Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 03:50
General
- Target 2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample261014-eee4jsvx6q
- SHA256 5874c05bfcfe824826b756da1e60a384e999dc2ffd32d3725a925892ee034782
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3468 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkidxvq.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\aysqkidxvq.exeC:\Temp\aysqkidxvq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkidxvq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkidxvq.exeC:\Temp\i_aysqkidxvq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smhfzxrpje.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\smhfzxrpje.exeC:\Temp\smhfzxrpje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smhfzxrpje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_smhfzxrpje.exeC:\Temp\i_smhfzxrpje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhezxrpjhc.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.exeC:\Temp\mhezxrpjhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhezxrpjhc.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhc.exeC:\Temp\i_mhezxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrmjebwuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrmjebwuom.exeC:\Temp\wrmjebwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrmjebwuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrmjebwuom.exeC:\Temp\i_wrmjebwuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywrojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywrojgbz.exeC:\Temp\geywrojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywrojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywrojgbz.exeC:\Temp\i_geywrojgbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qnigaysqli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqli.exeC:\Temp\qnigaysqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qnigaysqli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqli.exeC:\Temp\i_qnigaysqli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkhcaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkhcaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run2⤵
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins2⤵
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run2⤵
-
C:\Temp\wrpjhbztrm.exeC:\Temp\wrpjhbztrm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins2⤵
-
C:\Temp\i_wrpjhbztrm.exeC:\Temp\i_wrpjhbztrm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run2⤵
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins2⤵
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run2⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins2⤵
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqoigayki.exe ups_run2⤵
-
C:\Temp\yvqoigayki.exeC:\Temp\yvqoigayki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqoigayki.exe ups_ins2⤵
-
C:\Temp\i_yvqoigayki.exeC:\Temp\i_yvqoigayki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run2⤵
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins2⤵
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicavsnkfd.exe ups_run2⤵
-
C:\Temp\kicavsnkfd.exeC:\Temp\kicavsnkfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicavsnkfd.exe ups_ins2⤵
-
C:\Temp\i_kicavsnkfd.exeC:\Temp\i_kicavsnkfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupkhcaus.exe ups_run2⤵
-
C:\Temp\cxupkhcaus.exeC:\Temp\cxupkhcaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupkhcaus.exe ups_ins2⤵
-
C:\Temp\i_cxupkhcaus.exeC:\Temp\i_cxupkhcaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run2⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins2⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\khcausmkfc.sysC:\Temp\khcausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.sysC:\Temp\hcausmkecx.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljdb.sysC:\Temp\jgbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\snhfzxspkh.sysC:\Temp\snhfzxspkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhc.sysC:\Temp\mhfzxrpjhc.sys1⤵
-
C:\Temp\ywqojgbztr.sysC:\Temp\ywqojgbztr.sys1⤵
-
C:\Temp\ywqojgbytr.sysC:\Temp\ywqojgbytr.sys1⤵
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
-
C:\Temp\vqkicausnk.sysC:\Temp\vqkicausnk.sys1⤵
-
C:\Temp\mhfzxrpkhc.sysC:\Temp\mhfzxrpkhc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqkidxvq.exe
cxvpnhfzxs.exe
ecwuomhezw.sys
geywrojgbz.exe
hcausmkecx.sys
i_aysqkidxvq.exe
i_cxvpnhfzxs.exe
i_geywrojgbz.exe
i_mhezxrpjhc.exe
i_smhfzxrpje.exe
i_tnlgdywqoi.exe
i_wrmjebwuom.exe
jgbytrljdb.sys
khcausmkfc.sys
mhezxrpjhc.exe
qnigaysqli.exe
rljdbwtomg.sys
smhfzxrpje.exe
tnlgdywqoi.exe
usmkecwupm.sys
wrmjebwuom.exe
yvqoigaysq.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/616-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/752-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1424-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1476-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1520-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1520-134-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2116-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2260-138-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2792-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3024-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3064-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3404-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3404-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3404-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4004-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4332-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4460-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5004-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5048-159-0x0000000000010000-0x0000000000083000-memory.dmp