Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
31/10/2026, 04:38
General
- Target 2026-10-30_46b75e956bb6aa8f90d75b467161322c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-e9fcssg15w
- SHA256 d6e6c756e9d38c4bd40b58699b1348da610d6109dd3bed10ee8eb33dfef355dd
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 55 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_46b75e956bb6aa8f90d75b467161322c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_46b75e956bb6aa8f90d75b467161322c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nifaysqkicavsnlf.exeC:\Temp\nifaysqkicavsnlf.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxupnhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecxupnhca.exeC:\Temp\kecxupnhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxupnhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecxupnhca.exeC:\Temp\i_kecxupnhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhezxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wupmhezxrp.exeC:\Temp\wupmhezxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhezxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhezxrp.exeC:\Temp\i_wupmhezxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgbz.exeC:\Temp\jecwuomgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuomgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jecwuomgbz.exeC:\Temp\i_jecwuomgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtol.exeC:\Temp\trljdbwtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtol.exeC:\Temp\i_trljdbwtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtgeyw.exeC:\Temp\ljdbvtgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtgeyw.exeC:\Temp\i_ljdbvtgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigayt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavsnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidavsnlf.exeC:\Temp\qkidavsnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavsnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavsnlf.exeC:\Temp\i_qkidavsnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausmcxu.exeC:\Temp\kicausmcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmcxu.exe ups_ins3⤵
-
C:\Temp\i_kicausmcxu.exeC:\Temp\i_kicausmcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezxrp.exe ups_run3⤵
-
C:\Temp\wuomhezxrp.exeC:\Temp\wuomhezxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezxrp.exe ups_ins3⤵
-
C:\Temp\i_wuomhezxrp.exeC:\Temp\i_wuomhezxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrojhb.exe ups_run3⤵
-
C:\Temp\mgezwrojhb.exeC:\Temp\mgezwrojhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrojhb.exe ups_ins3⤵
-
C:\Temp\i_mgezwrojhb.exeC:\Temp\i_mgezwrojhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojyt.exe ups_run3⤵
-
C:\Temp\mgeywrojyt.exeC:\Temp\mgeywrojyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrojyt.exe ups_ins3⤵
-
C:\Temp\i_mgeywrojyt.exeC:\Temp\i_mgeywrojyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins3⤵
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run3⤵
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run3⤵
-
C:\Temp\snkfcxvpnh.exeC:\Temp\snkfcxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins3⤵
-
C:\Temp\i_snkfcxvpnh.exeC:\Temp\i_snkfcxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run3⤵
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5296 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\nifaysqkicavsnlf.sysC:\Temp\nifaysqkicavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnifa.sysC:\Temp\kfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrmj.sysC:\Temp\rojhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojht.sysC:\Temp\mgeywrojht.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.sysC:\Temp\wqoigbytrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaysq.sysC:\Temp\xvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaqk.sysC:\Temp\dxvpnifaqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.sysC:\Temp\vpnhfaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
-
C:\Temp\ecwuomgezw.sysC:\Temp\ecwuomgezw.sys1⤵
-
C:\Temp\ebwuomgezw.sysC:\Temp\ebwuomgezw.sys1⤵
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\fdyvqnigay.sysC:\Temp\fdyvqnigay.sys1⤵
-
C:\Temp\axsqkicaus.sysC:\Temp\axsqkicaus.sys1⤵
-
C:\Temp\upnhfzxspk.sysC:\Temp\upnhfzxspk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
dyvqoigayt.exe
hczusmkecw.sys
i_jecwuomgbz.exe
i_kecxupnhca.exe
i_ljdbvtgeyw.exe
i_smkfcxvpnh.exe
i_trljdbwtol.exe
i_vsnlfdxvpn.exe
i_wupmhezxrp.exe
jecwuomgbz.exe
kecxupnhca.exe
kfdxvpnifa.sys
ljdbvtgeyw.exe
ljdbvtnlgd.sys
mgeywrojht.sys
nifaysqkicavsnlf.exe
nifaysqkicavsnlf.sys
rojhbztrmj.sys
smkfcxvpnh.exe
spkicausmk.sys
trljdbwtol.exe
vsnlfdxvpn.exe
wqoigbytrl.sys
wupmhezxrp.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
known_providers_download_v1[1].xml
favicon[1].ico
memory/1460-179-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1476-134-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1792-128-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1924-73-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2036-167-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2036-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2460-61-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-104-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2992-49-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3744-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-171-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4168-90-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4312-153-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4700-166-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-14-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5488-175-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5836-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5836-149-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5936-187-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-116-0x0000000000010000-0x00000000000AB000-memory.dmp