94006d9c00c6267db80d6992a581801b3a47c57fdb7a4a12889d347773a153d8

Analysis

max time kernel
60s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Size 10.4MB
Sample260705-edmr1acy9k
SHA256 94006d9c00c6267db80d6992a581801b3a47c57fdb7a4a12889d347773a153d8
MD5 4cf9555b62d26020516c79186ef61758
SHA1 4718b7b3bb5692703c01f025cad6dd32fd603561
SHA512 8ac0fb8f76f630a11c3dddb328451202c52d7b8da31e7dc3f3f6596ed1723ee2ff811a801f787eb53f46cd8da11c31452b4e0e874ded6a237589c0674fdf5a4d
SSDEEP 196608:XZGmuKsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnKsREJLODBWlX3d+NpvdHIoU
TLSH
T159B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 28 IoCs

pid	Process
2944	psaeexgimv.exe
3564	psaeexgimv.exe
1096	mugfqekrgr.exe
4636	mugfqekrgr.exe
1556	hegmjcacwv.exe
6084	hegmjcacwv.exe
3432	ulszhysynh.exe
3752	ulszhysynh.exe
2968	mxdyigskmh.exe
3028	mxdyigskmh.exe
5032	habawtirix.exe
3224	habawtirix.exe
2364	tssfueimyk.exe
5644	tssfueimyk.exe
5688	meapehwcwc.exe
4448	meapehwcwc.exe
3324	yhojvzihks.exe
1376	yhojvzihks.exe
5648	tknldwttyy.exe
1244	tknldwttyy.exe
4508	ondnzbjzvo.exe
3652	ondnzbjzvo.exe
4280	leqmnnykcj.exe
484	leqmnnykcj.exe
1936	virgazsrul.exe
632	virgazsrul.exe
3016	tdtnduwbvf.exe
3864	tdtnduwbvf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

pid	Process
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3184	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2944	psaeexgimv.exe
3564	psaeexgimv.exe
1096	mugfqekrgr.exe
4636	mugfqekrgr.exe
1556	hegmjcacwv.exe
6084	hegmjcacwv.exe
3432	ulszhysynh.exe
3752	ulszhysynh.exe
2968	mxdyigskmh.exe
3028	mxdyigskmh.exe
5032	habawtirix.exe
3224	habawtirix.exe
2364	tssfueimyk.exe
5644	tssfueimyk.exe
5688	meapehwcwc.exe
4448	meapehwcwc.exe
3324	yhojvzihks.exe
1376	yhojvzihks.exe
5648	tknldwttyy.exe
1244	tknldwttyy.exe
4508	ondnzbjzvo.exe
3652	ondnzbjzvo.exe
4280	leqmnnykcj.exe
484	leqmnnykcj.exe
1936	virgazsrul.exe
632	virgazsrul.exe
3016	tdtnduwbvf.exe
3864	tdtnduwbvf.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	habawtirix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tknldwttyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virgazsrul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hegmjcacwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxdyigskmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	meapehwcwc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhojvzihks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	psaeexgimv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulszhysynh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leqmnnykcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdtnduwbvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	psaeexgimv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mugfqekrgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhojvzihks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdtnduwbvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxdyigskmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tssfueimyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ondnzbjzvo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	habawtirix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	meapehwcwc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tknldwttyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ondnzbjzvo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leqmnnykcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulszhysynh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mugfqekrgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hegmjcacwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tssfueimyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virgazsrul.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{9A59F8A8-C487-4958-97B7-2AE0E9FA40DC}	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3184	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3184	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2944	psaeexgimv.exe
2944	psaeexgimv.exe
2944	psaeexgimv.exe
2944	psaeexgimv.exe
3564	psaeexgimv.exe
3564	psaeexgimv.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1096	mugfqekrgr.exe
1096	mugfqekrgr.exe
1096	mugfqekrgr.exe
1096	mugfqekrgr.exe
4636	mugfqekrgr.exe
4636	mugfqekrgr.exe
2944	psaeexgimv.exe
2944	psaeexgimv.exe
1556	hegmjcacwv.exe
1556	hegmjcacwv.exe
1556	hegmjcacwv.exe
1556	hegmjcacwv.exe
1096	mugfqekrgr.exe
1096	mugfqekrgr.exe
6084	hegmjcacwv.exe
6084	hegmjcacwv.exe
3432	ulszhysynh.exe
3432	ulszhysynh.exe
3432	ulszhysynh.exe
3432	ulszhysynh.exe
1556	hegmjcacwv.exe
1556	hegmjcacwv.exe
3752	ulszhysynh.exe
3752	ulszhysynh.exe
2968	mxdyigskmh.exe
2968	mxdyigskmh.exe
2968	mxdyigskmh.exe
2968	mxdyigskmh.exe
3028	mxdyigskmh.exe
3028	mxdyigskmh.exe
3432	ulszhysynh.exe
3432	ulszhysynh.exe
5032	habawtirix.exe
5032	habawtirix.exe
5032	habawtirix.exe
5032	habawtirix.exe
3224	habawtirix.exe
3224	habawtirix.exe
2968	mxdyigskmh.exe
2968	mxdyigskmh.exe
2364	tssfueimyk.exe
2364	tssfueimyk.exe
2364	tssfueimyk.exe
2364	tssfueimyk.exe
5644	tssfueimyk.exe
5644	tssfueimyk.exe
5032	habawtirix.exe
5032	habawtirix.exe
5688	meapehwcwc.exe
5688	meapehwcwc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	explorer.exe
Token: SeCreatePagefilePrivilege	3084	explorer.exe
Token: SeShutdownPrivilege	3084	explorer.exe
Token: SeCreatePagefilePrivilege	3084	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	sihost.exe

