfcxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sqkfcxvpnh.exeC:\Temp\sqkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkfcxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sqkfcxvpnh.exeC:\Temp\i_sqkfcxvpnh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczusmkec.exe ups_run2⤵
-
C:\Temp\jhczusmkec.exeC:\Temp\jhczusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczusmkec.exe ups_ins2⤵
-
C:\Temp\i_jhczusmkec.exeC:\Temp\i_jhczusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmjecwuo.exe ups_run2⤵
-
C:\Temp\zurmjecwuo.exeC:\Temp\zurmjecwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmjecwuo.exe ups_ins2⤵
-
C:\Temp\i_zurmjecwuo.exeC:\Temp\i_zurmjecwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run2⤵
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins2⤵
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgaytqljdb.exe ups_run2⤵
-
C:\Temp\lgaytqljdb.exeC:\Temp\lgaytqljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgaytqljdb.exe ups_ins2⤵
-
C:\Temp\i_lgaytqljdb.exeC:\Temp\i_lgaytqljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run2⤵
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins2⤵
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\davtnlfdys.exe ups_run2⤵
-
C:\Temp\davtnlfdys.exeC:\Temp\davtnlfdys.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_davtnlfdys.exe ups_ins2⤵
-
C:\Temp\i_davtnlfdys.exeC:\Temp\i_davtnlfdys.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run2⤵
-
C:\Temp\usnkfcxvpn.exeC:\Temp\usnkfcxvpn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins2⤵
-
C:\Temp\i_usnkfcxvpn.exeC:\Temp\i_usnkfcxvpn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxspkhc.exe ups_run2⤵
-
C:\Temp\mhfzxspkhc.exeC:\Temp\mhfzxspkhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxspkhc.exe ups_ins2⤵
-
C:\Temp\i_mhfzxspkhc.exeC:\Temp\i_mhfzxspkhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.sysC:\Temp\pnhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.sysC:\Temp\xupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.sysC:\Temp\hezxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgbz.sysC:\Temp\geywrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysql.sysC:\Temp\vqnigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\fausnkfdxs.sysC:\Temp\fausnkfdxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupn.sysC:\Temp\usmkecxupn.sys1⤵
-
C:\Temp\rpkhcausmk.sysC:\Temp\rpkhcausmk.sys1⤵
-
C:\Temp\jezwrpjhbz.sysC:\Temp\jezwrpjhbz.sys1⤵
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
-
C:\Temp\trljdbwtol.sysC:\Temp\trljdbwtol.sys1⤵
-
C:\Temp\tqlidbvtnl.sysC:\Temp\tqlidbvtnl.sys1⤵
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ecxvpnhfax.exe
faxsqkicav.sys
geywrojgbz.sys
hezxrpjhcz.sys
i_ecxvpnhfax.exe
i_jebwrojgbz.exe
i_lgdyvqoiga.exe
i_mkecwuomhe.exe
i_omgezwrojh.exe
i_vpnifavsnk.exe
i_vtnlfdxvic.exe
i_ztolgeywqo.exe
jebwrojgbz.exe
lgdyvqoiga.exe
mkecwuomhe.exe
omgezwrojh.exe
pnhfzxspki.sys
tqljdbvtnl.sys
uomgezwrpj.sys
vpnifavsnk.exe
vtnlfdxvic.exe
xupmhfzxrp.sys
ztolgeywqo.exe
suggestions[1].en-US
memory/60-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/816-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/972-67-0x0000000000010000-0x0000000000083000-memory.dmp
memory/972-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1480-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2116-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2132-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2168-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2844-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3760-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4236-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4304-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4492-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4716-113-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4760-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4784-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4956-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4956-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4968-79-0x0000000000010000-0x0000000000083000-memory.dmp