428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa

Analysis

max time kernel
47s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
Size 10.4MB
Sample260701-ybat7sft31
SHA256 428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa
MD5 36af28bce1b8035911794594c359adae
SHA1 6c3e6078a1f08387ef0205419a860ab5f8f98bf0
SHA512 71c4ef07de82179b272b274a2a5e402867021c25d04c530f6ee0536c9564aac4e1c07d7d06cd31196c31ff73b9338b6cfc037fb0435cdfa0140f08e09bbd7234
SSDEEP 196608:XZGmuQsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSM:XZGnQsREJLODBWlX3d+NpvdHIoJ
TLSH
T183B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 24 IoCs

pid	Process
1344	oqzhmfpgvg.exe
820	oqzhmfpgvg.exe
4196	bonqrjakcr.exe
1804	bonqrjakcr.exe
1276	jbhpxojrxm.exe
1628	jbhpxojrxm.exe
5488	owowrbpfmr.exe
5460	owowrbpfmr.exe
3168	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
6100	tsxroidlmh.exe
5956	tsxroidlmh.exe
3848	oklynortcm.exe
1644	oklynortcm.exe
2500	snpvzlwhhk.exe
4972	snpvzlwhhk.exe
4412	nucnbhtdtt.exe
5588	nucnbhtdtt.exe
1612	adsjqqckmr.exe
3424	adsjqqckmr.exe
5952	spblsbrakk.exe
5400	spblsbrakk.exe
1544	knxydoqhvf.exe
3580	knxydoqhvf.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

pid	Process
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1052	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1344	oqzhmfpgvg.exe
820	oqzhmfpgvg.exe
4196	bonqrjakcr.exe
1804	bonqrjakcr.exe
1276	jbhpxojrxm.exe
1628	jbhpxojrxm.exe
5488	owowrbpfmr.exe
5460	owowrbpfmr.exe
3168	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
6100	tsxroidlmh.exe
5956	tsxroidlmh.exe
3848	oklynortcm.exe
1644	oklynortcm.exe
2500	snpvzlwhhk.exe
4972	snpvzlwhhk.exe
4412	nucnbhtdtt.exe
5588	nucnbhtdtt.exe
1612	adsjqqckmr.exe
3424	adsjqqckmr.exe
5952	spblsbrakk.exe
5400	spblsbrakk.exe
1544	knxydoqhvf.exe
3580	knxydoqhvf.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spblsbrakk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knxydoqhvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oqzhmfpgvg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bonqrjakcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	owowrbpfmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snpvzlwhhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nucnbhtdtt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nucnbhtdtt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsxroidlmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adsjqqckmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spblsbrakk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knxydoqhvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oqzhmfpgvg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bonqrjakcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jbhpxojrxm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jbhpxojrxm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	owowrbpfmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqikbuqxpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqikbuqxpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsxroidlmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oklynortcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oklynortcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snpvzlwhhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adsjqqckmr.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{C28426C6-9FD1-4276-B6F8-747DB1264AA5}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1052	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1052	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1344	oqzhmfpgvg.exe
1344	oqzhmfpgvg.exe
1344	oqzhmfpgvg.exe
1344	oqzhmfpgvg.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
820	oqzhmfpgvg.exe
820	oqzhmfpgvg.exe
4196	bonqrjakcr.exe
4196	bonqrjakcr.exe
4196	bonqrjakcr.exe
4196	bonqrjakcr.exe
1344	oqzhmfpgvg.exe
1344	oqzhmfpgvg.exe
1804	bonqrjakcr.exe
1804	bonqrjakcr.exe
1276	jbhpxojrxm.exe
1276	jbhpxojrxm.exe
1276	jbhpxojrxm.exe
1276	jbhpxojrxm.exe
4196	bonqrjakcr.exe
4196	bonqrjakcr.exe
1628	jbhpxojrxm.exe
1628	jbhpxojrxm.exe
5488	owowrbpfmr.exe
5488	owowrbpfmr.exe
1276	jbhpxojrxm.exe
1276	jbhpxojrxm.exe
5488	owowrbpfmr.exe
5488	owowrbpfmr.exe
5460	owowrbpfmr.exe
5460	owowrbpfmr.exe
3168	wqikbuqxpd.exe
3168	wqikbuqxpd.exe
3168	wqikbuqxpd.exe
3168	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
5488	owowrbpfmr.exe
5488	owowrbpfmr.exe
6100	tsxroidlmh.exe
6100	tsxroidlmh.exe
6100	tsxroidlmh.exe
6100	tsxroidlmh.exe
5956	tsxroidlmh.exe
5956	tsxroidlmh.exe
3168	wqikbuqxpd.exe
3168	wqikbuqxpd.exe
3848	oklynortcm.exe
3848	oklynortcm.exe
3848	oklynortcm.exe
3848	oklynortcm.exe
1644	oklynortcm.exe
1644	oklynortcm.exe
6100	tsxroidlmh.exe
6100	tsxroidlmh.exe
2500	snpvzlwhhk.exe
2500	snpvzlwhhk.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5516	explorer.exe
Token: SeCreatePagefilePrivilege	5516	explorer.exe
Token: SeShutdownPrivilege	5516	explorer.exe
Token: SeCreatePagefilePrivilege	5516	explorer.exe
Token: SeShutdownPrivilege	5516	explorer.exe
Token: SeCreatePagefilePrivilege	5516	explorer.exe
Token: SeShutdownPrivilege	5516	explorer.exe
Token: SeCreatePagefilePrivilege	5516	explorer.exe
Token: SeShutdownPrivilege	5516	explorer.exe
Token: SeCreatePagefilePrivilege	5516	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1464	sihost.exe
5516	explorer.exe
5516	explorer.exe

