Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 04:27
General
- Target 2026-10-01_bb6cb2fe2a01ce55c6e0bab6cc23a586_elex_redline-stealer_rhadamanthys_stop.exe
- Size 248KB
- Sample261002-e3ahzaha53
- SHA256 3795533b3ab0c4014a428d8866de2e1bc9146578c94d329e3b4fea5669704454
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 50 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_bb6cb2fe2a01ce55c6e0bab6cc23a586_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_bb6cb2fe2a01ce55c6e0bab6cc23a586_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:452 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojeywrojgb.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ojeywrojgb.exeC:\Temp\ojeywrojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojeywrojgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojeywrojgb.exeC:\Temp\i_ojeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaysqlidb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.exeC:\Temp\igaysqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaysqlidb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlidb.exeC:\Temp\i_igaysqlidb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkicavsnlf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkicavsnlf.exeC:\Temp\pkicavsnlf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkicavsnlf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkicavsnlf.exeC:\Temp\i_pkicavsnlf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faxspkicau.exeC:\Temp\faxspkicau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faxspkicau.exeC:\Temp\i_faxspkicau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkfzusmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkfzusmkec.exeC:\Temp\mkfzusmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkfzusmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkfzusmkec.exeC:\Temp\i_mkfzusmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.exeC:\Temp\ztrmjebwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjebwuo.exeC:\Temp\i_ztrmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgcwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\uomgcwuomg.exeC:\Temp\uomgcwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgcwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_uomgcwuomg.exeC:\Temp\i_uomgcwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgdytqljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\olgdytqljd.exeC:\Temp\olgdytqljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgdytqljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgdytqljd.exeC:\Temp\i_olgdytqljd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avqnifaysq.exe ups_run2⤵
-
C:\Temp\avqnifaysq.exeC:\Temp\avqnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avqnifaysq.exe ups_ins2⤵
-
C:\Temp\i_avqnifaysq.exeC:\Temp\i_avqnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysnlfaxsqk.exe ups_run2⤵
-
C:\Temp\ysnlfaxsqk.exeC:\Temp\ysnlfaxsqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysnlfaxsqk.exe ups_ins2⤵
-
C:\Temp\i_ysnlfaxsqk.exeC:\Temp\i_ysnlfaxsqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run2⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins2⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run2⤵
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins2⤵
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezwrpj.exe ups_run2⤵
-
C:\Temp\uomhezwrpj.exeC:\Temp\uomhezwrpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezwrpj.exe ups_ins2⤵
-
C:\Temp\i_uomhezwrpj.exeC:\Temp\i_uomhezwrpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjecwuomge.exe ups_run2⤵
-
C:\Temp\pjecwuomge.exeC:\Temp\pjecwuomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjecwuomge.exe ups_ins2⤵
-
C:\Temp\i_pjecwuomge.exeC:\Temp\i_pjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run2⤵
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins2⤵
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbvtolgd.exe ups_run2⤵
-
C:\Temp\ljdbvtolgd.exeC:\Temp\ljdbvtolgd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbvtolgd.exe ups_ins2⤵
-
C:\Temp\i_ljdbvtolgd.exeC:\Temp\i_ljdbvtolgd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidbvqo.exe ups_run2⤵
-
C:\Temp\ysqkidbvqo.exeC:\Temp\ysqkidbvqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkhc.sysC:\Temp\nhfzxspkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrmjecwu.sysC:\Temp\bztrmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigaytqli.sysC:\Temp\toigaytqli.sys1⤵
-
C:\Temp\fdxvqnigay.sysC:\Temp\fdxvqnigay.sys1⤵
-
C:\Temp\usnkfcxvpn.sysC:\Temp\usnkfcxvpn.sys1⤵
-
C:\Temp\kecxupnhfz.sysC:\Temp\kecxupnhfz.sys1⤵
-
C:\Temp\nhfzxrpkhc.sysC:\Temp\nhfzxrpkhc.sys1⤵
-
C:\Temp\zuomgezwrp.sysC:\Temp\zuomgezwrp.sys1⤵
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
-
C:\Temp\qljdbnlfdy.sysC:\Temp\qljdbnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bvtnlgdywq.exe
faxspkicau.exe
i_bvtnlgdywq.exe
i_faxspkicau.exe
i_igaysqlidb.exe
i_mkfzusmkec.exe
i_ojeywrojgb.exe
i_pkicavsnlf.exe
i_snlfdxvpni.exe
igaysqlidb.exe
igaysqlidb.sys
jdbvtolgey.sys
mkfzusmkec.exe
nhfzxspkhc.sys
ojeywrojgb.exe
pkicavsnlf.exe
rmkecwupmh.sys
snlfdxvpni.exe
tnlgdywqoi.sys
xrpkhcausm.sys
xvpnhfaxsq.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
RecoveryStore.{91BEBD38-BE19-11F1-8D83-6E24823C6C3E}.dat
RecoveryStore.{91C38845-BE19-11F1-8D83-6E24823C6C3E}.dat
suggestions[1].en-US
memory/516-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2544-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2552-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2784-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2920-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2944-169-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3056-111-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3296-115-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3308-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3376-73-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4192-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4192-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4400-165-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4556-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4684-87-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4788-173-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4828-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4828-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4960-140-0x0000000000010000-0x0000000000083000-memory.dmp