Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/07/2026, 16:49
General
- Target 2026-07-15_956ed46277ec6cb153bb415c9469fb0f_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260715-vbml8acw8x
- SHA256 a24fc70d77de2302620f30272e78dd6b5381832f63d68717ab3f7e99ccb9d424
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 54 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_956ed46277ec6cb153bb415c9469fb0f_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_956ed46277ec6cb153bb415c9469fb0f_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4332 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wqojgbztrl.exeC:\Temp\wqojgbztrl.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqojgbztrl.exeC:\Temp\i_wqojgbztrl.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqoigbw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywqoigbw.exeC:\Temp\geywqoigbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqoigbw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywqoigbw.exeC:\Temp\i_geywqoigbw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wuomhezxrp.exeC:\Temp\wuomhezxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezxrp.exeC:\Temp\i_wuomhezxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuojhbzu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuojhbzu.exeC:\Temp\ecwuojhbzu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuojhbzu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuojhbzu.exeC:\Temp\i_ecwuojhbzu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.exeC:\Temp\ojgbztrljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbztrljd.exeC:\Temp\i_ojgbztrljd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlgdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.exeC:\Temp\dbvtnlgdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgdyw.exeC:\Temp\i_dbvtnlgdyw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidavtni.exe ups_run2⤵
-
C:\Temp\sqlidavtni.exeC:\Temp\sqlidavtni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidavtni.exe ups_ins2⤵
-
C:\Temp\i_sqlidavtni.exeC:\Temp\i_sqlidavtni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfcx.exe ups_run2⤵
-
C:\Temp\icausnkfcx.exeC:\Temp\icausnkfcx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfcx.exe ups_ins2⤵
-
C:\Temp\i_icausnkfcx.exeC:\Temp\i_icausnkfcx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcausmkfcx.exe ups_run2⤵
-
C:\Temp\hcausmkfcx.exeC:\Temp\hcausmkfcx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcausmkfcx.exe ups_ins2⤵
-
C:\Temp\i_hcausmkfcx.exeC:\Temp\i_hcausmkfcx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run2⤵
-
C:\Temp\xrpjhczusm.exeC:\Temp\xrpjhczusm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins2⤵
-
C:\Temp\i_xrpjhczusm.exeC:\Temp\i_xrpjhczusm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run2⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins2⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run2⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins2⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run2⤵
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins2⤵
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run2⤵
-
C:\Temp\oigaytqljd.exeC:\Temp\oigaytqljd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins2⤵
-
C:\Temp\i_oigaytqljd.exeC:\Temp\i_oigaytqljd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqkidavt.exe ups_run2⤵
-
C:\Temp\dyvqkidavt.exeC:\Temp\dyvqkidavt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqlidbvtnl.sysC:\Temp\tqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysicavsnl.sysC:\Temp\aysicavsnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkhcausm.sysC:\Temp\xspkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtolgeywqo.sysC:\Temp\wtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaysqlid.sysC:\Temp\oigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\dysqkidavs.sysC:\Temp\dysqkidavs.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
-
C:\Temp\pnhfzxspki.sysC:\Temp\pnhfzxspki.sys1⤵
-
C:\Temp\hcausmkecx.sysC:\Temp\hcausmkecx.sys1⤵
-
C:\Temp\zurmjecwuo.sysC:\Temp\zurmjecwuo.sys1⤵
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
-
C:\Temp\vtolgeywqo.sysC:\Temp\vtolgeywqo.sys1⤵
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausnkfdxvp.exe
aysicavsnl.sys
geywqoigbw.exe
hfzxrpjhcz.sys
i_ausnkfdxvp.exe
i_geywqoigbw.exe
i_idbvtnlfdy.exe
i_lfdxvpnifa.exe
i_nhfzxspkic.exe
i_wqojgbztrl.exe
i_wuomhezxrp.exe
idbvtnlfdy.exe
lfdxvpnifa.exe
nhfzxspkic.exe
omhezxrpjh.sys
qkicausnkf.sys
rljdbvtolg.sys
tqlidbvtnl.sys
wqojgbztrl.exe
wuomhezxrp.exe
xspkhcausm.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{15732165-806D-11F1-B40A-FEE57B6CEB98}.dat
RecoveryStore.{157582B5-806D-11F1-B40A-FEE57B6CEB98}.dat
suggestions[1].en-US
memory/368-45-0x0000000000010000-0x0000000000083000-memory.dmp
memory/636-67-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1172-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1196-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1196-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1828-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2148-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2452-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2476-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2836-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3220-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3916-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4008-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4120-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4256-105-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4280-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4432-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4540-33-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4916-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4936-79-0x0000000000010000-0x0000000000083000-memory.dmp