Suspicious use of SetWindowsHookEx 52 IoCs

pid	Process
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1052	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1052	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
1344	oqzhmfpgvg.exe
1344	oqzhmfpgvg.exe
820	oqzhmfpgvg.exe
820	oqzhmfpgvg.exe
4196	bonqrjakcr.exe
4196	bonqrjakcr.exe
1804	bonqrjakcr.exe
1804	bonqrjakcr.exe
1276	jbhpxojrxm.exe
1276	jbhpxojrxm.exe
1628	jbhpxojrxm.exe
1628	jbhpxojrxm.exe
5488	owowrbpfmr.exe
5488	owowrbpfmr.exe
5460	owowrbpfmr.exe
5460	owowrbpfmr.exe
3168	wqikbuqxpd.exe
3168	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
2916	wqikbuqxpd.exe
6100	tsxroidlmh.exe
6100	tsxroidlmh.exe
5956	tsxroidlmh.exe
5956	tsxroidlmh.exe
3848	oklynortcm.exe
3848	oklynortcm.exe
1644	oklynortcm.exe
1644	oklynortcm.exe
2500	snpvzlwhhk.exe
2500	snpvzlwhhk.exe
4972	snpvzlwhhk.exe
4972	snpvzlwhhk.exe
4412	nucnbhtdtt.exe
4412	nucnbhtdtt.exe
5588	nucnbhtdtt.exe
5588	nucnbhtdtt.exe
1612	adsjqqckmr.exe
1612	adsjqqckmr.exe
3424	adsjqqckmr.exe
3424	adsjqqckmr.exe
5952	spblsbrakk.exe
5952	spblsbrakk.exe
5400	spblsbrakk.exe
5400	spblsbrakk.exe
1544	knxydoqhvf.exe
1544	knxydoqhvf.exe
3580	knxydoqhvf.exe
3580	knxydoqhvf.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1052	3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe	88
PID 3660 wrote to memory of 1344	3660	428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe	89
PID 1344 wrote to memory of 820	1344	oqzhmfpgvg.exe	90
PID 1344 wrote to memory of 4196	1344	oqzhmfpgvg.exe	91
PID 4196 wrote to memory of 1804	4196	bonqrjakcr.exe	92
PID 4196 wrote to memory of 1276	4196	bonqrjakcr.exe	93
PID 1276 wrote to memory of 1628	1276	jbhpxojrxm.exe	94
PID 1276 wrote to memory of 5488	1276	jbhpxojrxm.exe	95
PID 5488 wrote to memory of 5460	5488	owowrbpfmr.exe	96
PID 5488 wrote to memory of 3168	5488	owowrbpfmr.exe	97
PID 3168 wrote to memory of 2916	3168	wqikbuqxpd.exe	98
PID 3168 wrote to memory of 6100	3168	wqikbuqxpd.exe	99
PID 6100 wrote to memory of 5956	6100	tsxroidlmh.exe	100
PID 6100 wrote to memory of 3848	6100	tsxroidlmh.exe	101
PID 3848 wrote to memory of 1644	3848	oklynortcm.exe	102
PID 3848 wrote to memory of 2500	3848	oklynortcm.exe	104
PID 2500 wrote to memory of 4972	2500	snpvzlwhhk.exe	105
PID 2500 wrote to memory of 4412	2500	snpvzlwhhk.exe	106
PID 4412 wrote to memory of 5588	4412	nucnbhtdtt.exe	107
PID 4412 wrote to memory of 1612	4412	nucnbhtdtt.exe	111
PID 1612 wrote to memory of 3424	1612	adsjqqckmr.exe	112
PID 1612 wrote to memory of 5952	1612	adsjqqckmr.exe	114
PID 5952 wrote to memory of 5400	5952	spblsbrakk.exe	115
PID 5952 wrote to memory of 1544	5952	spblsbrakk.exe	116
PID 1544 wrote to memory of 3580	1544	knxydoqhvf.exe	117
PID 1464 wrote to memory of 5516	1464	sihost.exe	118

