Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 21:26
General
- Target 2026-08-04_0398865282237b80784568025e0e1405_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample260804-1agmgaen21
- SHA256 6a83e17bfff72de28c33e15d8ca8b8fb94f55ee001bc1285cb27b7e72ccb5bc4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_0398865282237b80784568025e0e1405_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0398865282237b80784568025e0e1405_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3184 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhxrpkecw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pmhxrpkecw.exeC:\Temp\pmhxrpkecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhxrpkecw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pmhxrpkecw.exeC:\Temp\i_pmhxrpkecw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbzur.exeC:\Temp\zwrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zwrpjhbzur.exeC:\Temp\i_zwrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.exeC:\Temp\mgeywrojhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojhb.exeC:\Temp\i_mgeywrojhb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtlgdywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwtlgdywqo.exeC:\Temp\bwtlgdywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtlgdywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwtlgdywqo.exeC:\Temp\i_bwtlgdywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.exeC:\Temp\nlfdyvqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqoig.exeC:\Temp\i_nlfdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqlidb.exeC:\Temp\lfdxvqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvqlidb.exeC:\Temp\i_lfdxvqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.exeC:\Temp\avsnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avsnkfdxvp.exeC:\Temp\i_avsnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxsmkfc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhfzxsmkfc.exeC:\Temp\mhfzxsmkfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxsmkfc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxsmkfc.exeC:\Temp\i_mhfzxsmkfc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czusmkecxu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\czusmkecxu.exeC:\Temp\czusmkecxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czusmkecxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecxu.exeC:\Temp\i_czusmkecxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgezwroj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tomgezwroj.exeC:\Temp\tomgezwroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgezwroj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tomgezwroj.exeC:\Temp\i_tomgezwroj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbztrlje.exe ups_run2⤵
-
C:\Temp\ojgbztrlje.exeC:\Temp\ojgbztrlje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbztrlje.exe ups_ins2⤵
-
C:\Temp\i_ojgbztrlje.exeC:\Temp\i_ojgbztrlje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run2⤵
-
C:\Temp\ywqoigaytq.exeC:\Temp\ywqoigaytq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins2⤵
-
C:\Temp\i_ywqoigaytq.exeC:\Temp\i_ywqoigaytq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run2⤵
-
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins2⤵
-
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkicavsnl.exe ups_run2⤵
-
C:\Temp\sqkicavsnl.exeC:\Temp\sqkicavsnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkicavsnl.exe ups_ins2⤵
-
C:\Temp\i_sqkicavsnl.exeC:\Temp\i_sqkicavsnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run2⤵
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins2⤵
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run2⤵
-
C:\Temp\hczusmkecw.exeC:\Temp\hczusmkecw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins2⤵
-
C:\Temp\i_hczusmkecw.exeC:\Temp\i_hczusmkecw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpjhczu.exe ups_run2⤵
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpjhczu.exe ups_ins2⤵
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run2⤵
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins2⤵
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbwtomg.exe ups_run2⤵
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbwtomg.exe ups_ins2⤵
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\jhczurmkec.sysC:\Temp\jhczurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljebwtom.sysC:\Temp\trljebwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzu.sysC:\Temp\ezwrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
-
C:\Temp\qojgbztrlj.sysC:\Temp\qojgbztrlj.sys1⤵
-
C:\Temp\lgdyvqoiga.sysC:\Temp\lgdyvqoiga.sys1⤵
-
C:\Temp\dxvqnifays.sysC:\Temp\dxvqnifays.sys1⤵
-
C:\Temp\vpnhfaxsqk.sysC:\Temp\vpnhfaxsqk.sys1⤵
-
C:\Temp\xvpnhfzxsp.sysC:\Temp\xvpnhfzxsp.sys1⤵
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnkfdxvp.exe
bwtlgdywqo.exe
gbytqljdbv.sys
i_avsnkfdxvp.exe
i_bwtlgdywqo.exe
i_lfdxvqlidb.exe
i_mgeywrojhb.exe
i_mhfzxsmkfc.exe
i_nlfdyvqoig.exe
i_pmhxrpkecw.exe
i_zwrpjhbzur.exe
ifaysqkica.sys
jdbvtolgey.sys
jhczurmkec.sys
lfdxvqlidb.exe
mgeywrojhb.exe
mhfzxsmkfc.exe
nlfdyvqoig.exe
pmhxrpkecw.exe
sqlidavtnl.sys
trljebwtom.sys
xspkicausn.sys
zwrpjhbzur.exe
suggestions[1].en-US
memory/208-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/448-79-0x0000000000010000-0x0000000000083000-memory.dmp
memory/608-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1404-67-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1512-113-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1812-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2064-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2192-53-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2444-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4032-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4240-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4884-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5020-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5148-126-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5148-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5168-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5208-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5580-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5740-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5832-151-0x0000000000010000-0x0000000000083000-memory.dmp