Suspicious use of SetWindowsHookEx 60 IoCs

pid	Process
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3184	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3184	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2944	psaeexgimv.exe
2944	psaeexgimv.exe
3564	psaeexgimv.exe
3564	psaeexgimv.exe
1096	mugfqekrgr.exe
1096	mugfqekrgr.exe
4636	mugfqekrgr.exe
4636	mugfqekrgr.exe
1556	hegmjcacwv.exe
1556	hegmjcacwv.exe
6084	hegmjcacwv.exe
6084	hegmjcacwv.exe
3432	ulszhysynh.exe
3432	ulszhysynh.exe
3752	ulszhysynh.exe
3752	ulszhysynh.exe
2968	mxdyigskmh.exe
2968	mxdyigskmh.exe
3028	mxdyigskmh.exe
3028	mxdyigskmh.exe
5032	habawtirix.exe
5032	habawtirix.exe
3224	habawtirix.exe
3224	habawtirix.exe
2364	tssfueimyk.exe
2364	tssfueimyk.exe
5644	tssfueimyk.exe
5644	tssfueimyk.exe
5688	meapehwcwc.exe
5688	meapehwcwc.exe
4448	meapehwcwc.exe
4448	meapehwcwc.exe
3324	yhojvzihks.exe
3324	yhojvzihks.exe
1376	yhojvzihks.exe
1376	yhojvzihks.exe
5648	tknldwttyy.exe
5648	tknldwttyy.exe
1244	tknldwttyy.exe
1244	tknldwttyy.exe
4508	ondnzbjzvo.exe
4508	ondnzbjzvo.exe
3652	ondnzbjzvo.exe
3652	ondnzbjzvo.exe
4280	leqmnnykcj.exe
4280	leqmnnykcj.exe
484	leqmnnykcj.exe
484	leqmnnykcj.exe
1936	virgazsrul.exe
1936	virgazsrul.exe
632	virgazsrul.exe
632	virgazsrul.exe
3016	tdtnduwbvf.exe
3016	tdtnduwbvf.exe
3864	tdtnduwbvf.exe
3864	tdtnduwbvf.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 3184	608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	88
PID 608 wrote to memory of 2944	608	2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	89
PID 2944 wrote to memory of 3564	2944	psaeexgimv.exe	90
PID 2944 wrote to memory of 1096	2944	psaeexgimv.exe	91
PID 1096 wrote to memory of 4636	1096	mugfqekrgr.exe	92
PID 1096 wrote to memory of 1556	1096	mugfqekrgr.exe	93
PID 1556 wrote to memory of 6084	1556	hegmjcacwv.exe	94
PID 1556 wrote to memory of 3432	1556	hegmjcacwv.exe	95
PID 3432 wrote to memory of 3752	3432	ulszhysynh.exe	96
PID 3432 wrote to memory of 2968	3432	ulszhysynh.exe	97
PID 2968 wrote to memory of 3028	2968	mxdyigskmh.exe	98
PID 2968 wrote to memory of 5032	2968	mxdyigskmh.exe	99
PID 5032 wrote to memory of 3224	5032	habawtirix.exe	100
PID 5032 wrote to memory of 2364	5032	habawtirix.exe	101
PID 2364 wrote to memory of 5644	2364	tssfueimyk.exe	102
PID 2364 wrote to memory of 5688	2364	tssfueimyk.exe	103
PID 5688 wrote to memory of 4448	5688	meapehwcwc.exe	104
PID 5688 wrote to memory of 3324	5688	meapehwcwc.exe	105
PID 3324 wrote to memory of 1376	3324	yhojvzihks.exe	106
PID 3324 wrote to memory of 5648	3324	yhojvzihks.exe	107
PID 5648 wrote to memory of 1244	5648	tknldwttyy.exe	108
PID 5648 wrote to memory of 4508	5648	tknldwttyy.exe	109
PID 4508 wrote to memory of 3652	4508	ondnzbjzvo.exe	110
PID 4508 wrote to memory of 4280	4508	ondnzbjzvo.exe	112
PID 4280 wrote to memory of 484	4280	leqmnnykcj.exe	114
PID 4280 wrote to memory of 1936	4280	leqmnnykcj.exe	116
PID 1936 wrote to memory of 632	1936	virgazsrul.exe	118
PID 1936 wrote to memory of 3016	1936	virgazsrul.exe	119
PID 3016 wrote to memory of 3864	3016	tdtnduwbvf.exe	120
PID 2348 wrote to memory of 3084	2348	sihost.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-05_4cf9555b62d26020516c79186ef61758_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update psaeexgimv.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\psaeexgimv.exe
  C:\Users\Admin\AppData\Local\Temp\psaeexgimv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\psaeexgimv.exe
    C:\Users\Admin\AppData\Local\Temp\psaeexgimv.exe update mugfqekrgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\mugfqekrgr.exe
    C:\Users\Admin\AppData\Local\Temp\mugfqekrgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\mugfqekrgr.exe
      C:\Users\Admin\AppData\Local\Temp\mugfqekrgr.exe update hegmjcacwv.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\hegmjcacwv.exe
      C:\Users\Admin\AppData\Local\Temp\hegmjcacwv.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\hegmjcacwv.exe
        
