Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 03:22
General
- Target 2026-08-16_fbf2e0a862ddb0ff2d01bad4db919483_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample260816-dw1adaydnc
- SHA256 62ab62684d3373c100b610f3cd0711d01a1f8511bf95c4589672e681d72fbfb7
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_fbf2e0a862ddb0ff2d01bad4db919483_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fbf2e0a862ddb0ff2d01bad4db919483_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupnhfzxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzxr.exeC:\Temp\cxupnhfzxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupnhfzxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxupnhfzxr.exeC:\Temp\i_cxupnhfzxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtomgeywr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywr.exeC:\Temp\bwtomgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtomgeywr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwtomgeywr.exeC:\Temp\i_bwtomgeywr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbwqoigtql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbwqoigtql.exeC:\Temp\gbwqoigtql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbwqoigtql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbwqoigtql.exeC:\Temp\i_gbwqoigtql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.exeC:\Temp\qnigaysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqki.exeC:\Temp\i_qnigaysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dxvpnifaxs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.exeC:\Temp\dxvpnifaxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dxvpnifaxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifaxs.exeC:\Temp\i_dxvpnifaxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzpjhcz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzpjhcz.exeC:\Temp\pnhfzpjhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzpjhcz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzpjhcz.exeC:\Temp\i_pnhfzpjhcz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwuomgezwr.exe ups_run2⤵
-
C:\Temp\cwuomgezwr.exeC:\Temp\cwuomgezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwuomgezwr.exe ups_ins2⤵
-
C:\Temp\i_cwuomgezwr.exeC:\Temp\i_cwuomgezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywigb.exe ups_run2⤵
-
C:\Temp\tolgeywigb.exeC:\Temp\tolgeywigb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywigb.exe ups_ins2⤵
-
C:\Temp\i_tolgeywigb.exeC:\Temp\i_tolgeywigb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run2⤵
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins2⤵
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run2⤵
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins2⤵
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicausmcx.exe ups_run2⤵
-
C:\Temp\pkicausmcx.exeC:\Temp\pkicausmcx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicausmcx.exe ups_ins2⤵
-
C:\Temp\i_pkicausmcx.exeC:\Temp\i_pkicausmcx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run2⤵
-
C:\Temp\kecxupnhfz.exeC:\Temp\kecxupnhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins2⤵
-
C:\Temp\i_kecxupnhfz.exeC:\Temp\i_kecxupnhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run2⤵
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins2⤵
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\nhczusmkec.sysC:\Temp\nhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmjecwuom.sysC:\Temp\urmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigbytrlj.sysC:\Temp\toigbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdyvq.sysC:\Temp\bvtnlfdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.sysC:\Temp\nigaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaysqkaus.sysC:\Temp\hfaysqkaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.sysC:\Temp\ausmkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\upjhbzurmk.sysC:\Temp\upjhbzurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmjec.sysC:\Temp\jhbzurmjec.sys1⤵
-
C:\Temp\jgbztrljet.sysC:\Temp\jgbztrljet.sys1⤵
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\qoigaytqli.sysC:\Temp\qoigaytqli.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\davtnlfdxn.sysC:\Temp\davtnlfdxn.sys1⤵
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bvtnlfdyvq.sys
bwtomgeywr.exe
cxupnhfzxr.exe
dxvpnifaxs.exe
gbwqoigtql.exe
geywrojhbz.sys
i_bwtomgeywr.exe
i_cxupnhfzxr.exe
i_dxvpnifaxs.exe
i_gbwqoigtql.exe
i_mkecwupmhe.exe
i_olgdywqoig.exe
i_pnhfzxspki.exe
i_qnigaysqki.exe
mgezwrojhb.sys
mkecwupmhe.exe
nhczusmkec.sys
nigaysqkid.sys
olgdywqoig.exe
pnhfzxspki.exe
qnigaysqki.exe
toigbytrlj.sys
urmjecwuom.sys
suggestions[1].en-US
memory/116-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1148-106-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1204-107-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1204-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1680-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1784-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1840-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2008-79-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2356-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3400-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3516-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3608-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3848-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3848-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3932-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4248-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4248-162-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4348-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4396-115-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4840-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4880-91-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5088-111-0x0000000000010000-0x0000000000083000-memory.dmp