C:\Users\Admin\AppData\Local\Temp\428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
"C:\Users\Admin\AppData\Local\Temp\428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe
  C:\Users\Admin\AppData\Local\Temp\428311a91d99fbb00058254b041cae1c82a8141bd7e5201be81b86f0553dddaa.exe update oqzhmfpgvg.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\oqzhmfpgvg.exe
  C:\Users\Admin\AppData\Local\Temp\oqzhmfpgvg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\oqzhmfpgvg.exe
    C:\Users\Admin\AppData\Local\Temp\oqzhmfpgvg.exe update bonqrjakcr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\bonqrjakcr.exe
    C:\Users\Admin\AppData\Local\Temp\bonqrjakcr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\bonqrjakcr.exe
      C:\Users\Admin\AppData\Local\Temp\bonqrjakcr.exe update jbhpxojrxm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\jbhpxojrxm.exe
      C:\Users\Admin\AppData\Local\Temp\jbhpxojrxm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\jbhpxojrxm.exe
        
        C:\Users\Admin\AppData\Local\Temp\jbhpxojrxm.exe update owowrbpfmr.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\owowrbpfmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\owowrbpfmr.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\owowrbpfmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\owowrbpfmr.exe update wqikbuqxpd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\wqikbuqxpd.exe
        
        C:\Users\Admin\AppData\Local\Temp\wqikbuqxpd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\wqikbuqxpd.exe
        
        C:\Users\Admin\AppData\Local\Temp\wqikbuqxpd.exe update tsxroidlmh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\tsxroidlmh.exe
        
        C:\Users\Admin\AppData\Local\Temp\tsxroidlmh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\tsxroidlmh.exe
        
        C:\Users\Admin\AppData\Local\Temp\tsxroidlmh.exe update oklynortcm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\oklynortcm.exe
        
        C:\Users\Admin\AppData\Local\Temp\oklynortcm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\oklynortcm.exe
        
        C:\Users\Admin\AppData\Local\Temp\oklynortcm.exe update snpvzlwhhk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\snpvzlwhhk.exe
        
        C:\Users\Admin\AppData\Local\Temp\snpvzlwhhk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\snpvzlwhhk.exe
        
        C:\Users\Admin\AppData\Local\Temp\snpvzlwhhk.exe update nucnbhtdtt.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\nucnbhtdtt.exe
        
