Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 06:36
General
- Target 2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample261030-hdan8axt2n
- SHA256 7650b34a8dbfe0f39ff77356794b07f2c12d0832d455625f52462fee5055c17a
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4180 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbytqljdbv.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbytqljdbv.exeC:\Temp\gbytqljdbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbytqljdbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqljdbv.exeC:\Temp\i_gbytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.exeC:\Temp\tnlfdyvqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdyvqoi.exeC:\Temp\i_tnlfdyvqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cavsnkfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cavsnkfdxv.exeC:\Temp\cavsnkfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cavsnkfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnkfdxv.exeC:\Temp\i_cavsnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkhczusmke.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkhczusmke.exeC:\Temp\pkhczusmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkhczusmke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkhczusmke.exeC:\Temp\i_pkhczusmke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhczurmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhczurmkec.exeC:\Temp\mhczurmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhczurmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhczurmkec.exeC:\Temp\i_mhczurmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgbytrljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgbytrljdb.exeC:\Temp\mgbytrljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgbytrljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgbytrljdb.exeC:\Temp\i_mgbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvqnifaysq.exe ups_run2⤵
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvqnifaysq.exe ups_ins2⤵
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxspki.exe ups_run2⤵
-
C:\Temp\pnhfaxspki.exeC:\Temp\pnhfaxspki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxspki.exe ups_ins2⤵
-
C:\Temp\i_pnhfaxspki.exeC:\Temp\i_pnhfaxspki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run2⤵
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins2⤵
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run2⤵
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins2⤵
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgdywqlj.exe ups_run2⤵
-
C:\Temp\tolgdywqlj.exeC:\Temp\tolgdywqlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgdywqlj.exe ups_ins2⤵
-
C:\Temp\i_tolgdywqlj.exeC:\Temp\i_tolgdywqlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nidavtnlfd.exe ups_run2⤵
-
C:\Temp\nidavtnlfd.exeC:\Temp\nidavtnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nidavtnlfd.exe ups_ins2⤵
-
C:\Temp\i_nidavtnlfd.exeC:\Temp\i_nidavtnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxspkicau.sysC:\Temp\faxspkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomhezxrpj.sysC:\Temp\uomhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrljebwtom.sysC:\Temp\wrljebwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoiga.sysC:\Temp\lgdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
-
C:\Temp\xsmkecxupm.sysC:\Temp\xsmkecxupm.sys1⤵
-
C:\Temp\mhezwrpjhb.sysC:\Temp\mhezwrpjhb.sys1⤵
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
-
C:\Temp\geywqojgbz.sysC:\Temp\geywqojgbz.sys1⤵
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\ytnlfdyvqo.sysC:\Temp\ytnlfdyvqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avtnlfdxvq.sys
cavsnkfdxv.exe
faxspkicau.sys
fcxvpnhfzx.sys
gbytqljdbv.exe
geywrojhbz.sys
i_cavsnkfdxv.exe
i_gbytqljdbv.exe
i_mhczurmkec.exe
i_pkhczusmke.exe
i_tnlfdyvqoi.exe
i_tnlgdywqoi.exe
i_usmkfcxvpn.exe
igbytqljdb.sys
mhczurmkec.exe
nifaysqkic.sys
pkhczusmke.exe
tnlfdyvqoi.exe
tnlgdywqoi.exe
uomhezxrpj.sys
usmkfcxvpn.exe
zwrpjhbztr.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/532-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1108-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1396-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1636-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2128-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2300-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2416-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2500-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2756-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3216-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4020-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4060-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4420-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4448-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4604-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4808-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4844-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4904-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4988-123-0x0000000000010000-0x0000000000083000-memory.dmp