        C:\Users\Admin\AppData\Local\Temp\hegmjcacwv.exe update ulszhysynh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\ulszhysynh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulszhysynh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\ulszhysynh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulszhysynh.exe update mxdyigskmh.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\mxdyigskmh.exe
        
        C:\Users\Admin\AppData\Local\Temp\mxdyigskmh.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\mxdyigskmh.exe
        
        C:\Users\Admin\AppData\Local\Temp\mxdyigskmh.exe update habawtirix.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\habawtirix.exe
        
        C:\Users\Admin\AppData\Local\Temp\habawtirix.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\habawtirix.exe
        
        C:\Users\Admin\AppData\Local\Temp\habawtirix.exe update tssfueimyk.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\tssfueimyk.exe
        
        C:\Users\Admin\AppData\Local\Temp\tssfueimyk.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\tssfueimyk.exe
        
        C:\Users\Admin\AppData\Local\Temp\tssfueimyk.exe update meapehwcwc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\meapehwcwc.exe
        
        C:\Users\Admin\AppData\Local\Temp\meapehwcwc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\meapehwcwc.exe
        
        C:\Users\Admin\AppData\Local\Temp\meapehwcwc.exe update yhojvzihks.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\yhojvzihks.exe
        
        C:\Users\Admin\AppData\Local\Temp\yhojvzihks.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\yhojvzihks.exe
        
        C:\Users\Admin\AppData\Local\Temp\yhojvzihks.exe update tknldwttyy.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
        
        C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
        
        C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe update ondnzbjzvo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\ondnzbjzvo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ondnzbjzvo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\ondnzbjzvo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ondnzbjzvo.exe update leqmnnykcj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\leqmnnykcj.exe
        
        C:\Users\Admin\AppData\Local\Temp\leqmnnykcj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\leqmnnykcj.exe
        
        C:\Users\Admin\AppData\Local\Temp\leqmnnykcj.exe update virgazsrul.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\virgazsrul.exe
        
        C:\Users\Admin\AppData\Local\Temp\virgazsrul.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\virgazsrul.exe
        
        C:\Users\Admin\AppData\Local\Temp\virgazsrul.exe update tdtnduwbvf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\tdtnduwbvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\tdtnduwbvf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\tdtnduwbvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\tdtnduwbvf.exe update xywfdkdyyf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\xywfdkdyyf.exe
        
        C:\Users\Admin\AppData\Local\Temp\xywfdkdyyf.exe
        16⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\xywfdkdyyf.exe
        
        C:\Users\Admin\AppData\Local\Temp\xywfdkdyyf.exe update nsqhorfues.exe
        17⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\nsqhorfues.exe
        
        C:\Users\Admin\AppData\Local\Temp\nsqhorfues.exe
        17⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\nsqhorfues.exe
        
        C:\Users\Admin\AppData\Local\Temp\nsqhorfues.exe update mqtddjcfun.exe
        18⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\mqtddjcfun.exe
        
        C:\Users\Admin\AppData\Local\Temp\mqtddjcfun.exe
        18⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\mqtddjcfun.exe
        
        C:\Users\Admin\AppData\Local\Temp\mqtddjcfun.exe update momspryzfb.exe
        19⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\momspryzfb.exe
        
        C:\Users\Admin\AppData\Local\Temp\momspryzfb.exe
        19⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\momspryzfb.exe
        
        C:\Users\Admin\AppData\Local\Temp\momspryzfb.exe update kmyitrnxes.exe
        20⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\kmyitrnxes.exe
        
        C:\Users\Admin\AppData\Local\Temp\kmyitrnxes.exe
        20⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\kmyitrnxes.exe
        
        C:\Users\Admin\AppData\Local\Temp\kmyitrnxes.exe update redbsgpsrc.exe
        21⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\redbsgpsrc.exe
        
        C:\Users\Admin\AppData\Local\Temp\redbsgpsrc.exe
        21⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\redbsgpsrc.exe
        
        C:\Users\Admin\AppData\Local\Temp\redbsgpsrc.exe update ovgibjuzyl.exe
        22⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\ovgibjuzyl.exe
        
        C:\Users\Admin\AppData\Local\Temp\ovgibjuzyl.exe
        22⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\ovgibjuzyl.exe
        
        C:\Users\Admin\AppData\Local\Temp\ovgibjuzyl.exe update jmloysjcdp.exe
        23⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\jmloysjcdp.exe
        
        C:\Users\Admin\AppData\Local\Temp\jmloysjcdp.exe
        23⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\jmloysjcdp.exe
        
        C:\Users\Admin\AppData\Local\Temp\jmloysjcdp.exe update jfxkjyfsmr.exe
        24⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\jfxkjyfsmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfxkjyfsmr.exe
        24⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\jfxkjyfsmr.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfxkjyfsmr.exe update wlbvirboss.exe
        25⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\wlbvirboss.exe
        
        C:\Users\Admin\AppData\Local\Temp\wlbvirboss.exe
        25⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\wlbvirboss.exe
        
        C:\Users\Admin\AppData\Local\Temp\wlbvirboss.exe update trgtmuqoki.exe
        26⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\trgtmuqoki.exe
        
        C:\Users\Admin\AppData\Local\Temp\trgtmuqoki.exe
        26⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\trgtmuqoki.exe
        
        C:\Users\Admin\AppData\Local\Temp\trgtmuqoki.exe update viikgnyzci.exe
        27⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\viikgnyzci.exe
        
