Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/08/2026, 18:45
General
- Target 2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
- Size 230KB
- Sample260812-xee3nasgrb
- SHA256 b77e3cad22e4a49a7059269e93411a5d7f5df8f721a91539cf8d6d27201e7c7a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 58 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1412 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdywrojhbw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdywrojhbw.exeC:\Temp\jdywrojhbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdywrojhbw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdywrojhbw.exeC:\Temp\i_jdywrojhbw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojdbw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywqojdbw.exeC:\Temp\geywqojdbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojdbw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojdbw.exeC:\Temp\i_geywqojdbw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdyvqniga.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqniga.exeC:\Temp\lfdyvqniga.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdyvqniga.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqniga.exeC:\Temp\i_lfdyvqniga.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nidavsnlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nidavsnlfd.exeC:\Temp\nidavsnlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nidavsnlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nidavsnlfd.exeC:\Temp\i_nidavsnlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkausnk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqkausnk.exeC:\Temp\aysqkausnk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkausnk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkausnk.exeC:\Temp\i_aysqkausnk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausmkfcx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.exeC:\Temp\icausmkfcx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausmkfcx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icausmkfcx.exeC:\Temp\i_icausmkfcx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjecwupmh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjecwupmh.exeC:\Temp\rpjecwupmh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjecwupmh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjecwupmh.exeC:\Temp\i_rpjecwupmh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrlgezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbztrlgezw.exeC:\Temp\gbztrlgezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrlgezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrlgezw.exeC:\Temp\i_gbztrlgezw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbvtojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtojg.exeC:\Temp\rljdbvtojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbvtojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtojg.exeC:\Temp\i_rljdbvtojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run2⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins2⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run2⤵
-
C:\Temp\causmkfcxv.exeC:\Temp\causmkfcxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins2⤵
-
C:\Temp\i_causmkfcxv.exeC:\Temp\i_causmkfcxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xsmkecwupm.exe ups_run2⤵
-
C:\Temp\xsmkecwupm.exeC:\Temp\xsmkecwupm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xsmkecwupm.exe ups_ins2⤵
-
C:\Temp\i_xsmkecwupm.exeC:\Temp\i_xsmkecwupm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run2⤵
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins2⤵
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run2⤵
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins2⤵
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run2⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins2⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run2⤵
-
C:\Temp\dxvqnigays.exeC:\Temp\dxvqnigays.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\qljdbvtolg.sysC:\Temp\qljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqn.sysC:\Temp\vtnlfdyvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidav.sysC:\Temp\gaysqlidav.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.sysC:\Temp\smkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfzxr.sysC:\Temp\cxupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomh.sysC:\Temp\rmjecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.sysC:\Temp\jhbztrmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbytr.sysC:\Temp\ywqojgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
-
C:\Temp\xvqnifaysq.sysC:\Temp\xvqnifaysq.sys1⤵
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
-
C:\Temp\ecxupnhfzx.sysC:\Temp\ecxupnhfzx.sys1⤵
-
C:\Temp\wuomgezwrp.sysC:\Temp\wuomgezwrp.sys1⤵
-
C:\Temp\ztrmjecwuo.sysC:\Temp\ztrmjecwuo.sys1⤵
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\oidbvtnlfd.sysC:\Temp\oidbvtnlfd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqkausnk.exe
cxupmhfzxr.sys
gaysqlidav.sys
gbztrlgezw.exe
geywqojdbw.exe
i_aysqkausnk.exe
i_geywqojdbw.exe
i_icausmkfcx.exe
i_jdywrojhbw.exe
i_lfdyvqniga.exe
i_nidavsnlfd.exe
i_rpjecwupmh.exe
icausmkfcx.exe
jdywrojhbw.exe
kicavsnlfd.sys
lfdyvqniga.exe
nidavsnlfd.exe
qljdbvtolg.sys
rmjecwuomh.sys
rpjecwupmh.exe
smkfcxvpnh.sys
vtnlfdyvqn.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{07B830CF-967E-11F1-BC3D-DA48EC94345F}.dat
RecoveryStore.{07BA9409-967E-11F1-BC3D-DA48EC94345F}.dat
suggestions[1].en-US
memory/700-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/864-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1308-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1924-16-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2276-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2508-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2552-71-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2932-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2932-95-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4068-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4252-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4332-28-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4356-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4364-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4664-40-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4752-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5020-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5040-57-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5108-106-0x0000000000010000-0x0000000000083000-memory.dmp