Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/05/2026, 04:33
General
- Target 2026-05-10_267fc7f89d81c6617818238f29337e69_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260510-e6qpcsg12t
- SHA256 8709a6ca34ccb3d99da555d54f2f8a528010d7f4f7bc443a7cec327702b2e886
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 36 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_267fc7f89d81c6617818238f29337e69_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_267fc7f89d81c6617818238f29337e69_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4232 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmgeywrojg.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rmgeywrojg.exeC:\Temp\rmgeywrojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmgeywrojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmgeywrojg.exeC:\Temp\i_rmgeywrojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvqnid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvqnid.exeC:\Temp\nlfdxvqnid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvqnid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvqnid.exeC:\Temp\i_nlfdxvqnid.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xspkicausm.exeC:\Temp\xspkicausm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xspkicausm.exeC:\Temp\i_xspkicausm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.exeC:\Temp\cwuomhezxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezxr.exeC:\Temp\i_cwuomhezxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qojgbytrlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qojgbytrlj.exeC:\Temp\qojgbytrlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qojgbytrlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbytrlj.exeC:\Temp\i_qojgbytrlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtolgdyto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdyto.exeC:\Temp\bvtolgdyto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtolgdyto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgdyto.exeC:\Temp\i_bvtolgdyto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\toigaytqli.exe ups_run2⤵
-
C:\Temp\toigaytqli.exeC:\Temp\toigaytqli.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_toigaytqli.exe ups_ins2⤵
-
C:\Temp\i_toigaytqli.exeC:\Temp\i_toigaytqli.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run2⤵
-
C:\Temp\dxvqnigays.exeC:\Temp\dxvqnigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins2⤵
-
C:\Temp\i_dxvqnigays.exeC:\Temp\i_dxvqnigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run2⤵
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins2⤵
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run2⤵
-
C:\Temp\ezxrpjhczu.exeC:\Temp\ezxrpjhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins2⤵
-
C:\Temp\i_ezxrpjhczu.exeC:\Temp\i_ezxrpjhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run2⤵
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins2⤵
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run2⤵
-
C:\Temp\urmjecwuom.exeC:\Temp\urmjecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmjecwuom.exeC:\Temp\i_urmjecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwuomgey.exe ups_run2⤵
-
C:\Temp\jebwuomgey.exeC:\Temp\jebwuomgey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwuomgey.exe ups_ins2⤵
-
C:\Temp\i_jebwuomgey.exeC:\Temp\i_jebwuomgey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run2⤵
-
C:\Temp\tqljdbvtol.exeC:\Temp\tqljdbvtol.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins2⤵
-
C:\Temp\i_tqljdbvtol.exeC:\Temp\i_tqljdbvtol.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgdywqoi.exe ups_run2⤵
-
C:\Temp\tolgdywqoi.exeC:\Temp\tolgdywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\obwtolgeyw.sysC:\Temp\obwtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytolgeywqo.sysC:\Temp\ytolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.sysC:\Temp\icausmkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxspkicaus.sysC:\Temp\cxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.sysC:\Temp\mhfzxrpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\uojhbztrlj.sysC:\Temp\uojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwu.sysC:\Temp\bztrljebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
-
C:\Temp\nidavsnlfd.sysC:\Temp\nidavsnlfd.sys1⤵
-
C:\Temp\axsqkicaus.sysC:\Temp\axsqkicaus.sys1⤵
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
-
C:\Temp\pkecwupmhf.sysC:\Temp\pkecwupmhf.sys1⤵
-
C:\Temp\ezwrpjhbzt.sysC:\Temp\ezwrpjhbzt.sys1⤵
-
C:\Temp\tojgbztrlj.sysC:\Temp\tojgbztrlj.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avtnlfdxvq.exe
cwuomhezxr.exe
cxspkicaus.sys
dbvtnlfdyv.exe
hfzxrpkhca.exe
i_avtnlfdxvq.exe
i_dbvtnlfdyv.exe
i_hfzxrpkhca.exe
i_nlfdxvqnid.exe
i_rmgeywrojg.exe
i_trljdbwtom.exe
i_xspkicausm.exe
icausmkfcx.sys
lidbvtnlgd.sys
mhfzxrpjhc.sys
nlfdxvqnid.exe
obwtolgeyw.sys
rmgeywrojg.exe
trljdbwtom.exe
xspkicausm.exe
ysqkicavsn.sys
ytolgeywqo.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/8-156-0x0000000000600000-0x000000000064B000-memory.dmp
memory/8-147-0x0000000000600000-0x000000000064B000-memory.dmp
memory/376-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/544-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/692-20-0x0000000000010000-0x0000000000083000-memory.dmp
memory/752-207-0x0000000000930000-0x000000000097B000-memory.dmp
memory/752-208-0x0000000000930000-0x000000000097B000-memory.dmp
memory/860-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1120-8-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/1120-10-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/1208-172-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/1208-170-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/1236-98-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/1236-95-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/1316-183-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1316-184-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1344-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1416-133-0x0000000000870000-0x00000000008BB000-memory.dmp
memory/1416-135-0x0000000000870000-0x00000000008BB000-memory.dmp
memory/1524-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1580-234-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/1580-236-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/1824-73-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1884-121-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/1884-119-0x0000000000AA0000-0x0000000000AEB000-memory.dmp
memory/1888-199-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1888-200-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1972-223-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/1972-224-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/2004-59-0x0000000000D60000-0x0000000000DAB000-memory.dmp
memory/2004-56-0x0000000000D60000-0x0000000000DAB000-memory.dmp
memory/2024-43-0x0000000000C00000-0x0000000000C4B000-memory.dmp
memory/2024-40-0x0000000000C00000-0x0000000000C4B000-memory.dmp
memory/2080-50-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/2080-48-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/2304-159-0x0000000000E20000-0x0000000000E6B000-memory.dmp
memory/2304-160-0x0000000000E20000-0x0000000000E6B000-memory.dmp
memory/2332-18-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/2332-0-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/2616-226-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2616-228-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2652-202-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/2652-204-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/2656-32-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2656-34-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2688-36-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2836-181-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3024-176-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/3024-175-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/3212-71-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3212-64-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3240-218-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/3240-220-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/3248-52-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3364-89-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/3364-87-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/3380-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3396-107-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3704-186-0x0000000000D10000-0x0000000000D5B000-memory.dmp
memory/3704-188-0x0000000000D10000-0x0000000000D5B000-memory.dmp
memory/3740-196-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/3740-194-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/3768-139-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/3768-138-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/3944-229-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3948-105-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/3948-103-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/4112-114-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/4112-111-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/4164-212-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/4164-210-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/4188-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4188-231-0x0000000000350000-0x000000000039B000-memory.dmp
memory/4188-232-0x0000000000350000-0x000000000039B000-memory.dmp
memory/4332-130-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/4332-127-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/4364-213-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4400-27-0x0000000000100000-0x000000000014B000-memory.dmp
memory/4400-25-0x0000000000100000-0x000000000014B000-memory.dmp
memory/4464-14-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4464-17-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4500-82-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4500-79-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4696-178-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4696-180-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4780-221-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4900-191-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4900-192-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/4924-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4936-164-0x0000000000700000-0x000000000074B000-memory.dmp
memory/4936-162-0x0000000000700000-0x000000000074B000-memory.dmp
memory/5020-215-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/5020-216-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/5048-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5092-168-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/5092-167-0x0000000000DC0000-0x0000000000E0B000-memory.dmp