Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 10:32
General
- Target 2026-05-11_8be8a5cd4c2d5b934ed75c6638ea723b_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample260511-mlb98sax2k
- SHA256 a914c7495851ab3d197359e4d5d623f388f90f68072cc47577d8af0ee7384625
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_8be8a5cd4c2d5b934ed75c6638ea723b_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_8be8a5cd4c2d5b934ed75c6638ea723b_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3840 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspkhcaupn.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xspkhcaupn.exeC:\Temp\xspkhcaupn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspkhcaupn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhcaupn.exeC:\Temp\i_xspkhcaupn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwup.exeC:\Temp\zurmkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwup.exeC:\Temp\i_zurmkecwup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljebwtomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rljebwtomg.exeC:\Temp\rljebwtomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljebwtomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rljebwtomg.exeC:\Temp\i_rljebwtomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igbytrljdb.exeC:\Temp\igbytrljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igbytrljdb.exeC:\Temp\i_igbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlgdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.exeC:\Temp\dbvtnlgdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgdyw.exeC:\Temp\i_dbvtnlgdyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faysqkicav.exeC:\Temp\faysqkicav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faysqkicav.exeC:\Temp\i_faysqkicav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausmkecxup.exeC:\Temp\ausmkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkecxup.exeC:\Temp\i_ausmkecxup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run2⤵
-
C:\Temp\wrojhbztrl.exeC:\Temp\wrojhbztrl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins2⤵
-
C:\Temp\i_wrojhbztrl.exeC:\Temp\i_wrojhbztrl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbwto.exe ups_run2⤵
-
C:\Temp\ytrljdbwto.exeC:\Temp\ytrljdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytrljdbwto.exe ups_ins2⤵
-
C:\Temp\i_ytrljdbwto.exeC:\Temp\i_ytrljdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run2⤵
-
C:\Temp\tnlgdyvqoi.exeC:\Temp\tnlgdyvqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins2⤵
-
C:\Temp\i_tnlgdyvqoi.exeC:\Temp\i_tnlgdyvqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnigaysqli.exe ups_run2⤵
-
C:\Temp\qnigaysqli.exeC:\Temp\qnigaysqli.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnigaysqli.exe ups_ins2⤵
-
C:\Temp\i_qnigaysqli.exeC:\Temp\i_qnigaysqli.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run2⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins2⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run2⤵
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins2⤵
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run2⤵
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins2⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhezxrpjhc.exe ups_run2⤵
-
C:\Temp\mhezxrpjhc.exeC:\Temp\mhezxrpjhc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhezxrpjhc.exe ups_ins2⤵
-
C:\Temp\i_mhezxrpjhc.exeC:\Temp\i_mhezxrpjhc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhezwjhbzt.exe ups_run2⤵
-
C:\Temp\mhezwjhbzt.exeC:\Temp\mhezwjhbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhezwjhbzt.exe ups_ins2⤵
-
C:\Temp\i_mhezwjhbzt.exeC:\Temp\i_mhezwjhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.sysC:\Temp\cwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtolg.sysC:\Temp\rljdbwtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlgdywq.sysC:\Temp\avtnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnkf.sysC:\Temp\qkicavsnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkica.sysC:\Temp\hfzxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.sysC:\Temp\cwupmhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
-
C:\Temp\avqnifaysq.sysC:\Temp\avqnifaysq.sys1⤵
-
C:\Temp\faysqkidav.sysC:\Temp\faysqkidav.sys1⤵
-
C:\Temp\axsqkicaus.sysC:\Temp\axsqkicaus.sys1⤵
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
-
C:\Temp\cwupmherpj.sysC:\Temp\cwupmherpj.sys1⤵
-
C:\Temp\wuomgezwro.sysC:\Temp\wuomgezwro.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausmkfcxvp.exe
avtnlgdywq.sys
bwuomgeywr.sys
cwuomgezwr.sys
dbvtnlgdyw.exe
faysqkicav.exe
i_ausmkfcxvp.exe
i_dbvtnlgdyw.exe
i_faysqkicav.exe
i_igbytrljdb.exe
i_qoigaysqli.exe
i_rljebwtomg.exe
i_xspkhcaupn.exe
i_zurmkecwup.exe
igbytrljdb.exe
kecwupmhez.sys
nlfdxvpnif.sys
qkicavsnkf.sys
qoigaysqli.exe
rljdbwtolg.sys
rljebwtomg.exe
xspkhcaupn.exe
zurmkecwup.exe
suggestions[1].en-US
memory/808-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/952-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1044-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1232-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1244-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1580-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1924-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2208-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2244-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3012-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3444-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4240-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4720-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4740-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5132-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5196-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5216-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5652-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5708-106-0x0000000000010000-0x0000000000083000-memory.dmp