        C:\Users\Admin\AppData\Local\Temp\viikgnyzci.exe
        27⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\viikgnyzci.exe
        
        C:\Users\Admin\AppData\Local\Temp\viikgnyzci.exe update vmwajmkusl.exe
        28⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\vmwajmkusl.exe
        
        C:\Users\Admin\AppData\Local\Temp\vmwajmkusl.exe
        28⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\vmwajmkusl.exe
        
        C:\Users\Admin\AppData\Local\Temp\vmwajmkusl.exe update yeyjypvjwh.exe
        29⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\yeyjypvjwh.exe
        
        C:\Users\Admin\AppData\Local\Temp\yeyjypvjwh.exe
        29⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\yeyjypvjwh.exe
        
        C:\Users\Admin\AppData\Local\Temp\yeyjypvjwh.exe update wnsozikuzk.exe
        30⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\wnsozikuzk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wnsozikuzk.exe
        30⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\wnsozikuzk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wnsozikuzk.exe update ybgulceuwn.exe
        31⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\ybgulceuwn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ybgulceuwn.exe
        31⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\ybgulceuwn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ybgulceuwn.exe update dsmatewcah.exe
        32⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\dsmatewcah.exe
        
        C:\Users\Admin\AppData\Local\Temp\dsmatewcah.exe
        32⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\dsmatewcah.exe
        
        C:\Users\Admin\AppData\Local\Temp\dsmatewcah.exe update nvmwfcpeqj.exe
        33⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\nvmwfcpeqj.exe
        
        C:\Users\Admin\AppData\Local\Temp\nvmwfcpeqj.exe
        33⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\nvmwfcpeqj.exe
        
        C:\Users\Admin\AppData\Local\Temp\nvmwfcpeqj.exe update dmjhdnysvz.exe
        34⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\dmjhdnysvz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dmjhdnysvz.exe
        34⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\dmjhdnysvz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dmjhdnysvz.exe update ivzfzvwdfd.exe
        35⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\ivzfzvwdfd.exe
        
        C:\Users\Admin\AppData\Local\Temp\ivzfzvwdfd.exe
        35⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\ivzfzvwdfd.exe
        
        C:\Users\Admin\AppData\Local\Temp\ivzfzvwdfd.exe update qobiewfyiv.exe
        36⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\qobiewfyiv.exe
        
        C:\Users\Admin\AppData\Local\Temp\qobiewfyiv.exe
        36⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\qobiewfyiv.exe
        
        C:\Users\Admin\AppData\Local\Temp\qobiewfyiv.exe update qhveqlcpax.exe
        37⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\qhveqlcpax.exe
        
        C:\Users\Admin\AppData\Local\Temp\qhveqlcpax.exe
        37⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\qhveqlcpax.exe
        
        C:\Users\Admin\AppData\Local\Temp\qhveqlcpax.exe update iagzjrzyjr.exe
        38⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\iagzjrzyjr.exe
        
        C:\Users\Admin\AppData\Local\Temp\iagzjrzyjr.exe
        38⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\iagzjrzyjr.exe
        
        C:\Users\Admin\AppData\Local\Temp\iagzjrzyjr.exe update ieevxxisct.exe
        39⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\ieevxxisct.exe
        
        C:\Users\Admin\AppData\Local\Temp\ieevxxisct.exe
        39⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\ieevxxisct.exe
        
        C:\Users\Admin\AppData\Local\Temp\ieevxxisct.exe update coigttjusk.exe
        40⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\coigttjusk.exe
        
        C:\Users\Admin\AppData\Local\Temp\coigttjusk.exe
        40⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\coigttjusk.exe
        
        C:\Users\Admin\AppData\Local\Temp\coigttjusk.exe update aapejqcyjy.exe
        41⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\aapejqcyjy.exe
        
        C:\Users\Admin\AppData\Local\Temp\aapejqcyjy.exe
        41⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\aapejqcyjy.exe
        
        C:\Users\Admin\AppData\Local\Temp\aapejqcyjy.exe update sqcyknbzjl.exe
        42⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\sqcyknbzjl.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqcyknbzjl.exe
        42⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\sqcyknbzjl.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqcyknbzjl.exe update sfyznnbgok.exe
        43⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\sfyznnbgok.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfyznnbgok.exe
        43⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\sfyznnbgok.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfyznnbgok.exe update izhczdooam.exe
        44⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\izhczdooam.exe
        
        C:\Users\Admin\AppData\Local\Temp\izhczdooam.exe
        44⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\izhczdooam.exe
        
        C:\Users\Admin\AppData\Local\Temp\izhczdooam.exe update uiwabsquka.exe
        45⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\uiwabsquka.exe
        
        C:\Users\Admin\AppData\Local\Temp\uiwabsquka.exe
        45⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\uiwabsquka.exe
        
        C:\Users\Admin\AppData\Local\Temp\uiwabsquka.exe update ftxbzwhgvs.exe
        46⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\ftxbzwhgvs.exe
        
        C:\Users\Admin\AppData\Local\Temp\ftxbzwhgvs.exe
        46⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\ftxbzwhgvs.exe
        
        C:\Users\Admin\AppData\Local\Temp\ftxbzwhgvs.exe update nbxkwobqaq.exe
        47⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\nbxkwobqaq.exe
        
        C:\Users\Admin\AppData\Local\Temp\nbxkwobqaq.exe
        47⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\nbxkwobqaq.exe
        
