Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/05/2026, 12:44
General
- Target 2026-05-10_dc2106a3dd747347c8115e562a64b6d1_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample260510-pyra2agy61
- SHA256 f9317ae08f1a7c4f35ebf9d2c1f5f8ca7e0e5631bf3adc60a0027c0a16574461
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_dc2106a3dd747347c8115e562a64b6d1_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_dc2106a3dd747347c8115e562a64b6d1_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3080 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtolgdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdywq.exeC:\Temp\bvtolgdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtolgdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgdywq.exeC:\Temp\i_bvtolgdywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnigaysqli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqli.exeC:\Temp\qnigaysqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnigaysqli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqli.exeC:\Temp\i_qnigaysqli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kidavsnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kidavsnlfd.exeC:\Temp\kidavsnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kidavsnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kidavsnlfd.exeC:\Temp\i_kidavsnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfcxupnhfz.exeC:\Temp\kfcxupnhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxupnhfz.exeC:\Temp\i_kfcxupnhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcwupmhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hcwupmhfzx.exeC:\Temp\hcwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcwupmhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hcwupmhfzx.exeC:\Temp\i_hcwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\herojhbztr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\herojhbztr.exeC:\Temp\herojhbztr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_herojhbztr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_herojhbztr.exeC:\Temp\i_herojhbztr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljebw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbztrljebw.exeC:\Temp\gbztrljebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljebw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljebw.exeC:\Temp\i_gbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.exeC:\Temp\bvtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdyvq.exeC:\Temp\i_bvtnlgdyvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run2⤵
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins2⤵
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run2⤵
-
C:\Temp\dxvpnifays.exeC:\Temp\dxvpnifays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins2⤵
-
C:\Temp\i_dxvpnifays.exeC:\Temp\i_dxvpnifays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsqkicausn.exe ups_run2⤵
-
C:\Temp\xsqkicausn.exeC:\Temp\xsqkicausn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsqkicausn.exe ups_ins2⤵
-
C:\Temp\i_xsqkicausn.exeC:\Temp\i_xsqkicausn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run2⤵
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins2⤵
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run2⤵
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins2⤵
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run2⤵
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins2⤵
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywrojdbwto.exe ups_run2⤵
-
C:\Temp\ywrojdbwto.exeC:\Temp\ywrojdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywrojdbwto.exe ups_ins2⤵
-
C:\Temp\i_ywrojdbwto.exeC:\Temp\i_ywrojdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqljdbvto.exe ups_run2⤵
-
C:\Temp\ytqljdbvto.exeC:\Temp\ytqljdbvto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqljdbvto.exe ups_ins2⤵
-
C:\Temp\i_ytqljdbvto.exeC:\Temp\i_ytqljdbvto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ojgbytrljd.sysC:\Temp\ojgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpkicausmk.sysC:\Temp\rpkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjzurmke.sysC:\Temp\xrpjzurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlfdyvqoig.sysC:\Temp\qlfdyvqoig.sys1⤵
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
-
C:\Temp\fzxspkicau.sysC:\Temp\fzxspkicau.sys1⤵
-
C:\Temp\nhfzxrpkhc.sysC:\Temp\nhfzxrpkhc.sys1⤵
-
C:\Temp\mhezxrpjhb.sysC:\Temp\mhezxrpjhb.sys1⤵
-
C:\Temp\jezwrojhbz.sysC:\Temp\jezwrojhbz.sys1⤵
-
C:\Temp\geywqojgbz.sysC:\Temp\geywqojgbz.sys1⤵
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
-
C:\Temp\lfdyvqoiga.sysC:\Temp\lfdyvqoiga.sys1⤵
-
C:\Temp\lfdyvqniga.sysC:\Temp\lfdyvqniga.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aytqlidbvt.sys
bvtolgdywq.exe
dxvqnigays.sys
hcwupmhfzx.exe
herojhbztr.exe
i_bvtolgdywq.exe
i_hcwupmhfzx.exe
i_kfcxupnhfz.exe
i_kidavsnlfd.exe
i_nhfaxsqkic.exe
i_qnigaysqli.exe
i_ywrojhbztr.exe
kfcxupnhfz.exe
kidavsnlfd.exe
nhfaxsqkic.exe
ojgbytrljd.sys
qnigaysqli.exe
rmkecwuomh.sys
rpkicausmk.sys
xrpjzurmke.sys
ysqkicavsn.sys
ywrojhbztr.exe
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/1140-167-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1408-111-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1764-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1888-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3612-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3808-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3944-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4028-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4052-171-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4060-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4676-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4744-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4808-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4956-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5064-31-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5420-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5992-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6132-143-0x0000000000010000-0x0000000000083000-memory.dmp