Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 08:51
General
- Target 2026-04-18_3230b5aa80eb73e124bde563fc169f87_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample260418-ksemtsbw3x
- SHA256 0b25da35134dd1956debfdb61ebcf1afd88d22ad4a867961ec1430d9775c104b
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_3230b5aa80eb73e124bde563fc169f87_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3230b5aa80eb73e124bde563fc169f87_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4764 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcxu.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxrpkhcxu.exeC:\Temp\fzxrpkhcxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcxu.exeC:\Temp\i_fzxrpkhcxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezwrpjhbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hezwrpjhbz.exeC:\Temp\hezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezwrpjhbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hezwrpjhbz.exeC:\Temp\i_hezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.exeC:\Temp\ywqoigaytq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigaytq.exeC:\Temp\i_ywqoigaytq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qkidavsnlf.exeC:\Temp\qkidavsnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavsnlf.exeC:\Temp\i_qkidavsnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.exeC:\Temp\pnhfaxsqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxsqki.exeC:\Temp\i_pnhfaxsqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpkhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpkhc.exeC:\Temp\mhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpkhc.exeC:\Temp\i_mhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rlgeywrojh.exe ups_run2⤵
-
C:\Temp\rlgeywrojh.exeC:\Temp\rlgeywrojh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rlgeywrojh.exe ups_ins2⤵
-
C:\Temp\i_rlgeywrojh.exeC:\Temp\i_rlgeywrojh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run2⤵
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins2⤵
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dytqljdbvt.exe ups_run2⤵
-
C:\Temp\dytqljdbvt.exeC:\Temp\dytqljdbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dytqljdbvt.exe ups_ins2⤵
-
C:\Temp\i_dytqljdbvt.exeC:\Temp\i_dytqljdbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvqnifaysq.exe ups_run2⤵
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvqnifaysq.exe ups_ins2⤵
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run2⤵
-
C:\Temp\fdxvqnigay.exeC:\Temp\fdxvqnigay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins2⤵
-
C:\Temp\i_fdxvqnigay.exeC:\Temp\i_fdxvqnigay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run2⤵
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins2⤵
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run2⤵
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins2⤵
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwupmher.exe ups_run2⤵
-
C:\Temp\jecwupmher.exeC:\Temp\jecwupmher.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwupmher.exe ups_ins2⤵
-
C:\Temp\i_jecwupmher.exeC:\Temp\i_jecwupmher.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run2⤵
-
C:\Temp\kecwuomhez.exeC:\Temp\kecwuomhez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins2⤵
-
C:\Temp\i_kecwuomhez.exeC:\Temp\i_kecwuomhez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgezwrojh.sysC:\Temp\omgezwrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.sysC:\Temp\avsnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.sysC:\Temp\upmhezxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczur.sysC:\Temp\zxrpjhczur.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbztr.sysC:\Temp\zwrpjhbztr.sys1⤵
-
C:\Temp\wtolgeywqo.sysC:\Temp\wtolgeywqo.sys1⤵
-
C:\Temp\wlgeywqoig.sysC:\Temp\wlgeywqoig.sys1⤵
-
C:\Temp\qoigaytqli.sysC:\Temp\qoigaytqli.sys1⤵
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
-
C:\Temp\nkfdxvpnif.sysC:\Temp\nkfdxvpnif.sys1⤵
-
C:\Temp\usnkfdxvpf.sysC:\Temp\usnkfdxvpf.sys1⤵
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
-
C:\Temp\rmkecwuomg.sysC:\Temp\rmkecwuomg.sys1⤵
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnkfdxvp.sys
dyvqoigays.sys
ebwtomgeyw.exe
ebwuomgeyw.exe
fdyvqoigay.sys
fzxrpkhcxu.exe
hezwrpjhbz.exe
i_ebwtomgeyw.exe
i_ebwuomgeyw.exe
i_fzxrpkhcxu.exe
i_hezwrpjhbz.exe
i_qkidavsnlf.exe
i_wqoigaytql.exe
i_ywqoigaytq.exe
jdbvtolgey.sys
omgezwrojh.sys
pnhfaxsqki.exe
qkidavsnlf.exe
rmkecwuomh.sys
wqoigaytql.exe
xrpjhbzurm.sys
ywqoigaytq.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/364-39-0x0000000000010000-0x0000000000083000-memory.dmp
memory/392-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1896-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1908-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2064-94-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2064-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2256-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2264-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2348-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3552-142-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3924-70-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3948-166-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4084-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4768-103-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4956-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5280-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5396-82-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5736-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5744-27-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5744-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6048-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6048-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6048-133-0x0000000000010000-0x0000000000083000-memory.dmp