Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 11:17
General
- Target 2026-10-02_645e17a60c9d2397fe9f0d28b8675e08_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample261003-nd2qlaxbpd
- SHA256 2ab2f244300462db76346ea8694efc48237a1084386518c98ebdf39933bb0003
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_645e17a60c9d2397fe9f0d28b8675e08_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_645e17a60c9d2397fe9f0d28b8675e08_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrjgbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbztrjgbzt.exeC:\Temp\hbztrjgbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrjgbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrjgbzt.exeC:\Temp\i_hbztrjgbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.exeC:\Temp\nlfdyvqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqoig.exeC:\Temp\i_nlfdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnlfdxvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvq.exeC:\Temp\avsnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnlfdxvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvq.exeC:\Temp\i_avsnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ankfdxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ankfdxvpnh.exeC:\Temp\ankfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ankfdxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ankfdxvpnh.exeC:\Temp\i_ankfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.exeC:\Temp\pnhfaxsqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxsqki.exeC:\Temp\i_pnhfaxsqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxrpkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkec.exeC:\Temp\nhfzxrpkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxrpkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkec.exeC:\Temp\i_nhfzxrpkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezxrpjhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhcz.exeC:\Temp\hezxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezxrpjhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhcz.exeC:\Temp\i_hezxrpjhcz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwjhbztrm.exe ups_run2⤵
-
C:\Temp\ezwjhbztrm.exeC:\Temp\ezwjhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwjhbztrm.exe ups_ins2⤵
-
C:\Temp\i_ezwjhbztrm.exeC:\Temp\i_ezwjhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run2⤵
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins2⤵
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run2⤵
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins2⤵
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run2⤵
-
C:\Temp\dxvqnigays.exeC:\Temp\dxvqnigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins2⤵
-
C:\Temp\i_dxvqnigays.exeC:\Temp\i_dxvqnigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run2⤵
-
C:\Temp\avsnkfdxvp.exeC:\Temp\avsnkfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins2⤵
-
C:\Temp\i_avsnkfdxvp.exeC:\Temp\i_avsnkfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run2⤵
-
C:\Temp\axsqkicaus.exeC:\Temp\axsqkicaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins2⤵
-
C:\Temp\i_axsqkicaus.exeC:\Temp\i_axsqkicaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxspk.exe ups_run2⤵
-
C:\Temp\upmhfzxspk.exeC:\Temp\upmhfzxspk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxspk.exe ups_ins2⤵
-
C:\Temp\i_upmhfzxspk.exeC:\Temp\i_upmhfzxspk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run2⤵
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins2⤵
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run2⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins2⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\cwupmhezxr.sysC:\Temp\cwupmhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.sysC:\Temp\omgezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.sysC:\Temp\eywqoigbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqli.sysC:\Temp\qoigaytqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoiysqkida.sysC:\Temp\qoiysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkida.sysC:\Temp\ifaysqkida.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfzxsp.sysC:\Temp\xvpnhfzxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\zupmherpjh.sysC:\Temp\zupmherpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
-
C:\Temp\geywqojgbz.sysC:\Temp\geywqojgbz.sys1⤵
-
C:\Temp\toigbytrlj.sysC:\Temp\toigbytrlj.sys1⤵
-
C:\Temp\lidavtnlfd.sysC:\Temp\lidavtnlfd.sys1⤵
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
-
C:\Temp\lfdxvpnifa.sysC:\Temp\lfdxvpnifa.sys1⤵
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ankfdxvpnh.exe
avsnlfdxvq.exe
cwupmhezxr.sys
cwupmhfzxr.sys
eywqoigbyt.sys
fzxspkhcau.exe
hbztrjgbzt.exe
i_avsnlfdxvq.exe
i_fzxspkhcau.exe
i_hbztrjgbzt.exe
i_jecwuomgez.exe
i_nlfdyvqoig.exe
i_rpjhczusmk.exe
i_tolgeywqoi.exe
ifaysqkida.sys
jecwuomgez.exe
nlfdyvqoig.exe
omgezwrpjh.sys
qoigaytqli.sys
qoiysqkida.sys
rpjhczusmk.exe
tolgeywqoi.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/520-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/620-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/904-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1112-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1136-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1684-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3044-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3088-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3336-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3748-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3748-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3860-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4052-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4476-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4692-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4740-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4788-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4880-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4956-151-0x0000000000010000-0x0000000000083000-memory.dmp