        C:\Users\Admin\AppData\Local\Temp\nbxkwobqaq.exe update swzbfaemrg.exe
        48⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\swzbfaemrg.exe
        
        C:\Users\Admin\AppData\Local\Temp\swzbfaemrg.exe
        48⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\swzbfaemrg.exe
        
        C:\Users\Admin\AppData\Local\Temp\swzbfaemrg.exe update oytrhmzrqw.exe
        49⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\oytrhmzrqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\oytrhmzrqw.exe
        49⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\oytrhmzrqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\oytrhmzrqw.exe update momiluwppv.exe
        50⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\momiluwppv.exe
        
        C:\Users\Admin\AppData\Local\Temp\momiluwppv.exe
        50⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\momiluwppv.exe
        
        C:\Users\Admin\AppData\Local\Temp\momiluwppv.exe update edyoakyzuj.exe
        51⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\edyoakyzuj.exe
        
        C:\Users\Admin\AppData\Local\Temp\edyoakyzuj.exe
        51⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\edyoakyzuj.exe
        
        C:\Users\Admin\AppData\Local\Temp\edyoakyzuj.exe update zzpmdfrngh.exe
        52⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\zzpmdfrngh.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzpmdfrngh.exe
        52⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\zzpmdfrngh.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzpmdfrngh.exe update exuqwcwasu.exe
        53⤵
        
        PID:3972

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3084

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

habawtirix.exe

Path C:\Users\Admin\AppData\Local\Temp\habawtirix.exe
Size 10.4MB
SHA256 62cc78587eac17892b768971c6d7f4a6a298d84658a2c354c9d414a4f61e3b74
MD5 e36a21cd363cad2a5998fd3dc6cba0d0
SHA1 3b70fe33f9a74d04b954426ade1af576cc671f47
SHA512 a6fde2af0f872d863725eddadea8a3f4181e3c3f0b83188f0c8d1dff38a09c384c0d4632086c0cdcad2cffd95a76f56074d4c698577ac616c552e6059684db04
SSDEEP 196608:XZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnPsREJLODBWlX3d+NpvdHIoU
TLSH
T118B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hegmjcacwv.exe

Path C:\Users\Admin\AppData\Local\Temp\hegmjcacwv.exe
Size 10.4MB
SHA256 2d0d21817deacaa61677290998ae2715c7cf953edbdb417d030a5ff14539a67d
MD5 67f025d43b59a458d1fe3fdbb587f8e5
SHA1 9e4f65784c844c9143294fd40f331b9b8a946b87
SHA512 11086310a0c9755a028d637aafa4e8567d542eb8f5a62b093804f30fcc58d34ddcd3bb496c9aeef99bca038fd9cb860f8fc17d89742c1ff080d09211014cc88a
SSDEEP 196608:XZGmunsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnnsREJLODBWlX3d+NpvdHIoU
TLSH
T1C3B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kmyitrnxes.exe

Path C:\Users\Admin\AppData\Local\Temp\kmyitrnxes.exe
Size 10.4MB
SHA256 a8a3a6e22adf6bc3a57cd9c0bc1673b2cfa36012d1370b7bad126d559c92890b
MD5 c85b8d1fae35f6dc6859e79c02556e0b
SHA1 97288bcf957aa8a86a8365f75429388a94c6cd58
SHA512 e515d2543dba08f1680ec56b3e4568f5b0d1c8f9c6b130c77b8cdca9a01c41ac6f1b86758531fc9bcd914180ecdde4061aaced8762b75eb7e508dab79873f165
SSDEEP 196608:XZGmuQsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnQsREJLODBWlX3d+NpvdHIoU
TLSH
T123B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leqmnnykcj.exe

Path C:\Users\Admin\AppData\Local\Temp\leqmnnykcj.exe
Size 10.4MB
SHA256 c3992bfce98c0f2bebd70ad71dbd85fd5cbf4d410ff67945a932b70c018b266d
MD5 1bd35903f84f7a1de04b621f1a55b3ed
SHA1 a90a2016f51cd4f146d0b916c2cd64c6b9f03bc6
SHA512 e07ec30015fa681459364244e49eccf37131a58415baedbd2cfa6d9967085229f85dab349ff5441e802199d393db9b3eb74298ff44d8cce6f7f462707f6e65a8
SSDEEP 196608:XZGmuJsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnJsREJLODBWlX3d+NpvdHIoU
TLSH
T185B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meapehwcwc.exe

Path C:\Users\Admin\AppData\Local\Temp\meapehwcwc.exe
Size 10.4MB
SHA256 8d1ae444d136846692683cc51334ada353b631ef938164a198d32631296bb793
MD5 25ec65f0822ec5548fbb5349cb1a14ce
SHA1 a6b495c7ed3a8b527220219d472ca0c28f51fd8f
SHA512 7e56a6d13a5627c5821855798bfa3312e1a682aa0573a4ce6255f5779a358091fea0ff4be6da2d981a588d2e3539c8c08ea24ca5523442698abb9922d917da33
SSDEEP 196608:XZGmuvsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnvsREJLODBWlX3d+NpvdHIoU
TLSH
T10BB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

momspryzfb.exe

Path C:\Users\Admin\AppData\Local\Temp\momspryzfb.exe
Size 10.4MB
SHA256 a7dd8b19195600668491233badde64917c8e7a414d218d3f311c21bfabb18546
MD5 a94876f09edfff183a3daa451565be02
SHA1 5a066cb0ffd2c61613049aa0166b020b680e59e2
SHA512 384d7dd2e8708f7a7544b5f5aca5c14c2e9d9bb10b59d546ad7a733fac0d2d10e896624823bfe76e1b2d298a5fabd78fa6c3bc08897b66cb85f6e2dec4c86285
SSDEEP 196608:XZGmuLsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnLsREJLODBWlX3d+NpvdHIoU
TLSH
T1C8B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mqtddjcfun.exe

