Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 19:24
General
- Target 2026-10-19_5baaa385c445a85dfa88fac87afa8661_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample261020-x4tmcaws7j
- SHA256 9935512000cc4d582df9929dd7494e3d8fb0dea5e616d4e68d42eb6d7fd78b66
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_5baaa385c445a85dfa88fac87afa8661_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_5baaa385c445a85dfa88fac87afa8661_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5060 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicaupnhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kicaupnhfz.exeC:\Temp\kicaupnhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicaupnhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kicaupnhfz.exeC:\Temp\i_kicaupnhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhczu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhczu.exeC:\Temp\fzxrpkhczu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhczu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhczu.exeC:\Temp\i_fzxrpkhczu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjebwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pjebwuomge.exeC:\Temp\pjebwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjebwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjebwuomge.exeC:\Temp\i_pjebwuomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljdbwqoj.exeC:\Temp\trljdbwqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwqoj.exeC:\Temp\i_trljdbwqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaytqlidb.exeC:\Temp\igaytqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqlidb.exeC:\Temp\i_igaytqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.exeC:\Temp\fdyvqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqoigay.exeC:\Temp\i_fdyvqoigay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvqnifaysq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvqnifaysq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnhfaxspk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.exeC:\Temp\vpnhfaxspk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnhfaxspk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfaxspk.exeC:\Temp\i_vpnhfaxspk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxrpkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkec.exeC:\Temp\nhfzxrpkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxrpkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkec.exeC:\Temp\i_nhfzxrpkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run2⤵
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins2⤵
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run2⤵
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins2⤵
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run2⤵
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins2⤵
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtol.exe ups_run2⤵
-
C:\Temp\trljdbwtol.exeC:\Temp\trljdbwtol.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtol.exe ups_ins2⤵
-
C:\Temp\i_trljdbwtol.exeC:\Temp\i_trljdbwtol.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqlidbvtnl.exe ups_run2⤵
-
C:\Temp\tqlidbvtnl.exeC:\Temp\tqlidbvtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqlidbvtnl.exe ups_ins2⤵
-
C:\Temp\i_tqlidbvtnl.exeC:\Temp\i_tqlidbvtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run2⤵
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins2⤵
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run2⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins2⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfvpnhfzxs.exe ups_run2⤵
-
C:\Temp\kfvpnhfzxs.exeC:\Temp\kfvpnhfzxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfvpnhfzxs.exe ups_ins2⤵
-
C:\Temp\i_kfvpnhfzxs.exeC:\Temp\i_kfvpnhfzxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxupkhcau.exe ups_run2⤵
-
C:\Temp\ecxupkhcau.exeC:\Temp\ecxupkhcau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxupkhcau.exe ups_ins2⤵
-
C:\Temp\i_ecxupkhcau.exeC:\Temp\i_ecxupkhcau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwrp.sysC:\Temp\wuomhezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfcxv.sysC:\Temp\causnkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
-
C:\Temp\mgbytrljdb.sysC:\Temp\mgbytrljdb.sys1⤵
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
-
C:\Temp\vqnigaysql.sysC:\Temp\vqnigaysql.sys1⤵
-
C:\Temp\xvqfaxsqki.sysC:\Temp\xvqfaxsqki.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bvtolgeywq.sys
eywrojhbzt.sys
fdyvqoigay.exe
fzxrpkhczu.exe
hfzxrpjhcz.sys
i_fzxrpkhczu.exe
i_igaytqlidb.exe
i_kicaupnhfz.exe
i_pjebwuomge.exe
i_snlfdxvpni.exe
i_trljdbwqoj.exe
i_zurmkecwuo.exe
igaytqlidb.exe
kicaupnhfz.exe
pjebwuomge.exe
qljdbvtnlg.sys
snlfdxvpni.exe
trljdbwqoj.exe
usmkfcxvpn.sys
usnkfdxvpn.sys
wuomhezwrp.sys
zurmkecwuo.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
known_providers_download_v1[1].xml
favicon[1].ico
suggestions[1].en-US
memory/468-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/928-182-0x0000000000010000-0x0000000000083000-memory.dmp
memory/948-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/968-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1128-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1420-178-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1420-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2488-97-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2760-66-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2876-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2960-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2976-42-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3104-177-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3160-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3968-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4148-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4212-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4648-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4672-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4908-145-0x0000000000010000-0x0000000000083000-memory.dmp