        C:\Users\Admin\AppData\Local\Temp\nucnbhtdtt.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\nucnbhtdtt.exe
        
        C:\Users\Admin\AppData\Local\Temp\nucnbhtdtt.exe update adsjqqckmr.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\adsjqqckmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\adsjqqckmr.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\adsjqqckmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\adsjqqckmr.exe update spblsbrakk.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\spblsbrakk.exe
        
        C:\Users\Admin\AppData\Local\Temp\spblsbrakk.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\spblsbrakk.exe
        
        C:\Users\Admin\AppData\Local\Temp\spblsbrakk.exe update knxydoqhvf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\knxydoqhvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\knxydoqhvf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\knxydoqhvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\knxydoqhvf.exe update syrhpjpcih.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\syrhpjpcih.exe
        
        C:\Users\Admin\AppData\Local\Temp\syrhpjpcih.exe
        14⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\syrhpjpcih.exe
        
        C:\Users\Admin\AppData\Local\Temp\syrhpjpcih.exe update fujquqrqhr.exe
        15⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\fujquqrqhr.exe
        
        C:\Users\Admin\AppData\Local\Temp\fujquqrqhr.exe
        15⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\fujquqrqhr.exe
        
        C:\Users\Admin\AppData\Local\Temp\fujquqrqhr.exe update urdgjkltgg.exe
        16⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\urdgjkltgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\urdgjkltgg.exe
        16⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\urdgjkltgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\urdgjkltgg.exe update putcfizuzo.exe
        17⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\putcfizuzo.exe
        
        C:\Users\Admin\AppData\Local\Temp\putcfizuzo.exe
        17⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\putcfizuzo.exe
        
        C:\Users\Admin\AppData\Local\Temp\putcfizuzo.exe update tvlsfeeiei.exe
        18⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\tvlsfeeiei.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvlsfeeiei.exe
        18⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\tvlsfeeiei.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvlsfeeiei.exe update wfmbvhppam.exe
        19⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\wfmbvhppam.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfmbvhppam.exe
        19⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\wfmbvhppam.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfmbvhppam.exe update gnzzesaptm.exe
        20⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe
        
        C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe
        20⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe
        
        C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe update ocglgmnwbt.exe
        21⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\ocglgmnwbt.exe
        
        C:\Users\Admin\AppData\Local\Temp\ocglgmnwbt.exe
        21⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\ocglgmnwbt.exe
        
        C:\Users\Admin\AppData\Local\Temp\ocglgmnwbt.exe update bqlkrwgrtt.exe
        22⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\bqlkrwgrtt.exe
        
        C:\Users\Admin\AppData\Local\Temp\bqlkrwgrtt.exe
        22⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\bqlkrwgrtt.exe
        
        C:\Users\Admin\AppData\Local\Temp\bqlkrwgrtt.exe update dbxjlfchrr.exe
        23⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\dbxjlfchrr.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbxjlfchrr.exe
        23⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\dbxjlfchrr.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbxjlfchrr.exe update bzpudguows.exe
        24⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\bzpudguows.exe
        
        C:\Users\Admin\AppData\Local\Temp\bzpudguows.exe
        24⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\bzpudguows.exe
        
        C:\Users\Admin\AppData\Local\Temp\bzpudguows.exe update tdfqcxingk.exe
        25⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\tdfqcxingk.exe
        
        C:\Users\Admin\AppData\Local\Temp\tdfqcxingk.exe
        25⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\tdfqcxingk.exe
        
        C:\Users\Admin\AppData\Local\Temp\tdfqcxingk.exe update vqsqlkewig.exe
        26⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\vqsqlkewig.exe
        
        C:\Users\Admin\AppData\Local\Temp\vqsqlkewig.exe
        26⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\vqsqlkewig.exe
        
        C:\Users\Admin\AppData\Local\Temp\vqsqlkewig.exe update baleyxflfz.exe
        27⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\baleyxflfz.exe
        
        C:\Users\Admin\AppData\Local\Temp\baleyxflfz.exe
        27⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\baleyxflfz.exe
        
