Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 10:16
General
- Target 2026-08-20_24ebf6db395c4c659f43990db5b146a5_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260820-ma8jasvbrd
- SHA256 fad82531f272068940835f2a540b7387d532f316cb6a4fbcf845a77d0bbff370
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 52 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_24ebf6db395c4c659f43990db5b146a5_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_24ebf6db395c4c659f43990db5b146a5_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzuogeywqo.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzuogeywqo.exeC:\Temp\bzuogeywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzuogeywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bzuogeywqo.exeC:\Temp\i_bzuogeywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoigbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbvt.exeC:\Temp\eywqoigbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqoigbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqoigbvt.exeC:\Temp\i_eywqoigbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdyvq.exeC:\Temp\avtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdyvq.exeC:\Temp\i_avtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqlidavlfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\sqlidavlfd.exeC:\Temp\sqlidavlfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqlidavlfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidavlfd.exeC:\Temp\i_sqlidavlfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avpnifaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\avpnifaxsq.exeC:\Temp\avpnifaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avpnifaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_avpnifaxsq.exeC:\Temp\i_avpnifaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcupnhfzxs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fcupnhfzxs.exeC:\Temp\fcupnhfzxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcupnhfzxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fcupnhfzxs.exeC:\Temp\i_fcupnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.exeC:\Temp\rpjhbzurmj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurmj.exeC:\Temp\i_rpjhbzurmj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaytqlid.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nigaytqlid.exeC:\Temp\nigaytqlid.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaytqlid.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nigaytqlid.exeC:\Temp\i_nigaytqlid.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlfdyvq.exe ups_run2⤵
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins2⤵
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run2⤵
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins2⤵
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icxvpnhfzx.exe ups_run2⤵
-
C:\Temp\icxvpnhfzx.exeC:\Temp\icxvpnhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icxvpnhfzx.exe ups_ins2⤵
-
C:\Temp\i_icxvpnhfzx.exeC:\Temp\i_icxvpnhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfzxrpkh.exe ups_run2⤵
-
C:\Temp\pmhfzxrpkh.exeC:\Temp\pmhfzxrpkh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfzxrpkh.exe ups_ins2⤵
-
C:\Temp\i_pmhfzxrpkh.exeC:\Temp\i_pmhfzxrpkh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwuomhezwr.exe ups_run2⤵
-
C:\Temp\cwuomhezwr.exeC:\Temp\cwuomhezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwuomhezwr.exe ups_ins2⤵
-
C:\Temp\i_cwuomhezwr.exeC:\Temp\i_cwuomhezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run2⤵
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins2⤵
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run2⤵
-
C:\Temp\ojgbztrljd.exeC:\Temp\ojgbztrljd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins2⤵
-
C:\Temp\i_ojgbztrljd.exeC:\Temp\i_ojgbztrljd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqlj.exe ups_run2⤵
-
C:\Temp\tnlgdywqlj.exeC:\Temp\tnlgdywqlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqlj.exe ups_ins2⤵
-
C:\Temp\i_tnlgdywqlj.exeC:\Temp\i_tnlgdywqlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\oigbytrljd.sysC:\Temp\oigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdyv.sysC:\Temp\davtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.sysC:\Temp\pnhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcamkecxup.sysC:\Temp\hcamkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhbzurmkec.sysC:\Temp\mhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywrojgbztr.sysC:\Temp\ywrojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\zxrpkhcaus.sysC:\Temp\zxrpkhcaus.sys1⤵
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
-
C:\Temp\hbzurmjecw.sysC:\Temp\hbzurmjecw.sys1⤵
-
C:\Temp\ztrljebwuo.sysC:\Temp\ztrljebwuo.sys1⤵
-
C:\Temp\eywqoigbyt.sysC:\Temp\eywqoigbyt.sys1⤵
-
C:\Temp\ytnlgdyoig.sysC:\Temp\ytnlgdyoig.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avpnifaxsq.exe
avtnlfdyvq.exe
bzuogeywqo.exe
davtnlfdyv.sys
eywqoigbvt.exe
fcupnhfzxs.exe
hcamkecxup.sys
hfaxsqkica.sys
i_avpnifaxsq.exe
i_avtnlfdyvq.exe
i_bzuogeywqo.exe
i_eywqoigbvt.exe
i_fcupnhfzxs.exe
i_mkecwupmhe.exe
i_sqlidavlfd.exe
mhbzurmkec.sys
mkecwupmhe.exe
oigbytrljd.sys
pnhfzxspki.sys
rpjhbzurmj.exe
sqlidavlfd.exe
tqljdbvtnl.sys
RecoveryStore.{42C70F3D-9C80-11F1-B05C-56E9201B28D7}.dat
RecoveryStore.{42C9722A-9C80-11F1-B05C-56E9201B28D7}.dat
suggestions[1].en-US
memory/312-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/468-224-0x0000000000640000-0x000000000068B000-memory.dmp
memory/468-225-0x0000000000640000-0x000000000068B000-memory.dmp
memory/520-175-0x0000000000310000-0x000000000035B000-memory.dmp
memory/520-176-0x0000000000310000-0x000000000035B000-memory.dmp