Path C:\Users\Admin\AppData\Local\Temp\mqtddjcfun.exe
Size 10.4MB
SHA256 6b34a9b5f27baaf43b37ceb6097cfcf5ae7f89591efba4543d7dd1d4f6c8d000
MD5 b5ffd132a5487165a3013d33c45aff57
SHA1 8373306e45c74b875cd9b39df5a0a50eb916d2c5
SHA512 55b10a4bdc0635dd36293e6fe5020569aa76c58ef719c8698e98fcef37cbdea098de93903999b00022d0a2596c202dfac637fe0afc297bb6d352193d1be59386
SSDEEP 196608:XZGmu/sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGn/sREJLODBWlX3d+NpvdHIoU
TLSH
T18FB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mugfqekrgr.exe

Path C:\Users\Admin\AppData\Local\Temp\mugfqekrgr.exe
Size 10.4MB
SHA256 05d93479725bd29106a83c544ed3f56476a2e4f5277d3e8f45c02bdb917d8c9b
MD5 91c17dbe318d6ac30842981e00f2e656
SHA1 b1b6353b7769f0571c490c075304a1f66661278a
SHA512 e2932917715a551f3f276efb84baaa304fb53055435c8180fc76bd7eba421057ad20c99e5a6a519fea46f8476a1660d84ec0c113830078d7f82c17e3193a93dc
SSDEEP 196608:XZGmumsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnmsREJLODBWlX3d+NpvdHIoU
TLSH
T181B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mxdyigskmh.exe

Path C:\Users\Admin\AppData\Local\Temp\mxdyigskmh.exe
Size 10.4MB
SHA256 2e3cb30f0c4f41781cd80256e7de703724d76e117c2e50cd49145605924abc1f
MD5 70aeeb1da4bee3f657e36fbe7976771d
SHA1 0de40796137f7f6d2d52fee48d99a3a56efda7d9
SHA512 bb252efc4fccfb3578a7f6ba66dc3d973c0ee85e7b8be9146bd6fb3c449ca2390b36c1e08c46090cf0c825f537ba4c0d2a479878b6f581aaafa9adee4a89c5c9
SSDEEP 196608:XZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGngsREJLODBWlX3d+NpvdHIoU
TLSH
T122B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsqhorfues.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqhorfues.exe
Size 10.4MB
SHA256 9f223cd824fe88ef5f8e83c512523a1f5bc2f7e6e76d49bf24c27f8a41c2bfee
MD5 1a7b531a790aa41a9d24a4b64d5d6f1b
SHA1 1bff5d54d3583da63d5b463d3f87e2db30abb852
SHA512 9233eeebd38f032e2e89e7cc52039444b9e218dc165114c625abc7c1da03114303a0df367e652cb9dc39e5574a72c9d1bf5ddb06fe7d93cfeccc97252a262ad3
SSDEEP 196608:XZGmuCsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnCsREJLODBWlX3d+NpvdHIoU
TLSH
T182B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ondnzbjzvo.exe

Path C:\Users\Admin\AppData\Local\Temp\ondnzbjzvo.exe
Size 10.4MB
SHA256 43fd3b325f55ae3a73a443d8bd4d4a837869a8256f0c0be3a56709835c644b44
MD5 7feafbe551947d9d20776f0ceb23d292
SHA1 8be87ae9cbe9631551e32694a9b124b133d79213
SHA512 6a88c9254f22d3ea2297e603289eb02c74b4c7d0c08949ea972ae6583fb0aa5d15ddc5a1f89dd48acd2c9e23b65ad8390152ee9a8bb2759d3cd9b13aa42eef90
SSDEEP 196608:XZGmuVsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnVsREJLODBWlX3d+NpvdHIoU
TLSH
T123B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psaeexgimv.exe

Path C:\Users\Admin\AppData\Local\Temp\psaeexgimv.exe
Size 10.4MB
SHA256 b3f5e0e42671cc5708cbc60f9329cec2c5a59887cce538f3947acd63dc658498
MD5 24b6d1cbcc9f394d1f605c78f07905fe
SHA1 700f62141f359b31e1c344498d443fbd8ada2b6f
SHA512 54c0cc64fa3ee812f2e06b5e701706fc777c1face1e399c3c51624234452c04fde8ec8691cf39cbeda9df8ccb58d8954ba62833b1e16b99559d7f35088f024fb
SSDEEP 196608:XZGmuZsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnZsREJLODBWlX3d+NpvdHIoU
TLSH
T1C7B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tdtnduwbvf.exe

Path C:\Users\Admin\AppData\Local\Temp\tdtnduwbvf.exe
Size 10.4MB
SHA256 ed20f84dad40b4041ffa025c536a91158cef78250aa0da54c12a1e12710c5455
MD5 8d8208b704a761b08b3b54f5d2a23f08
SHA1 536b7c2f06aa422de8183fb38e9ec0e55e700753
SHA512 32bdab930799629f15a9a3fb11869173d9c7922f7d58aa53434c92d082b66818798847d8d32f41be5424e18d47e3e76c8093298525cae1f7f6731e7aad2dd5d7
SSDEEP 196608:XZGmu6sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGn6sREJLODBWlX3d+NpvdHIoU
TLSH
T132B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tknldwttyy.exe