        C:\Users\Admin\AppData\Local\Temp\baleyxflfz.exe update dopezsbuhd.exe
        28⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\dopezsbuhd.exe
        
        C:\Users\Admin\AppData\Local\Temp\dopezsbuhd.exe
        28⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\dopezsbuhd.exe
        
        C:\Users\Admin\AppData\Local\Temp\dopezsbuhd.exe update vlpdnhhayz.exe
        29⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\vlpdnhhayz.exe
        
        C:\Users\Admin\AppData\Local\Temp\vlpdnhhayz.exe
        29⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\vlpdnhhayz.exe
        
        C:\Users\Admin\AppData\Local\Temp\vlpdnhhayz.exe update qutdqrydin.exe
        30⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\qutdqrydin.exe
        
        C:\Users\Admin\AppData\Local\Temp\qutdqrydin.exe
        30⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\qutdqrydin.exe
        
        C:\Users\Admin\AppData\Local\Temp\qutdqrydin.exe update ingzdqrgrf.exe
        31⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\ingzdqrgrf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ingzdqrgrf.exe
        31⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\ingzdqrgrf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ingzdqrgrf.exe update irnswrqbsq.exe
        32⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\irnswrqbsq.exe
        
        C:\Users\Admin\AppData\Local\Temp\irnswrqbsq.exe
        32⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\irnswrqbsq.exe
        
        C:\Users\Admin\AppData\Local\Temp\irnswrqbsq.exe update dbrtzagmuw.exe
        33⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\dbrtzagmuw.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbrtzagmuw.exe
        33⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\dbrtzagmuw.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbrtzagmuw.exe update sycwcmvfyn.exe
        34⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\sycwcmvfyn.exe
        
        C:\Users\Admin\AppData\Local\Temp\sycwcmvfyn.exe
        34⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\sycwcmvfyn.exe
        
        C:\Users\Admin\AppData\Local\Temp\sycwcmvfyn.exe update ivvhghrruw.exe
        35⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\ivvhghrruw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ivvhghrruw.exe
        35⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\ivvhghrruw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ivvhghrruw.exe update yqtnbjamfy.exe
        36⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\yqtnbjamfy.exe
        
        C:\Users\Admin\AppData\Local\Temp\yqtnbjamfy.exe
        36⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\yqtnbjamfy.exe
        
        C:\Users\Admin\AppData\Local\Temp\yqtnbjamfy.exe update nnmqndogbp.exe
        37⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\nnmqndogbp.exe
        
        C:\Users\Admin\AppData\Local\Temp\nnmqndogbp.exe
        37⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\nnmqndogbp.exe
        
        C:\Users\Admin\AppData\Local\Temp\nnmqndogbp.exe update ngylyjlxti.exe
        38⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\ngylyjlxti.exe
        
        C:\Users\Admin\AppData\Local\Temp\ngylyjlxti.exe
        38⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\ngylyjlxti.exe
        
        C:\Users\Admin\AppData\Local\Temp\ngylyjlxti.exe update amcxxchsrj.exe
        39⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\amcxxchsrj.exe
        
        C:\Users\Admin\AppData\Local\Temp\amcxxchsrj.exe
        39⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\amcxxchsrj.exe
        
        C:\Users\Admin\AppData\Local\Temp\amcxxchsrj.exe update ulvdrtbruo.exe
        40⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\ulvdrtbruo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulvdrtbruo.exe
        40⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\ulvdrtbruo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulvdrtbruo.exe update xrurgfpvsr.exe
        41⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\xrurgfpvsr.exe
        
        C:\Users\Admin\AppData\Local\Temp\xrurgfpvsr.exe
        41⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\xrurgfpvsr.exe
        
        C:\Users\Admin\AppData\Local\Temp\xrurgfpvsr.exe update kqopafjndd.exe
        42⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe
        
        C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe
        42⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe
        
        C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe update xlovwlgopj.exe
        43⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\xlovwlgopj.exe
        
        C:\Users\Admin\AppData\Local\Temp\xlovwlgopj.exe
        43⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\xlovwlgopj.exe
        
