Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 13:21
General
- Target 2026-09-30_1dbf2f3f7c8f68eeed5d7825a8dd5490_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260930-ql2rns1ejh
- SHA256 7875bfd5a5ec1196789d230359b1ad1c2e2ef4d7a65dc46322d0f3a13bdd0568
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_1dbf2f3f7c8f68eeed5d7825a8dd5490_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_1dbf2f3f7c8f68eeed5d7825a8dd5490_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:412 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnifaxsqk.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnifaxsqk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxrpjhczur.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxrpjhczur.exeC:\Temp\cxrpjhczur.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxrpjhczur.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxrpjhczur.exeC:\Temp\i_cxrpjhczur.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhbzurm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhbzurm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgcw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgcw.exeC:\Temp\jecwuomgcw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgcw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgcw.exeC:\Temp\i_jecwuomgcw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.exeC:\Temp\rljdbvtolg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtolg.exeC:\Temp\i_rljdbvtolg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqoigaytql.exeC:\Temp\vqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaytql.exeC:\Temp\i_vqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icaupnhfax.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\icaupnhfax.exeC:\Temp\icaupnhfax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icaupnhfax.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icaupnhfax.exeC:\Temp\i_icaupnhfax.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcar.exe ups_run2⤵
-
C:\Temp\fzxrpkhcar.exeC:\Temp\fzxrpkhcar.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcar.exe ups_ins2⤵
-
C:\Temp\i_fzxrpkhcar.exeC:\Temp\i_fzxrpkhcar.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrmhbztrmj.exe ups_run2⤵
-
C:\Temp\wrmhbztrmj.exeC:\Temp\wrmhbztrmj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrmhbztrmj.exe ups_ins2⤵
-
C:\Temp\i_wrmhbztrmj.exeC:\Temp\i_wrmhbztrmj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrljeb.exe ups_run2⤵
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrljeb.exe ups_ins2⤵
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run2⤵
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins2⤵
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run2⤵
-
C:\Temp\bytqljdbvt.exeC:\Temp\bytqljdbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins2⤵
-
C:\Temp\i_bytqljdbvt.exeC:\Temp\i_bytqljdbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run2⤵
-
C:\Temp\tnlfdyvqni.exeC:\Temp\tnlfdyvqni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdyvqni.exe ups_ins2⤵
-
C:\Temp\i_tnlfdyvqni.exeC:\Temp\i_tnlfdyvqni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfaxsqkica.exe ups_run2⤵
-
C:\Temp\kfaxsqkica.exeC:\Temp\kfaxsqkica.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfaxsqkica.exe ups_ins2⤵
-
C:\Temp\i_kfaxsqkica.exeC:\Temp\i_kfaxsqkica.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run2⤵
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins2⤵
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxrpkhczus.exe ups_run2⤵
-
C:\Temp\cxrpkhczus.exeC:\Temp\cxrpkhczus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxrpkhczus.exe ups_ins2⤵
-
C:\Temp\i_cxrpkhczus.exeC:\Temp\i_cxrpkhczus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\fdxvpnhfax.sysC:\Temp\fdxvpnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcwupmhezx.sysC:\Temp\hcwupmhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqkidavtnl.sysC:\Temp\vqkidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnifaxsqki.sysC:\Temp\pnifaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.sysC:\Temp\smkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.sysC:\Temp\mhfzxrpjhc.sys1⤵
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
-
C:\Temp\tomgeywroj.sysC:\Temp\tomgeywroj.sys1⤵
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
-
C:\Temp\igaytqlidb.sysC:\Temp\igaytqlidb.sys1⤵
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bytrljdbwt.sys
cxrpjhczur.exe
dyvqoigays.sys
fdxvpnhfax.sys
hcwupmhezx.sys
i_cxrpjhczur.exe
i_jecwuomgcw.exe
i_rljdbvtolg.exe
i_usmkfcxvpn.exe
i_vpnifaxsqk.exe
i_vqoigaytql.exe
i_xrpjhbzurm.exe
jecwuomgcw.exe
ljdbvtolge.sys
rljdbvtolg.exe
rojhbztrlj.sys
spkicausmk.sys
usmkfcxvpn.exe
vpnifaxsqk.exe
vqoigaytql.exe
wqoigaytql.exe
xrpjhbzurm.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
suggestions[1].en-US
memory/8-112-0x0000000000010000-0x0000000000083000-memory.dmp
memory/972-33-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2124-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2328-45-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2428-100-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2516-57-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2536-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2700-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2744-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2800-88-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2880-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3188-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3204-168-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3252-172-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3352-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4504-164-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4696-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4864-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5076-74-0x0000000000010000-0x0000000000083000-memory.dmp