fb7d52b7558877742037cf0014cbd4d215eb100602ee8a994b1a2bf5ad4fab39

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Size 10.4MB
Sample260708-2f4vmaaz7x
SHA256 fb7d52b7558877742037cf0014cbd4d215eb100602ee8a994b1a2bf5ad4fab39
MD5 42c921a75495e25bb348428f6004bf87
SHA1 39f3b15a418a27362d120c18a9c50fb05f27525f
SHA512 7b90a20429b7a2dfdb6df0301acb3006bb045b27fdc5845a805d6e5e20ce063c82854f323be29a5f0bc60f5d317fb2097444a2de5114a61d9334592185693b39
SSDEEP 196608:XZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGngsREJLODBWlX3d+NpvdHIom
TLSH
T132B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 10 IoCs

pid	Process
1480	bcrhimkbss.exe
5916	bcrhimkbss.exe
1084	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
1604	tknldwttyy.exe
2312	tknldwttyy.exe
4416	qqoydlnptq.exe
5192	qqoydlnptq.exe
6128	qcxshbmwxc.exe
5636	qcxshbmwxc.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2052	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1480	bcrhimkbss.exe
5916	bcrhimkbss.exe
1084	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
1604	tknldwttyy.exe
2312	tknldwttyy.exe
4416	qqoydlnptq.exe
5192	qqoydlnptq.exe
6128	qcxshbmwxc.exe
5636	qcxshbmwxc.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qqoydlnptq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcxshbmwxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdoxxlfxbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tknldwttyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tknldwttyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcxshbmwxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcrhimkbss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcrhimkbss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdoxxlfxbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qqoydlnptq.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{1995D261-EA98-43E8-A587-8430ED37DEC7}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{59A81C58-2286-4D4D-AAE5-26DAD6C021DE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2052	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2052	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1480	bcrhimkbss.exe
1480	bcrhimkbss.exe
1480	bcrhimkbss.exe
1480	bcrhimkbss.exe
5916	bcrhimkbss.exe
5916	bcrhimkbss.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1084	qdoxxlfxbv.exe
1084	qdoxxlfxbv.exe
1084	qdoxxlfxbv.exe
1084	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
1480	bcrhimkbss.exe
1480	bcrhimkbss.exe
1604	tknldwttyy.exe
1604	tknldwttyy.exe
1604	tknldwttyy.exe
1604	tknldwttyy.exe
1084	qdoxxlfxbv.exe
1084	qdoxxlfxbv.exe
2312	tknldwttyy.exe
2312	tknldwttyy.exe
4416	qqoydlnptq.exe
4416	qqoydlnptq.exe
4416	qqoydlnptq.exe
4416	qqoydlnptq.exe
5192	qqoydlnptq.exe
5192	qqoydlnptq.exe
1604	tknldwttyy.exe
1604	tknldwttyy.exe
6128	qcxshbmwxc.exe
6128	qcxshbmwxc.exe
6128	qcxshbmwxc.exe
6128	qcxshbmwxc.exe
5636	qcxshbmwxc.exe
5636	qcxshbmwxc.exe
4416	qqoydlnptq.exe
4416	qqoydlnptq.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	248	explorer.exe
Token: SeCreatePagefilePrivilege	248	explorer.exe
Token: SeShutdownPrivilege	248	explorer.exe
Token: SeCreatePagefilePrivilege	248	explorer.exe
Token: SeShutdownPrivilege	248	explorer.exe
Token: SeCreatePagefilePrivilege	248	explorer.exe
Token: SeShutdownPrivilege	248	explorer.exe
Token: SeCreatePagefilePrivilege	248	explorer.exe
Token: SeShutdownPrivilege	248	explorer.exe
Token: SeCreatePagefilePrivilege	248	explorer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2056	sihost.exe
248	explorer.exe
248	explorer.exe
248	explorer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
248	explorer.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2052	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2052	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
1480	bcrhimkbss.exe
1480	bcrhimkbss.exe
5916	bcrhimkbss.exe
5916	bcrhimkbss.exe
1084	qdoxxlfxbv.exe
1084	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
4372	qdoxxlfxbv.exe
1604	tknldwttyy.exe
1604	tknldwttyy.exe
2312	tknldwttyy.exe
2312	tknldwttyy.exe
4416	qqoydlnptq.exe
4416	qqoydlnptq.exe
5192	qqoydlnptq.exe
5192	qqoydlnptq.exe
6128	qcxshbmwxc.exe
6128	qcxshbmwxc.exe
5636	qcxshbmwxc.exe
5636	qcxshbmwxc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2052	1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	88
PID 1472 wrote to memory of 1480	1472	2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	89
PID 1480 wrote to memory of 5916	1480	bcrhimkbss.exe	90
PID 1480 wrote to memory of 1084	1480	bcrhimkbss.exe	91
PID 1084 wrote to memory of 4372	1084	qdoxxlfxbv.exe	115
PID 1084 wrote to memory of 1604	1084	qdoxxlfxbv.exe	93
PID 1604 wrote to memory of 2312	1604	tknldwttyy.exe	94
PID 1604 wrote to memory of 4416	1604	tknldwttyy.exe	95
PID 4416 wrote to memory of 5192	4416	qqoydlnptq.exe	97
PID 4416 wrote to memory of 6128	4416	qqoydlnptq.exe	101
PID 6128 wrote to memory of 5636	6128	qcxshbmwxc.exe	102
PID 2056 wrote to memory of 248	2056	sihost.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-08_42c921a75495e25bb348428f6004bf87_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update bcrhimkbss.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\bcrhimkbss.exe
  C:\Users\Admin\AppData\Local\Temp\bcrhimkbss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\bcrhimkbss.exe
    C:\Users\Admin\AppData\Local\Temp\bcrhimkbss.exe update qdoxxlfxbv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\qdoxxlfxbv.exe
    C:\Users\Admin\AppData\Local\Temp\qdoxxlfxbv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\qdoxxlfxbv.exe
      C:\Users\Admin\AppData\Local\Temp\qdoxxlfxbv.exe update tknldwttyy.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
      C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe
        
