Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 12:39
General
- Target 2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260816-pvw24syscs
- SHA256 b5ea1b5bb8f73d965ee9348ee77d195272bd341ca3992777322e0fc9c364bee1
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5012 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trmgeywroj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trmgeywroj.exeC:\Temp\trmgeywroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trmgeywroj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trmgeywroj.exeC:\Temp\i_trmgeywroj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtolgdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtolgdy.exeC:\Temp\idbvtolgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtolgdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtolgdy.exeC:\Temp\i_idbvtolgdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlgdytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdytql.exeC:\Temp\vtnlgdytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlgdytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdytql.exeC:\Temp\i_vtnlgdytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avpnhfaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avpnhfaxsq.exeC:\Temp\avpnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avpnhfaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avpnhfaxsq.exeC:\Temp\i_avpnhfaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kezxrpjhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kezxrpjhcz.exeC:\Temp\kezxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kezxrpjhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kezxrpjhcz.exeC:\Temp\i_kezxrpjhcz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.exeC:\Temp\kecwuomhez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecwuomhez.exeC:\Temp\i_kecwuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run2⤵
-
C:\Temp\oigbytrljd.exeC:\Temp\oigbytrljd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins2⤵
-
C:\Temp\i_oigbytrljd.exeC:\Temp\i_oigbytrljd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run2⤵
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins2⤵
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysqlidav.exe ups_run2⤵
-
C:\Temp\gaysqlidav.exeC:\Temp\gaysqlidav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysqlidav.exe ups_ins2⤵
-
C:\Temp\i_gaysqlidav.exeC:\Temp\i_gaysqlidav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnlfdxvq.exe ups_run2⤵
-
C:\Temp\avsnlfdxvq.exeC:\Temp\avsnlfdxvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnlfdxvq.exe ups_ins2⤵
-
C:\Temp\i_avsnlfdxvq.exeC:\Temp\i_avsnlfdxvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run2⤵
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins2⤵
-
C:\Temp\i_snkfdxvpnh.exeC:\Temp\i_snkfdxvpnh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run2⤵
-
C:\Temp\kecxupnhfz.exeC:\Temp\kecxupnhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins2⤵
-
C:\Temp\i_kecxupnhfz.exeC:\Temp\i_kecxupnhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbzuo.exe ups_run2⤵
-
C:\Temp\zwrpjhbzuo.exeC:\Temp\zwrpjhbzuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbzuo.exe ups_ins2⤵
-
C:\Temp\i_zwrpjhbzuo.exeC:\Temp\i_zwrpjhbzuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezwrpjh.sysC:\Temp\omhezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaytqljd.sysC:\Temp\oigaytqljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlgdyvq.sysC:\Temp\avtnlgdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.sysC:\Temp\ausmkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.sysC:\Temp\zxspkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
-
C:\Temp\ywqoigbytq.sysC:\Temp\ywqoigbytq.sys1⤵
-
C:\Temp\qlfdyvqoig.sysC:\Temp\qlfdyvqoig.sys1⤵
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
-
C:\Temp\axsqkicaus.sysC:\Temp\axsqkicaus.sys1⤵
-
C:\Temp\rpkhcausmk.sysC:\Temp\rpkhcausmk.sys1⤵
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avpnhfaxsq.exe
avtnlgdyvq.sys
causmkecxu.exe
eywrojhbzt.sys
fzxrpjhczu.sys
hbzurmkecw.exe
i_causmkecxu.exe
i_hbzurmkecw.exe
i_idbvtolgdy.exe
i_mkecwupmhe.exe
i_qkidavtnlf.exe
i_trmgeywroj.exe
i_vtnlgdytql.exe
idbvtolgdy.exe
ifaysqkica.sys
mkecwupmhe.exe
oigaytqljd.sys
omhezwrpjh.sys
qkidavtnlf.exe
trljdbwtom.sys
trmgeywroj.exe
vtnlgdytql.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/632-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/652-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/652-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1124-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1340-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1424-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1832-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2004-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2180-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2376-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2600-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2780-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2932-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3208-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3940-120-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4060-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4636-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4864-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4908-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5028-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5028-103-0x0000000000010000-0x0000000000083000-memory.dmp