        C:\Users\Admin\AppData\Local\Temp\xlovwlgopj.exe update xecovmknhv.exe
        44⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\xecovmknhv.exe
        
        C:\Users\Admin\AppData\Local\Temp\xecovmknhv.exe
        44⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\xecovmknhv.exe
        
        C:\Users\Admin\AppData\Local\Temp\xecovmknhv.exe update zonuqkclur.exe
        45⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\zonuqkclur.exe
        
        C:\Users\Admin\AppData\Local\Temp\zonuqkclur.exe
        45⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\zonuqkclur.exe
        
        C:\Users\Admin\AppData\Local\Temp\zonuqkclur.exe update uvqgejccsu.exe
        46⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe
        
        C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe
        46⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe
        
        C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe update msoulcvfqh.exe
        47⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        47⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe update ktlpshsgct.exe
        48⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\ktlpshsgct.exe
        
        C:\Users\Admin\AppData\Local\Temp\ktlpshsgct.exe
        48⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\ktlpshsgct.exe
        
        C:\Users\Admin\AppData\Local\Temp\ktlpshsgct.exe update ulkwhuuook.exe
        49⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe
        49⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe update eljuwhvwai.exe
        50⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\eljuwhvwai.exe
        
        C:\Users\Admin\AppData\Local\Temp\eljuwhvwai.exe
        50⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\eljuwhvwai.exe
        
        C:\Users\Admin\AppData\Local\Temp\eljuwhvwai.exe update mytqlrsvsw.exe
        51⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\mytqlrsvsw.exe
        
        C:\Users\Admin\AppData\Local\Temp\mytqlrsvsw.exe
        51⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\mytqlrsvsw.exe
        
        C:\Users\Admin\AppData\Local\Temp\mytqlrsvsw.exe update mncenbobsj.exe
        52⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\mncenbobsj.exe
        
        C:\Users\Admin\AppData\Local\Temp\mncenbobsj.exe
        52⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\mncenbobsj.exe
        
        C:\Users\Admin\AppData\Local\Temp\mncenbobsj.exe update trwshjzeyg.exe
        53⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\trwshjzeyg.exe
        
        C:\Users\Admin\AppData\Local\Temp\trwshjzeyg.exe
        53⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\trwshjzeyg.exe
        
        C:\Users\Admin\AppData\Local\Temp\trwshjzeyg.exe update yurocdrsju.exe
        54⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        54⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe update mawfnnsokt.exe
        55⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\mawfnnsokt.exe
        
        C:\Users\Admin\AppData\Local\Temp\mawfnnsokt.exe
        55⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\mawfnnsokt.exe
        
        C:\Users\Admin\AppData\Local\Temp\mawfnnsokt.exe update lxttbvpmjr.exe
        56⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\lxttbvpmjr.exe
        
        C:\Users\Admin\AppData\Local\Temp\lxttbvpmjr.exe
        56⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\lxttbvpmjr.exe
        
        C:\Users\Admin\AppData\Local\Temp\lxttbvpmjr.exe update tbnhddahhg.exe
        57⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\tbnhddahhg.exe
        
        C:\Users\Admin\AppData\Local\Temp\tbnhddahhg.exe
        57⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\tbnhddahhg.exe
        
        C:\Users\Admin\AppData\Local\Temp\tbnhddahhg.exe update brwvlcrigd.exe
        58⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\brwvlcrigd.exe
        
        C:\Users\Admin\AppData\Local\Temp\brwvlcrigd.exe
        58⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\brwvlcrigd.exe
        
        C:\Users\Admin\AppData\Local\Temp\brwvlcrigd.exe update oqbeqgvuno.exe
        59⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\oqbeqgvuno.exe
        
        C:\Users\Admin\AppData\Local\Temp\oqbeqgvuno.exe
        59⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\oqbeqgvuno.exe
        
        C:\Users\Admin\AppData\Local\Temp\oqbeqgvuno.exe update bdbvvoxznx.exe
        60⤵
        
        PID:2192

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:960

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact