Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 21:51
General
- Target 2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260810-1q1ehszapb
- SHA256 481d1b5ee9546b7041de34f6c31b99ef1e4cd20f4179faa514dd0c73cce5c928
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:980 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uojhbztrdb.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\uojhbztrdb.exeC:\Temp\uojhbztrdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uojhbztrdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uojhbztrdb.exeC:\Temp\i_uojhbztrdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbvtnlgdyw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbvtnlgdyw.exeC:\Temp\gbvtnlgdyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbvtnlgdyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbvtnlgdyw.exeC:\Temp\i_gbvtnlgdyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdyvq.exeC:\Temp\avtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdyvq.exeC:\Temp\i_avtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faysqkidav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faysqkidav.exeC:\Temp\faysqkidav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faysqkidav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faysqkidav.exeC:\Temp\i_faysqkidav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkhcausmkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmkf.exeC:\Temp\pkhcausmkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkhcausmkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmkf.exeC:\Temp\i_pkhcausmkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.exeC:\Temp\ztrmjebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjebwuo.exeC:\Temp\i_ztrmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigbytjdbv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\oigbytjdbv.exeC:\Temp\oigbytjdbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_oigbytjdbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytjdbv.exeC:\Temp\i_oigbytjdbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqoigaytq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaytq.exeC:\Temp\yvqoigaytq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqoigaytq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_yvqoigaytq.exeC:\Temp\i_yvqoigaytq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run2⤵
-
C:\Temp\nlfdxvpnif.exeC:\Temp\nlfdxvpnif.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins2⤵
-
C:\Temp\i_nlfdxvpnif.exeC:\Temp\i_nlfdxvpnif.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnifaxs.exe ups_run2⤵
-
C:\Temp\dxvpnifaxs.exeC:\Temp\dxvpnifaxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnifaxs.exe ups_ins2⤵
-
C:\Temp\i_dxvpnifaxs.exeC:\Temp\i_dxvpnifaxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xspcausmke.exe ups_run2⤵
-
C:\Temp\xspcausmke.exeC:\Temp\xspcausmke.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xspcausmke.exe ups_ins2⤵
-
C:\Temp\i_xspcausmke.exeC:\Temp\i_xspcausmke.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run2⤵
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins2⤵
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run2⤵
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins2⤵
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run2⤵
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins2⤵
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run2⤵
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins2⤵
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run2⤵
-
C:\Temp\nlgdywqoig.exeC:\Temp\nlgdywqoig.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins2⤵
-
C:\Temp\i_nlgdywqoig.exeC:\Temp\i_nlgdywqoig.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\tljdbvtnlg.sysC:\Temp\tljdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\oidbvtnlfd.sysC:\Temp\oidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkidavsnlf.sysC:\Temp\qkidavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzusmkecxu.sysC:\Temp\bzusmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjebwuom.sysC:\Temp\trmjebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
-
C:\Temp\vpnifaqkic.sysC:\Temp\vpnifaqkic.sys1⤵
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
-
C:\Temp\gezxrpjhcz.sysC:\Temp\gezxrpjhcz.sys1⤵
-
C:\Temp\zwjgbztrlj.sysC:\Temp\zwjgbztrlj.sys1⤵
-
C:\Temp\trljebwuom.sysC:\Temp\trljebwuom.sys1⤵
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdyvq.exe
bzusmkecxu.sys
faysqkidav.exe
gbvtnlgdyw.exe
hfzxrpkhca.exe
i_avtnlfdyvq.exe
i_faysqkidav.exe
i_gbvtnlgdyw.exe
i_hfzxrpkhca.exe
i_pkhcausmkf.exe
i_rmkecwuomh.exe
i_uojhbztrdb.exe
ifaysqkica.sys
jebwuomgez.sys
oidbvtnlfd.sys
pkhcausmkf.exe
qkidavsnlf.sys
rmkecwuomh.exe
spkicausmk.sys
tljdbvtnlg.sys
uojhbztrdb.exe
ztrmjebwuo.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{B713A9A5-9505-11F1-9D43-62F9C1B4CF77}.dat
RecoveryStore.{B7160BD1-9505-11F1-9D43-62F9C1B4CF77}.dat
suggestions[1].en-US
CP.exe
memory/812-233-0x0000000000C30000-0x0000000000C7B000-memory.dmp
memory/812-232-0x0000000000C30000-0x0000000000C7B000-memory.dmp
memory/888-100-0x0000000000330000-0x000000000037B000-memory.dmp
memory/888-98-0x0000000000330000-0x000000000037B000-memory.dmp
memory/1004-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1004-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1108-194-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/1108-196-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/1132-230-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1168-192-0x00000000002B0000-0x00000000002FB000-memory.dmp
memory/1168-191-0x00000000002B0000-0x00000000002FB000-memory.dmp
memory/1204-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1248-75-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2008-224-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/2008-225-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/2100-19-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/2100-17-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/2168-186-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/2168-188-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/2212-214-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2220-181-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2228-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2564-235-0x0000000000410000-0x000000000045B000-memory.dmp
memory/2708-209-0x00000000007A0000-0x00000000007EB000-memory.dmp
memory/2708-208-0x00000000007A0000-0x00000000007EB000-memory.dmp
memory/2712-116-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/2712-119-0x0000000000260000-0x00000000002AB000-memory.dmp
memory/2756-213-0x00000000006D0000-0x000000000071B000-memory.dmp
memory/2756-211-0x00000000006D0000-0x000000000071B000-memory.dmp
memory/2776-34-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/2776-36-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/2840-42-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/2840-45-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/3028-200-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/3028-201-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/3052-167-0x0000000000690000-0x00000000006DB000-memory.dmp
memory/3052-168-0x0000000000690000-0x00000000006DB000-memory.dmp
memory/3228-59-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3228-61-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3412-12-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3412-10-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/3504-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3520-184-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/3520-183-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/3708-88-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/3708-91-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/3716-159-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/3716-160-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/3732-105-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/3732-170-0x0000000000600000-0x000000000064B000-memory.dmp
memory/3732-172-0x0000000000600000-0x000000000064B000-memory.dmp
memory/3732-110-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/3780-138-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3780-136-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/3828-134-0x0000000000800000-0x000000000084B000-memory.dmp
memory/3828-132-0x0000000000800000-0x000000000084B000-memory.dmp
memory/3872-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3904-219-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/3904-221-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/3940-126-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/3940-217-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/3940-216-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/3940-123-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
memory/4004-0-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/4004-20-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/4108-227-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/4108-229-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/4164-222-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4180-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4208-81-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4208-84-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/4240-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4364-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4372-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4492-203-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/4492-205-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/4660-176-0x0000000000040000-0x000000000008B000-memory.dmp
memory/4660-175-0x0000000000040000-0x000000000008B000-memory.dmp
memory/4680-73-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/4680-65-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/4780-142-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/4780-141-0x00000000003F0000-0x000000000043B000-memory.dmp
memory/4824-112-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4828-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4888-49-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/4888-52-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/4924-197-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4948-206-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4948-178-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/4948-180-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/4996-162-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/4996-164-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/5096-154-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/5096-156-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/5116-29-0x0000000000DB0000-0x0000000000DFB000-memory.dmp
memory/5116-26-0x0000000000DB0000-0x0000000000DFB000-memory.dmp