Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 15:52
General
- Target 2026-11-03_7e470cd1073b119215a9a948e7269401_elex_redline-stealer_rhadamanthys_stop.exe
- Size 226KB
- Sample261104-ta8bvsbt2t
- SHA256 e104b56abc3fdd59092c892d863cc17fbfa4fa1a25e507d2f4cf4b9f73dbf87e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_7e470cd1073b119215a9a948e7269401_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7e470cd1073b119215a9a948e7269401_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4524 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaysicavsn.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gaysicavsn.exeC:\Temp\gaysicavsn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaysicavsn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gaysicavsn.exeC:\Temp\i_gaysicavsn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnhfax.exeC:\Temp\fdxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnhfax.exeC:\Temp\i_fdxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mjecwuomeb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomeb.exeC:\Temp\mjecwuomeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mjecwuomeb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwuomeb.exeC:\Temp\i_mjecwuomeb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbvtolgd.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.exeC:\Temp\ljdbvtolgd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbvtolgd.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtolgd.exeC:\Temp\i_ljdbvtolgd.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cavsnkfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cavsnkfdxv.exeC:\Temp\cavsnkfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cavsnkfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnkfdxv.exeC:\Temp\i_cavsnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run2⤵
-
C:\Temp\smkecwupmh.exeC:\Temp\smkecwupmh.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins2⤵
-
C:\Temp\i_smkecwupmh.exeC:\Temp\i_smkecwupmh.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwrpjhb.exe ups_run2⤵
-
C:\Temp\mkecwrpjhb.exeC:\Temp\mkecwrpjhb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwrpjhb.exe ups_ins2⤵
-
C:\Temp\i_mkecwrpjhb.exeC:\Temp\i_mkecwrpjhb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run2⤵
-
C:\Temp\mkecwuomhe.exeC:\Temp\mkecwuomhe.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins2⤵
-
C:\Temp\i_mkecwuomhe.exeC:\Temp\i_mkecwuomhe.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run2⤵
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins2⤵
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtolgeywq.exe ups_run2⤵
-
C:\Temp\bvtolgeywq.exeC:\Temp\bvtolgeywq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtolgeywq.exe ups_ins2⤵
-
C:\Temp\i_bvtolgeywq.exeC:\Temp\i_bvtolgeywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run2⤵
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins2⤵
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run2⤵
-
C:\Temp\vsnlfdxvqn.exeC:\Temp\vsnlfdxvqn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins2⤵
-
C:\Temp\i_vsnlfdxvqn.exeC:\Temp\i_vsnlfdxvqn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run2⤵
-
C:\Temp\snlfdxvpni.exeC:\Temp\snlfdxvpni.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins2⤵
-
C:\Temp\i_snlfdxvpni.exeC:\Temp\i_snlfdxvpni.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run2⤵
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins2⤵
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\pnifaysqki.sysC:\Temp\pnifaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhczusmke.sysC:\Temp\pkhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqlidbvtnl.sysC:\Temp\wqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxspkica.sysC:\Temp\hfaxspkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpkhcaus.sysC:\Temp\zxrpkhcaus.sys1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
-
C:\Temp\trmjecwuom.sysC:\Temp\trmjecwuom.sys1⤵
-
C:\Temp\omgeywrojh.sysC:\Temp\omgeywrojh.sys1⤵
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
-
C:\Temp\gaysqkidav.sysC:\Temp\gaysqkidav.sys1⤵
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
-
C:\Temp\usnkfcxvpn.sysC:\Temp\usnkfcxvpn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ezxrpjhbzu.exe
ezxrpjhbzu.sys
fdxvpnhfax.exe
gaysicavsn.exe
gbytrljdbv.sys
i_ezxrpjhbzu.exe
i_fdxvpnhfax.exe
i_gaysicavsn.exe
i_jhbztrmjec.exe
i_mjecwuomeb.exe
i_pnhfzxrpkh.exe
i_ztrljdbwto.exe
jhbztrmjec.exe
ljdbvtolgd.exe
mjecwuomeb.exe
pkhczusmke.sys
pnhfzxrpkh.exe
pnifaysqki.sys
rojhbztrlj.sys
wqlidbvtnl.sys
ztrljdbwto.exe
zxspkicaus.sys
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
suggestions[1].en-US
memory/636-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/980-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1052-131-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1984-55-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2068-102-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2128-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2180-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2180-147-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2508-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3028-123-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3572-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3840-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4132-69-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4208-119-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4336-139-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4784-127-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4860-135-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5084-151-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5096-81-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5112-143-0x0000000000010000-0x0000000000083000-memory.dmp