memory/628-153-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/628-151-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/788-222-0x0000000000010000-0x0000000000083000-memory.dmp
memory/844-216-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/844-217-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/900-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/900-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1028-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1092-172-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1092-133-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/1092-135-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/1536-188-0x0000000000520000-0x000000000056B000-memory.dmp
memory/1536-186-0x0000000000520000-0x000000000056B000-memory.dmp
memory/1612-232-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1612-233-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1792-43-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/1792-45-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/1824-195-0x0000000000910000-0x000000000095B000-memory.dmp
memory/1824-197-0x0000000000910000-0x000000000095B000-memory.dmp
memory/2080-211-0x0000000000A10000-0x0000000000A5B000-memory.dmp
memory/2080-213-0x0000000000A10000-0x0000000000A5B000-memory.dmp
memory/2212-70-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2424-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2436-198-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2472-190-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2572-36-0x0000000000910000-0x000000000095B000-memory.dmp
memory/2572-34-0x0000000000910000-0x000000000095B000-memory.dmp
memory/2572-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2576-206-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2648-143-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/2648-189-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2648-181-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2648-145-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/2872-149-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/2872-148-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/2884-214-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2988-219-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/2988-221-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/3036-59-0x0000000000130000-0x000000000017B000-memory.dmp
memory/3036-61-0x0000000000130000-0x000000000017B000-memory.dmp
memory/3172-203-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/3172-205-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/3396-84-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/3396-81-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/3408-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3456-230-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3472-52-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/3472-50-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
memory/3728-0-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/3728-20-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/3776-107-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3812-139-0x0000000000570000-0x00000000005BB000-memory.dmp
memory/3812-138-0x0000000000570000-0x00000000005BB000-memory.dmp
memory/3952-193-0x0000000000810000-0x000000000085B000-memory.dmp
memory/3952-192-0x0000000000810000-0x000000000085B000-memory.dmp
memory/4020-114-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/4020-112-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/4200-86-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4236-209-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/4236-208-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/4240-27-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/4240-29-0x0000000000070000-0x00000000000BB000-memory.dmp
memory/4268-77-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/4268-75-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/4332-118-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/4332-121-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/4364-156-0x0000000000250000-0x000000000029B000-memory.dmp
memory/4364-157-0x0000000000250000-0x000000000029B000-memory.dmp
memory/4376-17-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4376-19-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4420-171-0x0000000000640000-0x000000000068B000-memory.dmp
memory/4420-169-0x0000000000640000-0x000000000068B000-memory.dmp
memory/4548-95-0x0000000000330000-0x000000000037B000-memory.dmp
memory/4548-92-0x0000000000330000-0x000000000037B000-memory.dmp
memory/4572-180-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/4572-178-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/4580-127-0x0000000000DD0000-0x0000000000E1B000-memory.dmp
memory/4580-130-0x0000000000DD0000-0x0000000000E1B000-memory.dmp
memory/4588-65-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4588-22-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4588-68-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4740-183-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/4740-184-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/4796-12-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4796-10-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4860-100-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/4860-105-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/4984-227-0x0000000000800000-0x000000000084B000-memory.dmp
memory/4984-229-0x0000000000800000-0x000000000084B000-memory.dmp
memory/4992-201-0x0000000000840000-0x000000000088B000-memory.dmp
memory/4992-200-0x0000000000840000-0x000000000088B000-memory.dmp