Path C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
Size 10.4MB
SHA256 710db394ca75a67c428ad0bc6460b5ab8d5707bb2eac0c857ff170b5e538aff8
MD5 dfeeba66ae01b27d3509dab65bafa058
SHA1 224c972cbe738c88ebde39338fdc9c5b86114bb1
SHA512 13a4a4fe5406eb92e42f33061d418bc6dafffde461d972bc5f92502d5d22d2de7d83be3bf3b329596acbc73c10219399db32cbae2a04b3ba2466aff6156b0ec4
SSDEEP 196608:XZGmu4sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGn4sREJLODBWlX3d+NpvdHIoU
TLSH
T1E4B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tssfueimyk.exe

Path C:\Users\Admin\AppData\Local\Temp\tssfueimyk.exe
Size 10.4MB
SHA256 46e504622055d757c8899ec4162e192fc010be8c093b081130520995a60cd849
MD5 f3996d954a6f505cbe6221832381cf85
SHA1 ff0af43dac93db419e88f82f56871da13dd18f2f
SHA512 8df0c802cfeb6d25ec38b19ba665e4576ef27d6900443998b7dd4c5393549fa4033cf3b3cbe7e7b1b70ba1df4dc86d0270739a3cd4fe238eee47e739626a7436
SSDEEP 196608:XZGmuasR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnasREJLODBWlX3d+NpvdHIoU
TLSH
T133B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulszhysynh.exe

Path C:\Users\Admin\AppData\Local\Temp\ulszhysynh.exe
Size 10.4MB
SHA256 f41b3e2d33b0351f7cdedec6a9e6e83725dd75b31029eb48403ce064f3f4f0a1
MD5 237fef1a4819056db8550d8f5f651bce
SHA1 4e3f3ccd3b486d365ff66b84e070841d1ad1958b
SHA512 a92b15ca0ad2f381e8ccd39e5b614a1117de0e1253c2beb8df44b19294150fcccbf7725735d2c564e57d3d5b13e6b508bfaad37295f8fe0a7aec0a21a4aabb8c
SSDEEP 196608:XZGmuysR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnysREJLODBWlX3d+NpvdHIoU
TLSH
T194B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 96cabca89f9f06d396c5ae485a9314d341a23490424b51245fb185a0c20ffc02
MD5 4dfcfec27e96cad6077e3bdc979223db
SHA1 0c9ead6b459cfc16b7cffcb1d4b14359aa4ac02f
SHA512 112ed17ab50d23b19fcd1aab251187cc26697740c9cda3e2e80ec7f55f38ced36953128638ff9763c3b9381c1eaedb21be1644120bb783e44ce5609b7ee25569
SSDEEP 196608:XZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnPsREJLODBWlX3d+NpvdHIoU
TLSH
T1C9B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 bac62f1b8cd00dbab44e0f670a0f0553fbe94e5374cd42f2694c00b2df9cd5b7
MD5 c9f31dac6e14c343a42c7c6071fb5038
SHA1 bbcfd39fd8e585a6b5d1fbf5a180017a0828246b
SHA512 50f94b6c803e20041a2ea8b8dcf0b3928be4bc2da45367f3570dc308e78e7fc4b5571f9a32204d0a82fe9343d0f4e86acc021fc20628b656cbe61b34c28c80f0
SSDEEP 196608:XZGmuVsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnVsREJLODBWlX3d+NpvdHIoU
TLSH
T132B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 e8c3f232104601bc0fa38732a5fb9ec5188cd4e3b39ac87a7cca25fbfda64641
MD5 3305badfc263682cc90f8d678fa2fd11
SHA1 db4f7ba260684051ca5fbf64542edc025ec4b00c
SHA512 7602ff3868bf5efdc8f897ebb2ad84223fa006ea56e21fbe988a0442e13452c4765b97bdbf0fffcb63c25474d9891a1960adea1408e6fabc389a4051b0676447
SSDEEP 196608:XZGmudsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGndsREJLODBWlX3d+NpvdHIoU
TLSH
T139B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 6.1MB
SHA256 ee9224a8e536211c711cf64485fb2937ac9593cb89be51f24b25864b3ffee749
MD5 cec4ec47ffa561e4bbc9c0b59da7a5ae
SHA1 53430e4eedc09da28b8f86c084a766c4b657570a
SHA512 40925f4be25276822c92f68cdf56e848213f51bb607e76ed8ee7c039a087fedd6c401321116099aca7d5796ad30aad3433e885bea7a849a1ba5ac731cf50753d
SSDEEP 98304:bImZG9QR5JzQ9Rp9VbQzwIqIg42/HHhNGPo+fKWTChlOKOD4gHP:XZGmujsR2/LGPLCXOKODxHP
TLSH
T195560223E191C072E205193666B21F387DF897596AF0CDA3F7E4DCA26C624A1E77B10D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 5228ff1fb2097c372ee3dc8bc9e19a27ba427cd9984872b9ab90ec30d435eb34
MD5 19ecfdcb1830d6116b8c44ff474a2ab2
SHA1 7a06e76528d2c70deef3bb4ffeae2a4c05b8aacc
SHA512 2bcaa0d15849dece72d66bd7da311e7e1398e834042219027c64c0b66b36153173e0a4c4e58122ddfa0e11aa7ffdc7d24670f756e81f32dc571d6c1edb33e811
SSDEEP 196608:XZGmursR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnrsREJLODBWlX3d+NpvdHIoU
TLSH
T14AB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 f3d378493bcff4ea365c601a3c9935bf5409b060cffebb04cb88781819c9ca6d
MD5 5213dd1f529cb6e2ee127d1d6606c8b0
SHA1 c1a9a5d506b4fb4bf843852e8f55232e7b7409d7
SHA512 170fedb0eff41d4a3f71eec4e739053a36f22fee4a2a3a8c5f7c7a5c648bf51fb8145093888318e49fb3fe1efeb1fc3d08a053ce90d31dd557daddc34afa2cb7
SSDEEP 196608:XZGmumsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnmsREJLODBWlX3d+NpvdHIoU
TLSH
T15FB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 8b49fa2ea9c44f10f4168038bb6eb76976f7d8931ba813718fc88c93cce8356f
MD5 e01bd4cbeb1279881f2a9cab7cd452f6
SHA1 807e536cab51f87c1f679985c75e0224062a104c
SHA512 b8fb52812a9fbeafec6fbf2cfc4eab32d2cfd6e50d93449feece8757c09ac924f845c3ab44a8e13705055407b630213ee523ba4483e673445962729cc51780be
SSDEEP 196608:XZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGngsREJLODBWlX3d+NpvdHIoU
TLSH
T1E7B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virgazsrul.exe