        C:\Users\Admin\AppData\Local\Temp\tknldwttyy.exe update qqoydlnptq.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\qqoydlnptq.exe
        
        C:\Users\Admin\AppData\Local\Temp\qqoydlnptq.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\qqoydlnptq.exe
        
        C:\Users\Admin\AppData\Local\Temp\qqoydlnptq.exe update qcxshbmwxc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\qcxshbmwxc.exe
        
        C:\Users\Admin\AppData\Local\Temp\qcxshbmwxc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\qcxshbmwxc.exe
        
        C:\Users\Admin\AppData\Local\Temp\qcxshbmwxc.exe update lgnudnbluk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\lgnudnbluk.exe
        
        C:\Users\Admin\AppData\Local\Temp\lgnudnbluk.exe
        7⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\lgnudnbluk.exe
        
        C:\Users\Admin\AppData\Local\Temp\lgnudnbluk.exe update yebitscgdb.exe
        8⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\yebitscgdb.exe
        
        C:\Users\Admin\AppData\Local\Temp\yebitscgdb.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\yebitscgdb.exe
        
        C:\Users\Admin\AppData\Local\Temp\yebitscgdb.exe update dzfxiymldb.exe
        9⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        9⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe update fzrhzkbhdq.exe
        10⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\fzrhzkbhdq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fzrhzkbhdq.exe
        10⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\fzrhzkbhdq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fzrhzkbhdq.exe update fqvzrsgnsv.exe
        11⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\fqvzrsgnsv.exe
        
        C:\Users\Admin\AppData\Local\Temp\fqvzrsgnsv.exe
        11⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\fqvzrsgnsv.exe
        
        C:\Users\Admin\AppData\Local\Temp\fqvzrsgnsv.exe update atlbzqrhgb.exe
        12⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\atlbzqrhgb.exe
        
        C:\Users\Admin\AppData\Local\Temp\atlbzqrhgb.exe
        12⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\atlbzqrhgb.exe
        
        C:\Users\Admin\AppData\Local\Temp\atlbzqrhgb.exe update epjtfcsmct.exe
        13⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\epjtfcsmct.exe
        
        C:\Users\Admin\AppData\Local\Temp\epjtfcsmct.exe
        13⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\epjtfcsmct.exe
        
        C:\Users\Admin\AppData\Local\Temp\epjtfcsmct.exe update zzjjyzbxtg.exe
        14⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\zzjjyzbxtg.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzjjyzbxtg.exe
        14⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\zzjjyzbxtg.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzjjyzbxtg.exe update zzkjiwbceg.exe
        15⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\zzkjiwbceg.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzkjiwbceg.exe
        15⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\zzkjiwbceg.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzkjiwbceg.exe update orlftkgodo.exe
        16⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\orlftkgodo.exe
        
        C:\Users\Admin\AppData\Local\Temp\orlftkgodo.exe
        16⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\orlftkgodo.exe
        
        C:\Users\Admin\AppData\Local\Temp\orlftkgodo.exe update yjjywqcfng.exe
        17⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\yjjywqcfng.exe
        
        C:\Users\Admin\AppData\Local\Temp\yjjywqcfng.exe
        17⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\yjjywqcfng.exe
        
