Analysis
- max time kernel
19s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 16:13
General
- Target 2026-07-02_e937cb2f81f1ba0fcae9be5c3a786084_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.4MB
- Sample260702-tpde2aev8l
- SHA256 d19888a9a0267b12ef80a9d35392b8617fc24aa46b3a8695130b2725fc668ef9
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_e937cb2f81f1ba0fcae9be5c3a786084_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e937cb2f81f1ba0fcae9be5c3a786084_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_e937cb2f81f1ba0fcae9be5c3a786084_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-07-02_e937cb2f81f1ba0fcae9be5c3a786084_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update ywwvrmrtkp.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ywwvrmrtkp.exeC:\Users\Admin\AppData\Local\Temp\ywwvrmrtkp.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ywwvrmrtkp.exeC:\Users\Admin\AppData\Local\Temp\ywwvrmrtkp.exe update gypzoylphs.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\gypzoylphs.exeC:\Users\Admin\AppData\Local\Temp\gypzoylphs.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gypzoylphs.exeC:\Users\Admin\AppData\Local\Temp\gypzoylphs.exe update vdljvpfxqh.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vdljvpfxqh.exeC:\Users\Admin\AppData\Local\Temp\vdljvpfxqh.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vdljvpfxqh.exeC:\Users\Admin\AppData\Local\Temp\vdljvpfxqh.exe update dmddkamhzo.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dmddkamhzo.exeC:\Users\Admin\AppData\Local\Temp\dmddkamhzo.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dmddkamhzo.exeC:\Users\Admin\AppData\Local\Temp\dmddkamhzo.exe update nbapvvlvkb.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\nbapvvlvkb.exeC:\Users\Admin\AppData\Local\Temp\nbapvvlvkb.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nbapvvlvkb.exeC:\Users\Admin\AppData\Local\Temp\nbapvvlvkb.exe update phqtvkmwqo.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\phqtvkmwqo.exeC:\Users\Admin\AppData\Local\Temp\phqtvkmwqo.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\phqtvkmwqo.exeC:\Users\Admin\AppData\Local\Temp\phqtvkmwqo.exe update irjsjtxgqc.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\irjsjtxgqc.exeC:\Users\Admin\AppData\Local\Temp\irjsjtxgqc.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\irjsjtxgqc.exeC:\Users\Admin\AppData\Local\Temp\irjsjtxgqc.exe update zznxdhkyql.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zznxdhkyql.exeC:\Users\Admin\AppData\Local\Temp\zznxdhkyql.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\zznxdhkyql.exeC:\Users\Admin\AppData\Local\Temp\zznxdhkyql.exe update ktlhodtpss.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ktlhodtpss.exeC:\Users\Admin\AppData\Local\Temp\ktlhodtpss.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\ktlhodtpss.exeC:\Users\Admin\AppData\Local\Temp\ktlhodtpss.exe update wgowsyhhaj.exe11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wgowsyhhaj.exeC:\Users\Admin\AppData\Local\Temp\wgowsyhhaj.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\wgowsyhhaj.exeC:\Users\Admin\AppData\Local\Temp\wgowsyhhaj.exe update ckmbhxwvdw.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ckmbhxwvdw.exeC:\Users\Admin\AppData\Local\Temp\ckmbhxwvdw.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\ckmbhxwvdw.exeC:\Users\Admin\AppData\Local\Temp\ckmbhxwvdw.exe update zdhacvvfuc.exe13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zdhacvvfuc.exeC:\Users\Admin\AppData\Local\Temp\zdhacvvfuc.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\zdhacvvfuc.exeC:\Users\Admin\AppData\Local\Temp\zdhacvvfuc.exe update wrhuixxkai.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wrhuixxkai.exeC:\Users\Admin\AppData\Local\Temp\wrhuixxkai.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\wrhuixxkai.exeC:\Users\Admin\AppData\Local\Temp\wrhuixxkai.exe update rvkrjbfugi.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rvkrjbfugi.exeC:\Users\Admin\AppData\Local\Temp\rvkrjbfugi.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\rvkrjbfugi.exeC:\Users\Admin\AppData\Local\Temp\rvkrjbfugi.exe update gabnesghgf.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gabnesghgf.exeC:\Users\Admin\AppData\Local\Temp\gabnesghgf.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\gabnesghgf.exeC:\Users\Admin\AppData\Local\Temp\gabnesghgf.exe update qpayhsqiab.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qpayhsqiab.exeC:\Users\Admin\AppData\Local\Temp\qpayhsqiab.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\qpayhsqiab.exeC:\Users\Admin\AppData\Local\Temp\qpayhsqiab.exe update yiuzawheml.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yiuzawheml.exeC:\Users\Admin\AppData\Local\Temp\yiuzawheml.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\yiuzawheml.exeC:\Users\Admin\AppData\Local\Temp\yiuzawheml.exe update sxeobbdsgo.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sxeobbdsgo.exeC:\Users\Admin\AppData\Local\Temp\sxeobbdsgo.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\sxeobbdsgo.exeC:\Users\Admin\AppData\Local\Temp\sxeobbdsgo.exe update srorwbrwhh.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\srorwbrwhh.exeC:\Users\Admin\AppData\Local\Temp\srorwbrwhh.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\srorwbrwhh.exeC:\Users\Admin\AppData\Local\Temp\srorwbrwhh.exe update vzipesukwb.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vzipesukwb.exeC:\Users\Admin\AppData\Local\Temp\vzipesukwb.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\vzipesukwb.exeC:\Users\Admin\AppData\Local\Temp\vzipesukwb.exe update kqopafjndd.