Path C:\Users\Admin\AppData\Local\Temp\virgazsrul.exe
Size 10.4MB
SHA256 bf5e59de768d2cc4e7dcc2bee88a1346da9794eb24841f8056e9d2c009a29bcf
MD5 d44041d6cea5a0defea14da65a902c3d
SHA1 71765ba4a64993d32b6bb7e9ace1cd0d707b2887
SHA512 5e0800df8fe8e0c2388e2c93038bfe6ed1cc3569867a1b95f43885087f2eb60cf85b05b4b5293d209f03dae76432beb5d186211d1adfb622e128dfafbe36f1b2
SSDEEP 196608:XZGmursR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnrsREJLODBWlX3d+NpvdHIoU
TLSH
T194B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xywfdkdyyf.exe

Path C:\Users\Admin\AppData\Local\Temp\xywfdkdyyf.exe
Size 10.4MB
SHA256 1f31348bf35f18f497c0ba0531eba7e0a9877eecb7376058f4ead73b1d385163
MD5 c4a13e75b68a30481fcd1671e211735a
SHA1 dff1ff18a0c97b2b9099e6b6556ef453bfefe729
SHA512 0d007bfe62c0318c2c9b96df2893aa4dca7e1ce9241fb9118a1e68b5df9d23f7c0f32e632031555745a3118c4740cd3534b7f534c03dc5af399e7cb144ce107c
SSDEEP 196608:XZGmu7sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGn7sREJLODBWlX3d+NpvdHIoU
TLSH
T1E6B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yhojvzihks.exe

Path C:\Users\Admin\AppData\Local\Temp\yhojvzihks.exe
Size 10.4MB
SHA256 0bb1ae8daf247122f07005513ace5bf3eb77da7dad95aaa0549f84f3369485d4
MD5 3bd8c196f6378a6ad9b9576ec8378601
SHA1 bd9392a6e751ce29ae71042879e57275718a27a1
SHA512 a40a314058692febb9ddbb4ba32c0eb0be4af757fecd4c5d34a374c42a30e2901a47224a97fbf9494561d731f918bbada496877deeeab43839f9d5bed2c8eae2
SSDEEP 196608:XZGmuKsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnKsREJLODBWlX3d+NpvdHIoU
TLSH
T1AAB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-108-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/608-0-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/608-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/632-118-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1096-16-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1096-15-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/1244-90-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1376-82-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1428-342-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1556-24-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1556-23-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/1580-370-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1840-134-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1936-115-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2364-59-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2944-8-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2968-41-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3016-123-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3028-44-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3120-365-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3184-2-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/3184-3-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3216-333-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3224-52-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3224-51-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/3324-79-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3432-32-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/3432-33-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3444-356-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3564-11-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3564-10-0x0000000002C00000-0x0000000002C01000-memory.dmp

Download

memory/3652-100-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3748-349-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3752-36-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3852-354-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3864-126-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4280-105-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4348-345-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4348-346-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4448-74-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4468-325-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4508-97-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4604-367-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4636-19-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4636-18-0x0000000002C20000-0x0000000002C21000-memory.dmp

Download

memory/4736-163-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4780-131-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4820-361-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4880-160-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4936-351-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5024-216-0x0000021E14240000-0x0000021E14260000-memory.dmp

Download

memory/5024-178-0x0000021E02E20000-0x0000021E02F20000-memory.dmp

Download

memory/5024-170-0x0000021E001E0000-0x0000021E002E0000-memory.dmp

Download

memory/5024-196-0x0000021E02DC0000-0x0000021E02DE0000-memory.dmp

Download

memory/5024-177-0x0000021E02C60000-0x0000021E02C80000-memory.dmp

Download

memory/5032-49-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5412-322-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5428-330-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5644-62-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5648-87-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5688-71-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5848-359-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6084-28-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6084-27-0x0000000001040000-0x0000000001041000-memory.dmp

Download