        C:\Users\Admin\AppData\Local\Temp\yjjywqcfng.exe update bfzxozzphg.exe
        18⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\bfzxozzphg.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfzxozzphg.exe
        18⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\bfzxozzphg.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfzxozzphg.exe update tvoiwkreuv.exe
        19⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\tvoiwkreuv.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvoiwkreuv.exe
        19⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\tvoiwkreuv.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvoiwkreuv.exe update lvdwgrnqsk.exe
        20⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe
        20⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe
        
        C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe update tivkuckqsx.exe
        21⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\tivkuckqsx.exe
        
        C:\Users\Admin\AppData\Local\Temp\tivkuckqsx.exe
        21⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\tivkuckqsx.exe
        
        C:\Users\Admin\AppData\Local\Temp\tivkuckqsx.exe update sjmqlerjwh.exe
        22⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\sjmqlerjwh.exe
        
        C:\Users\Admin\AppData\Local\Temp\sjmqlerjwh.exe
        22⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\sjmqlerjwh.exe
        
        C:\Users\Admin\AppData\Local\Temp\sjmqlerjwh.exe update njzbvbcjxm.exe
        23⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\njzbvbcjxm.exe
        
        C:\Users\Admin\AppData\Local\Temp\njzbvbcjxm.exe
        23⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\njzbvbcjxm.exe
        
        C:\Users\Admin\AppData\Local\Temp\njzbvbcjxm.exe update fybjxxpktq.exe
        24⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\fybjxxpktq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fybjxxpktq.exe
        24⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\fybjxxpktq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fybjxxpktq.exe update apfkagfudw.exe
        25⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\apfkagfudw.exe
        
        C:\Users\Admin\AppData\Local\Temp\apfkagfudw.exe
        25⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\apfkagfudw.exe
        
        C:\Users\Admin\AppData\Local\Temp\apfkagfudw.exe update sepsccaoab.exe
        26⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\sepsccaoab.exe
        
        C:\Users\Admin\AppData\Local\Temp\sepsccaoab.exe
        26⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\sepsccaoab.exe
        
        C:\Users\Admin\AppData\Local\Temp\sepsccaoab.exe update fsjthalarr.exe
        27⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\fsjthalarr.exe
        
        C:\Users\Admin\AppData\Local\Temp\fsjthalarr.exe
        27⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\fsjthalarr.exe
        
        C:\Users\Admin\AppData\Local\Temp\fsjthalarr.exe update zgxztufbou.exe
        28⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\zgxztufbou.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgxztufbou.exe
        28⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\zgxztufbou.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgxztufbou.exe update hkspchvrmz.exe
        29⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe
        
        C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe
        29⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe
        
        C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe update hvelvosiwt.exe
        30⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\hvelvosiwt.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvelvosiwt.exe
        30⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\hvelvosiwt.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvelvosiwt.exe update xmbwtzawbj.exe
        31⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\xmbwtzawbj.exe
        
        C:\Users\Admin\AppData\Local\Temp\xmbwtzawbj.exe
        31⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\xmbwtzawbj.exe
        
        C:\Users\Admin\AppData\Local\Temp\xmbwtzawbj.exe update awdxkpvdlz.exe
        32⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\awdxkpvdlz.exe
        
        C:\Users\Admin\AppData\Local\Temp\awdxkpvdlz.exe
        32⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\awdxkpvdlz.exe
        
        C:\Users\Admin\AppData\Local\Temp\awdxkpvdlz.exe update admfbalrio.exe
        33⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\admfbalrio.exe
        
        C:\Users\Admin\AppData\Local\Temp\admfbalrio.exe
        33⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\admfbalrio.exe
        
        C:\Users\Admin\AppData\Local\Temp\admfbalrio.exe update entdvpgpac.exe
        34⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\entdvpgpac.exe
        
        C:\Users\Admin\AppData\Local\Temp\entdvpgpac.exe
        34⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\entdvpgpac.exe
        
        C:\Users\Admin\AppData\Local\Temp\entdvpgpac.exe update jaxonsxxqt.exe
        35⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\jaxonsxxqt.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaxonsxxqt.exe
        35⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\jaxonsxxqt.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaxonsxxqt.exe update zbvkfrydbv.exe
        36⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\zbvkfrydbv.exe
        
        C:\Users\Admin\AppData\Local\Temp\zbvkfrydbv.exe
        36⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\zbvkfrydbv.exe
        
        C:\Users\Admin\AppData\Local\Temp\zbvkfrydbv.exe update hvggnmqpsz.exe
        37⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\hvggnmqpsz.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvggnmqpsz.exe
        37⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\hvggnmqpsz.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvggnmqpsz.exe update xhpjzclyeb.exe
        38⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\xhpjzclyeb.exe
        