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exeC:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\kqopafjndd.exeC:\Users\Admin\AppData\Local\Temp\kqopafjndd.exe update pkrsnrjjpr.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pkrsnrjjpr.exeC:\Users\Admin\AppData\Local\Temp\pkrsnrjjpr.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\pkrsnrjjpr.exeC:\Users\Admin\AppData\Local\Temp\pkrsnrjjpr.exe update sdvzqoczcg.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sdvzqoczcg.exeC:\Users\Admin\AppData\Local\Temp\sdvzqoczcg.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\sdvzqoczcg.exeC:\Users\Admin\AppData\Local\Temp\sdvzqoczcg.exe update cgvmdldbsh.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cgvmdldbsh.exeC:\Users\Admin\AppData\Local\Temp\cgvmdldbsh.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\cgvmdldbsh.exeC:\Users\Admin\AppData\Local\Temp\cgvmdldbsh.exe update cksiqrmncb.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cksiqrmncb.exeC:\Users\Admin\AppData\Local\Temp\cksiqrmncb.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\cksiqrmncb.exeC:\Users\Admin\AppData\Local\Temp\cksiqrmncb.exe update khmtueiggr.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\khmtueiggr.exeC:\Users\Admin\AppData\Local\Temp\khmtueiggr.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\khmtueiggr.exeC:\Users\Admin\AppData\Local\Temp\khmtueiggr.exe update rmzjdrywwx.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rmzjdrywwx.exeC:\Users\Admin\AppData\Local\Temp\rmzjdrywwx.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\rmzjdrywwx.exeC:\Users\Admin\AppData\Local\Temp\rmzjdrywwx.exe update hyhhdhnnoa.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exeC:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exeC:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe update hueizsjgkp.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hueizsjgkp.exeC:\Users\Admin\AppData\Local\Temp\hueizsjgkp.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\hueizsjgkp.exeC:\Users\Admin\AppData\Local\Temp\hueizsjgkp.exe update kysjlhqivf.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kysjlhqivf.exeC:\Users\Admin\AppData\Local\Temp\kysjlhqivf.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\kysjlhqivf.exeC:\Users\Admin\AppData\Local\Temp\kysjlhqivf.exe update hocudiqpzy.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hocudiqpzy.exeC:\Users\Admin\AppData\Local\Temp\hocudiqpzy.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\hocudiqpzy.exeC:\Users\Admin\AppData\Local\Temp\hocudiqpzy.exe update hdldmkgdem.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hdldmkgdem.exeC:\Users\Admin\AppData\Local\Temp\hdldmkgdem.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\hdldmkgdem.exeC:\Users\Admin\AppData\Local\Temp\hdldmkgdem.exe update uybwdycive.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uybwdycive.exeC:\Users\Admin\AppData\Local\Temp\uybwdycive.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\uybwdycive.exeC:\Users\Admin\AppData\Local\Temp\uybwdycive.exe update hewhcqxetf.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hewhcqxetf.exeC:\Users\Admin\AppData\Local\Temp\hewhcqxetf.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\hewhcqxetf.exeC:\Users\Admin\AppData\Local\Temp\hewhcqxetf.exe update ousqnqxkxw.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ousqnqxkxw.exeC:\Users\Admin\AppData\Local\Temp\ousqnqxkxw.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\ousqnqxkxw.exeC:\Users\Admin\AppData\Local\Temp\ousqnqxkxw.exe update uhygjtmkpt.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uhygjtmkpt.exeC:\Users\Admin\AppData\Local\Temp\uhygjtmkpt.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\uhygjtmkpt.exeC:\Users\Admin\AppData\Local\Temp\uhygjtmkpt.exe update rmopsdpnvk.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rmopsdpnvk.exeC:\Users\Admin\AppData\Local\Temp\rmopsdpnvk.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\rmopsdpnvk.exeC:\Users\Admin\AppData\Local\Temp\rmopsdpnvk.exe update wdvagzpdax.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wdvagzpdax.exeC:\Users\Admin\AppData\Local\Temp\wdvagzpdax.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\wdvagzpdax.exeC:\Users\Admin\AppData\Local\Temp\wdvagzpdax.exe update jnletwhtnj.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jnletwhtnj.exeC:\Users\Admin\AppData\Local\Temp\jnletwhtnj.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\jnletwhtnj.exeC:\Users\Admin\AppData\Local\Temp\jnletwhtnj.exe update gstndfkoli.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gstndfkoli.exeC:\Users\Admin\AppData\Local\Temp\gstndfkoli.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\gstndfkoli.exeC:\Users\Admin\AppData\Local\Temp\gstndfkoli.exe update jkftgddmqx.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jkftgddmqx.exeC:\Users\Admin\AppData\Local\Temp\jkftgddmqx.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\jkftgddmqx.exeC:\Users\Admin\AppData\Local\Temp\jkftgddmqx.exe update ytppsqfjij.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ytppsqfjij.exeC:\Users\Admin\AppData\Local\Temp\ytppsqfjij.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\ytppsqfjij.exeC:\Users\Admin\AppData\Local\Temp\ytppsqfjij.exe update vrjfwrcihi.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vrjfwrcihi.exeC:\Users\Admin\AppData\Local\Temp\vrjfwrcihi.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\vrjfwrcihi.exeC:\Users\Admin\AppData\Local\Temp\vrjfwrcihi.exe update ovrzalxpaj.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ovrzalxpaj.exeC:\Users\Admin\AppData\Local\Temp\ovrzalxpaj.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\ovrzalxpaj.exeC:\Users\Admin\AppData\Local\Temp\ovrzalxpaj.exe update vsonxkcnzz.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vsonxkcnzz.exeC:\Users\Admin\AppData\Local\Temp\vsonxkcnzz.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\vsonxkcnzz.exeC:\Users\Admin\AppData\Local\Temp\vsonxkcnzz.exe update dpmblkztyw.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dpmblkztyw.exeC:\Users\Admin\AppData\Local\Temp\dpmblkztyw.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\dpmblkztyw.exeC:\Users\Admin\AppData\Local\Temp\dpmblkztyw.exe update ajpxgdahrs.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ajpxgdahrs.exeC:\Users\Admin\AppData\Local\Temp\ajpxgdahrs.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\ajpxgdahrs.exeC:\Users\Admin\AppData\Local\Temp\ajpxgdahrs.exe update scndkfgdes.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\scndkfgdes.exeC:\Users\Admin\AppData\Local\Temp\scndkfgdes.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\scndkfgdes.exeC:\Users\Admin\AppData\Local\Temp\scndkfgdes.exe update vqdhkuhmjf.exe50⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
ckmbhxwvdw.exe
dmddkamhzo.exe
gabnesghgf.exe
gypzoylphs.exe
irjsjtxgqc.exe
ktlhodtpss.exe
nbapvvlvkb.exe
phqtvkmwqo.exe
qpayhsqiab.exe
rvkrjbfugi.exe
srorwbrwhh.exe
sxeobbdsgo.exe
update.exe
update.exe
update.exe
update.exe
vdljvpfxqh.exe
vzipesukwb.exe
wgowsyhhaj.exe
wrhuixxkai.exe
yiuzawheml.exe
ywwvrmrtkp.exe
zdhacvvfuc.exe
zznxdhkyql.exe
memory/248-315-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/248-314-0x0000000001050000-0x0000000001051000-memory.dmp
memory/420-287-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/756-255-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/832-357-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1084-7-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/1084-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1148-324-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1176-264-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1212-2-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1212-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1580-269-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1680-272-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1880-347-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1952-338-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/1952-339-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1964-319-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1984-216-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2044-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2176-299-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2228-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2328-71-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2332-48-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2568-296-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2776-290-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2784-259-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/2784-260-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2884-309-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2892-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2904-342-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3236-32-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3440-360-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3820-250-0x0000027CD9340000-0x0000027CD99D1000-memory.dmp
memory/3820-354-0x0000027CD9340000-0x0000027CD99D1000-memory.dmp
memory/3820-181-0x0000027CD9340000-0x0000027CD99D1000-memory.dmp
memory/4324-23-0x0000000001120000-0x0000000001121000-memory.dmp
memory/4324-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4508-208-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/4508-209-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4592-350-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4608-239-0x0000000001040000-0x0000000001041000-memory.dmp
memory/4608-240-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4728-243-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4768-40-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5124-252-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5144-277-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/5144-278-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5172-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5480-106-0x000001D001C90000-0x000001D001CB0000-memory.dmp
memory/5480-123-0x000001D0141A0000-0x000001D0141C0000-memory.dmp
memory/5480-79-0x000001D0001B0000-0x000001D0002B0000-memory.dmp
memory/5480-96-0x000001D001CD0000-0x000001D001DD0000-memory.dmp
memory/5480-95-0x000001D0018B0000-0x000001D0018D0000-memory.dmp
memory/5480-78-0x000001D0001B0000-0x000001D0002B0000-memory.dmp
memory/5568-0-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/5568-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5680-43-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5688-306-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5700-69-0x0000000006960000-0x0000000006AEE000-memory.dmp
memory/6004-329-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6032-281-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6032-280-0x0000000001160000-0x0000000001161000-memory.dmp
memory/6140-34-0x0000000001030000-0x0000000001031000-memory.dmp
memory/6140-35-0x0000000000400000-0x0000000000E90000-memory.dmp