Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 16:07
General
- Target 2026-04-22_520be9635a8bee3c87c6330a575158c3_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260422-tk28laaz7p
- SHA256 e2f23e57c8b3851e4744f5f72fd5b51b271a7baae6524c4ce3d1b633c1d906b5
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_520be9635a8bee3c87c6330a575158c3_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_520be9635a8bee3c87c6330a575158c3_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5012 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zmjecwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zmjecwuomg.exeC:\Temp\zmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zmjecwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zmjecwuomg.exeC:\Temp\i_zmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdyvqnigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnigay.exeC:\Temp\fdyvqnigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdyvqnigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqnigay.exeC:\Temp\i_fdyvqnigay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifaxsqkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkic.exeC:\Temp\nifaxsqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifaxsqkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxsqkic.exeC:\Temp\i_nifaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhbztrmjec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhbztrmjec.exeC:\Temp\mhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhbztrmjec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhbztrmjec.exeC:\Temp\i_mhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run2⤵
-
C:\Temp\wtomgeywqo.exeC:\Temp\wtomgeywqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins2⤵
-
C:\Temp\i_wtomgeywqo.exeC:\Temp\i_wtomgeywqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gdywqljdbv.exe ups_run2⤵
-
C:\Temp\gdywqljdbv.exeC:\Temp\gdywqljdbv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gdywqljdbv.exe ups_ins2⤵
-
C:\Temp\i_gdywqljdbv.exeC:\Temp\i_gdywqljdbv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnifaysqk.exe ups_run2⤵
-
C:\Temp\vqnifaysqk.exeC:\Temp\vqnifaysqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnifaysqk.exe ups_ins2⤵
-
C:\Temp\i_vqnifaysqk.exeC:\Temp\i_vqnifaysqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run2⤵
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins2⤵
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run2⤵
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins2⤵
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run2⤵
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins2⤵
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run2⤵
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins2⤵
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrmjebw.exe ups_run2⤵
-
C:\Temp\gbztrmjebw.exeC:\Temp\gbztrmjebw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrmjebw.exe ups_ins2⤵
-
C:\Temp\i_gbztrmjebw.exeC:\Temp\i_gbztrmjebw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgeywro.exe ups_run2⤵
-
C:\Temp\wtomgeywro.exeC:\Temp\wtomgeywro.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\mhbzurmkec.sysC:\Temp\mhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgbytrljdb.sysC:\Temp\lgbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.sysC:\Temp\fdxvqnigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecxupmhfz.sysC:\Temp\kecxupmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.sysC:\Temp\geywqojgbz.sys1⤵
-
C:\Temp\tolgdywqoi.sysC:\Temp\tolgdywqoi.sys1⤵
-
C:\Temp\nlgdywqoig.sysC:\Temp\nlgdywqoig.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
-
C:\Temp\fzusmkecwu.sysC:\Temp\fzusmkecwu.sys1⤵
-
C:\Temp\rpjhbzurmk.sysC:\Temp\rpjhbzurmk.sys1⤵
-
C:\Temp\geywrojgbz.sysC:\Temp\geywrojgbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
faxsqkicau.exe
fdxvqnigay.sys
fdyvqnigay.exe
i_faxsqkicau.exe
i_fdyvqnigay.exe
i_nifaxsqkic.exe
i_wuomgeywro.exe
i_ywqoigbytr.exe
i_zmjecwuomg.exe
i_zxrpjhbzur.exe
lgbytrljdb.sys
mhbzurmkec.sys
nifaxsqkic.exe
pkhcausmke.exe
pnhfaxsqki.sys
tnlgdywqoi.sys
uomgeywroj.sys
wuomgeywro.exe
ywqoigbytr.exe
zmjecwuomg.exe
zxrpjhbzur.exe
zxspkicaus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{0F9A2F05-3E68-11F1-8285-EE999514C84F}.dat
RecoveryStore.{0F9C91AD-3E68-11F1-8285-EE999514C84F}.dat
suggestions[1].en-US
memory/116-93-0x00000000004B0000-0x000000000056F000-memory.dmp
memory/204-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/212-138-0x0000000000570000-0x000000000062F000-memory.dmp
memory/336-212-0x0000000000010000-0x0000000000083000-memory.dmp
memory/388-222-0x0000000000890000-0x000000000094F000-memory.dmp
memory/688-102-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/828-22-0x0000000000860000-0x000000000091F000-memory.dmp
memory/1000-186-0x00000000007D0000-0x000000000088F000-memory.dmp
memory/1132-52-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/1168-214-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1172-218-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/1288-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1380-134-0x0000000000850000-0x000000000090F000-memory.dmp
memory/1536-227-0x0000000000760000-0x000000000081F000-memory.dmp
memory/1544-193-0x0000000000880000-0x000000000093F000-memory.dmp
memory/1584-170-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1616-211-0x0000000000880000-0x000000000093F000-memory.dmp
memory/1692-45-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/1728-228-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/1820-37-0x0000000000870000-0x000000000092F000-memory.dmp
memory/1912-87-0x0000000000870000-0x000000000092F000-memory.dmp
memory/1964-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1988-101-0x00000000004E0000-0x000000000059F000-memory.dmp
memory/2016-39-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2060-75-0x0000000000920000-0x00000000009DF000-memory.dmp
memory/2068-77-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2068-201-0x0000000000410000-0x00000000004CF000-memory.dmp
memory/2112-225-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/2160-16-0x0000000000870000-0x000000000092F000-memory.dmp
memory/2292-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2484-117-0x0000000000690000-0x000000000074F000-memory.dmp
memory/2500-137-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/2524-169-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/2540-130-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/2584-177-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2660-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2660-80-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2672-161-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/2968-95-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2980-194-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/3048-200-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/3064-123-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3068-157-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/3172-215-0x0000000000880000-0x000000000093F000-memory.dmp
memory/3256-108-0x0000000000750000-0x000000000080F000-memory.dmp
memory/3288-86-0x0000000000630000-0x00000000006EF000-memory.dmp
memory/3320-180-0x00000000005C0000-0x000000000067F000-memory.dmp
memory/3324-179-0x0000000000950000-0x0000000000A0F000-memory.dmp
memory/3424-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3528-31-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/3796-190-0x00000000005C0000-0x000000000067F000-memory.dmp
memory/3796-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3928-204-0x0000000000640000-0x00000000006FF000-memory.dmp
memory/4124-15-0x00000000007E0000-0x000000000089F000-memory.dmp
memory/4152-166-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4324-207-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4352-197-0x0000000000860000-0x000000000091F000-memory.dmp
memory/4368-30-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4412-191-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4464-61-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4500-172-0x0000000000550000-0x000000000060F000-memory.dmp
memory/4504-187-0x0000000000880000-0x000000000093F000-memory.dmp
memory/4552-221-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/4564-165-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/4588-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4592-24-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4612-116-0x0000000000750000-0x000000000080F000-memory.dmp
memory/4648-131-0x0000000000560000-0x000000000061F000-memory.dmp
memory/4680-46-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4692-60-0x0000000000940000-0x00000000009FF000-memory.dmp
memory/4856-184-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4872-173-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/4936-183-0x0000000000570000-0x000000000062F000-memory.dmp
memory/5020-208-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/5028-154-0x0000000000470000-0x000000000052F000-memory.dmp
memory/5056-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5056-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5092-176-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5108-158-0x0000000000640000-0x00000000006FF000-memory.dmp