        C:\Users\Admin\AppData\Local\Temp\xhpjzclyeb.exe
        38⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\xhpjzclyeb.exe
        
        C:\Users\Admin\AppData\Local\Temp\xhpjzclyeb.exe update hvcxalbmbo.exe
        39⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\hvcxalbmbo.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvcxalbmbo.exe
        39⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\hvcxalbmbo.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvcxalbmbo.exe update jdadvdtdht.exe
        40⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\jdadvdtdht.exe
        
        C:\Users\Admin\AppData\Local\Temp\jdadvdtdht.exe
        40⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\jdadvdtdht.exe
        
        C:\Users\Admin\AppData\Local\Temp\jdadvdtdht.exe update rvhzbhzmyf.exe
        41⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\rvhzbhzmyf.exe
        
        C:\Users\Admin\AppData\Local\Temp\rvhzbhzmyf.exe
        41⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\rvhzbhzmyf.exe
        
        C:\Users\Admin\AppData\Local\Temp\rvhzbhzmyf.exe update ucasbblhrg.exe
        42⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\ucasbblhrg.exe
        
        C:\Users\Admin\AppData\Local\Temp\ucasbblhrg.exe
        42⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\ucasbblhrg.exe
        
        C:\Users\Admin\AppData\Local\Temp\ucasbblhrg.exe update zfcjlnoeqw.exe
        43⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\zfcjlnoeqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zfcjlnoeqw.exe
        43⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\zfcjlnoeqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zfcjlnoeqw.exe update evlmkckguy.exe
        44⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\evlmkckguy.exe
        
        C:\Users\Admin\AppData\Local\Temp\evlmkckguy.exe
        44⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\evlmkckguy.exe
        
        C:\Users\Admin\AppData\Local\Temp\evlmkckguy.exe update wogvorepgy.exe
        45⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\wogvorepgy.exe
        
        C:\Users\Admin\AppData\Local\Temp\wogvorepgy.exe
        45⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\wogvorepgy.exe
        
        C:\Users\Admin\AppData\Local\Temp\wogvorepgy.exe update ozvozlfsyi.exe
        46⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\ozvozlfsyi.exe
        
        C:\Users\Admin\AppData\Local\Temp\ozvozlfsyi.exe
        46⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\ozvozlfsyi.exe
        
        C:\Users\Admin\AppData\Local\Temp\ozvozlfsyi.exe update buwfpelkqi.exe
        47⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\buwfpelkqi.exe
        
        C:\Users\Admin\AppData\Local\Temp\buwfpelkqi.exe
        47⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\buwfpelkqi.exe
        
        C:\Users\Admin\AppData\Local\Temp\buwfpelkqi.exe update lfzlhiiwdy.exe
        48⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\lfzlhiiwdy.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfzlhiiwdy.exe
        48⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\lfzlhiiwdy.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfzlhiiwdy.exe update ypmcpmghvw.exe
        49⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\ypmcpmghvw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ypmcpmghvw.exe
        49⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\ypmcpmghvw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ypmcpmghvw.exe update oyllbsembw.exe
        50⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\oyllbsembw.exe
        
        C:\Users\Admin\AppData\Local\Temp\oyllbsembw.exe
        50⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\oyllbsembw.exe
        
        C:\Users\Admin\AppData\Local\Temp\oyllbsembw.exe update lsqzbkkwbu.exe
        51⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\lsqzbkkwbu.exe
        
        C:\Users\Admin\AppData\Local\Temp\lsqzbkkwbu.exe
        51⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\lsqzbkkwbu.exe
        
        C:\Users\Admin\AppData\Local\Temp\lsqzbkkwbu.exe update qntdxdlsmi.exe
        52⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\qntdxdlsmi.exe
        
        C:\Users\Admin\AppData\Local\Temp\qntdxdlsmi.exe
        52⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\qntdxdlsmi.exe
        
        C:\Users\Admin\AppData\Local\Temp\qntdxdlsmi.exe update ndneuzkhzs.exe
        53⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\ndneuzkhzs.exe
        
        C:\Users\Admin\AppData\Local\Temp\ndneuzkhzs.exe
        53⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\ndneuzkhzs.exe
        
        C:\Users\Admin\AppData\Local\Temp\ndneuzkhzs.exe update kfrzikkvlo.exe
        54⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\kfrzikkvlo.exe
        
        C:\Users\Admin\AppData\Local\Temp\kfrzikkvlo.exe
        54⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\kfrzikkvlo.exe
        
        C:\Users\Admin\AppData\Local\Temp\kfrzikkvlo.exe update asavwvhvlc.exe
        55⤵
        
        PID:5248

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:248

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5624

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2484

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv WHZUF/xaKkWsrpafUPSjRA.0.1
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact