Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 15:12
General
- Target 2026-10-02_2ed9d98c6e3ef98721a8fb59a58d0606_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample261003-slbats1epd
- SHA256 892ab56b0aca827c07800dc4bada62c79645a14ed731316442749296d68973b6
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_2ed9d98c6e3ef98721a8fb59a58d0606_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_2ed9d98c6e3ef98721a8fb59a58d0606_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqnigbvt.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dyvqnigbvt.exeC:\Temp\dyvqnigbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqnigbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqnigbvt.exeC:\Temp\i_dyvqnigbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdysqki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\snlfdysqki.exeC:\Temp\snlfdysqki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdysqki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_snlfdysqki.exeC:\Temp\i_snlfdysqki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fcxupnhfzx.exeC:\Temp\fcxupnhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fcxupnhfzx.exeC:\Temp\i_fcxupnhfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpkecxupn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpkecxupn.exeC:\Temp\xvpkecxupn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpkecxupn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpkecxupn.exeC:\Temp\i_xvpkecxupn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omgeywrojg.exeC:\Temp\omgeywrojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywrojg.exeC:\Temp\i_omgeywrojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbytqljdbv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.exeC:\Temp\gbytqljdbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbytqljdbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqljdbv.exeC:\Temp\i_gbytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnifaysq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaysq.exeC:\Temp\xvpnifaysq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnifaysq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifaysq.exeC:\Temp\i_xvpnifaysq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sfzxrpkhca.exe ups_run2⤵
-
C:\Temp\sfzxrpkhca.exeC:\Temp\sfzxrpkhca.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sfzxrpkhca.exe ups_ins2⤵
-
C:\Temp\i_sfzxrpkhca.exeC:\Temp\i_sfzxrpkhca.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khczusmkec.exe ups_run2⤵
-
C:\Temp\khczusmkec.exeC:\Temp\khczusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khczusmkec.exe ups_ins2⤵
-
C:\Temp\i_khczusmkec.exeC:\Temp\i_khczusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run2⤵
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins2⤵
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zwrojhbztr.exe ups_run2⤵
-
C:\Temp\zwrojhbztr.exeC:\Temp\zwrojhbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zwrojhbztr.exe ups_ins2⤵
-
C:\Temp\i_zwrojhbztr.exeC:\Temp\i_zwrojhbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoiytql.exe ups_run2⤵
-
C:\Temp\eywqoiytql.exeC:\Temp\eywqoiytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqoiytql.exe ups_ins2⤵
-
C:\Temp\i_eywqoiytql.exeC:\Temp\i_eywqoiytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqljdbvtol.exe ups_run2⤵
-
C:\Temp\wqljdbvtol.exeC:\Temp\wqljdbvtol.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqljdbvtol.exe ups_ins2⤵
-
C:\Temp\i_wqljdbvtol.exeC:\Temp\i_wqljdbvtol.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run2⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins2⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run2⤵
-
C:\Temp\kicavsnlfd.exeC:\Temp\kicavsnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins2⤵
-
C:\Temp\i_kicavsnlfd.exeC:\Temp\i_kicavsnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausnkfv.exe ups_run2⤵
-
C:\Temp\kicausnkfv.exeC:\Temp\kicausnkfv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausnkfv.exe ups_ins2⤵
-
C:\Temp\i_kicausnkfv.exeC:\Temp\i_kicausnkfv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\davtnifays.sysC:\Temp\davtnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsnkfdxusn.sysC:\Temp\xsnkfdxusn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkfcx.sysC:\Temp\hcausmkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.sysC:\Temp\xupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\htolgeywqo.sysC:\Temp\htolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.sysC:\Temp\idavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\icankfdxvp.sysC:\Temp\icankfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
-
C:\Temp\rmgezwjgbz.sysC:\Temp\rmgezwjgbz.sys1⤵
-
C:\Temp\ljdbwtomge.sysC:\Temp\ljdbwtomge.sys1⤵
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
-
C:\Temp\ysqlidbvtn.sysC:\Temp\ysqlidbvtn.sys1⤵
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
davtnifays.sys
dyvqnigbvt.exe
ezwrpjhbzt.exe
fcxupnhfzx.exe
gbytqljdbv.exe
gezwrojhbz.sys
hcausmkfcx.sys
htolgeywqo.sys
i_dyvqnigbvt.exe
i_ezwrpjhbzt.exe
i_fcxupnhfzx.exe
i_mkecwupmhe.exe
i_omgeywrojg.exe
i_snlfdysqki.exe
i_xvpkecxupn.exe
mkecwupmhe.exe
omgeywrojg.exe
snlfdysqki.exe
wtomgeywqo.sys
xsnkfdxusn.sys
xupmhfzxrp.sys
xvpkecxupn.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/544-98-0x0000000000010000-0x0000000000083000-memory.dmp
memory/716-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/872-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1640-74-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2120-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2196-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2360-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2552-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2772-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3092-86-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3116-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3256-60-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3328-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3416-19-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3728-31-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3868-107-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4224-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4708-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5108-164-0x0000000000010000-0x0000000000083000-memory.dmp