Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 11:25
General
- Target 2026-10-26_966306a47b16c5d46bb6f14844659b49_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample261027-njfejsdd27
- SHA256 f95c2acc38d9f8bde87e2fec3bda203f9f701a2a1a4c64ac3a780eae2cf84cda
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_966306a47b16c5d46bb6f14844659b49_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_966306a47b16c5d46bb6f14844659b49_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4132 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfdxvpkfcx.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\kfdxvpkfcx.exeC:\Temp\kfdxvpkfcx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfdxvpkfcx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kfdxvpkfcx.exeC:\Temp\i_kfdxvpkfcx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfzx.exeC:\Temp\ecxupnhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupnhfzx.exeC:\Temp\i_ecxupnhfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmk.exeC:\Temp\rpjhbzurmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurmk.exeC:\Temp\i_rpjhbzurmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrmgezwrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrmgezwrp.exeC:\Temp\ztrmgezwrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrmgezwrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmgezwrp.exeC:\Temp\i_ztrmgezwrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.exeC:\Temp\ojgbztrljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbztrljd.exeC:\Temp\i_ojgbztrljd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.exeC:\Temp\jdbwtomgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtomgey.exeC:\Temp\i_jdbwtomgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqni.exeC:\Temp\tnlfdyvqni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdyvqni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdyvqni.exeC:\Temp\i_tnlfdyvqni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfd.exeC:\Temp\kicausnkfd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kicausnkfd.exeC:\Temp\i_kicausnkfd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run2⤵
-
C:\Temp\uomhezxrpj.exeC:\Temp\uomhezxrpj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins2⤵
-
C:\Temp\i_uomhezxrpj.exeC:\Temp\i_uomhezxrpj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lgeywqojgb.exe ups_run2⤵
-
C:\Temp\lgeywqojgb.exeC:\Temp\lgeywqojgb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lgeywqojgb.exe ups_ins2⤵
-
C:\Temp\i_lgeywqojgb.exeC:\Temp\i_lgeywqojgb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run2⤵
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins2⤵
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run2⤵
-
C:\Temp\vtolgdywqo.exeC:\Temp\vtolgdywqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins2⤵
-
C:\Temp\i_vtolgdywqo.exeC:\Temp\i_vtolgdywqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run2⤵
-
C:\Temp\tnlfdyvqni.exeC:\Temp\tnlfdyvqni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tnlfdyvqni.exe ups_ins2⤵
-
C:\Temp\i_tnlfdyvqni.exeC:\Temp\i_tnlfdyvqni.exe ups_ins3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run2⤵
-
C:\Temp\kicavsnlfd.exeC:\Temp\kicavsnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins2⤵
-
C:\Temp\i_kicavsnlfd.exeC:\Temp\i_kicavsnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkicavsnkf.exe ups_run2⤵
-
C:\Temp\qkicavsnkf.exeC:\Temp\qkicavsnkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkicavsnkf.exe ups_ins2⤵
-
C:\Temp\i_qkicavsnkf.exeC:\Temp\i_qkicavsnkf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run2⤵
-
C:\Temp\kfcxupnhfz.exeC:\Temp\kfcxupnhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins2⤵
-
C:\Temp\i_kfcxupnhfz.exeC:\Temp\i_kfcxupnhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzurmkecwu.exe ups_run2⤵
-
C:\Temp\bzurmkecwu.exeC:\Temp\bzurmkecwu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzurmkecwu.exe ups_ins2⤵
-
C:\Temp\i_bzurmkecwu.exeC:\Temp\i_bzurmkecwu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\pnhfaxspki.sysC:\Temp\pnhfaxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzusmkecwu.sysC:\Temp\fzusmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjecw.sysC:\Temp\hbztrmjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.sysC:\Temp\idbvtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvq.sysC:\Temp\avsnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifays.sysC:\Temp\dxvqnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.sysC:\Temp\cwuomgezwr.sys1⤵
-
C:\Temp\ezwrpjhbzt.sysC:\Temp\ezwrpjhbzt.sys1⤵
-
C:\Temp\wrojgbztrl.sysC:\Temp\wrojgbztrl.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
-
C:\Temp\rpkicausmk.sysC:\Temp\rpkicausmk.sys1⤵
-
C:\Temp\mhezxrpjhc.sysC:\Temp\mhezxrpjhc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
avsnlfdxvq.sys
bvtnlgdywq.exe
ecxupnhfzx.exe
fzusmkecwu.sys
hbztrmjecw.sys
i_bvtnlgdywq.exe
i_ecxupnhfzx.exe
i_jdbwtomgey.exe
i_kfdxvpkfcx.exe
i_ojgbztrljd.exe
i_rpjhbzurmk.exe
i_ztrmgezwrp.exe
idbvtnlfdy.sys
jdbwtomgey.exe
jecwuomhez.sys
kfdxvpkfcx.exe
ojgbztrljd.exe
pnhfaxspki.sys
rljdbvtolg.sys
rpjhbzurmk.exe
tnlfdyvqni.exe
ztrmgezwrp.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
known_providers_download_v1[1].xml
favicon[1].ico
memory/1180-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1628-159-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2328-54-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2972-150-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2972-155-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3260-97-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3656-179-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3776-66-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4316-167-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4348-143-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4348-130-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4348-175-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4424-146-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4592-171-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4692-183-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4868-109-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4992-83-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5292-42-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5496-163-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5596-154-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5912-121-0x0000000000010000-0x0000000000083000-memory.dmp