Analysis
- max time kernel
23s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 16:02
General
- Target 2026-07-09_fbdbd581b53fe563088d84d3acbe4d71_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.4MB
- Sample260709-tg2snady51
- SHA256 452ab7391f73f7f6ff8749f5722571562d38eb944aff2adf3028ce73a01ea6fa
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 47 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_fbdbd581b53fe563088d84d3acbe4d71_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_fbdbd581b53fe563088d84d3acbe4d71_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_fbdbd581b53fe563088d84d3acbe4d71_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-07-09_fbdbd581b53fe563088d84d3acbe4d71_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update rvtqqjinkw.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\rvtqqjinkw.exeC:\Users\Admin\AppData\Local\Temp\rvtqqjinkw.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rvtqqjinkw.exeC:\Users\Admin\AppData\Local\Temp\rvtqqjinkw.exe update wemrctlyxr.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\wemrctlyxr.exeC:\Users\Admin\AppData\Local\Temp\wemrctlyxr.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wemrctlyxr.exeC:\Users\Admin\AppData\Local\Temp\wemrctlyxr.exe update obgapmxefw.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\obgapmxefw.exeC:\Users\Admin\AppData\Local\Temp\obgapmxefw.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obgapmxefw.exeC:\Users\Admin\AppData\Local\Temp\obgapmxefw.exe update vcejsjvbkx.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vcejsjvbkx.exeC:\Users\Admin\AppData\Local\Temp\vcejsjvbkx.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcejsjvbkx.exeC:\Users\Admin\AppData\Local\Temp\vcejsjvbkx.exe update nyxtncphsc.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\nyxtncphsc.exeC:\Users\Admin\AppData\Local\Temp\nyxtncphsc.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nyxtncphsc.exeC:\Users\Admin\AppData\Local\Temp\nyxtncphsc.exe update dhlyzgamdm.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dhlyzgamdm.exeC:\Users\Admin\AppData\Local\Temp\dhlyzgamdm.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dhlyzgamdm.exeC:\Users\Admin\AppData\Local\Temp\dhlyzgamdm.exe update tisegjgmge.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\tisegjgmge.exeC:\Users\Admin\AppData\Local\Temp\tisegjgmge.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tisegjgmge.exeC:\Users\Admin\AppData\Local\Temp\tisegjgmge.exe update bbbcakripy.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bbbcakripy.exeC:\Users\Admin\AppData\Local\Temp\bbbcakripy.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bbbcakripy.exeC:\Users\Admin\AppData\Local\Temp\bbbcakripy.exe update qnbabahzyc.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qnbabahzyc.exeC:\Users\Admin\AppData\Local\Temp\qnbabahzyc.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qnbabahzyc.exeC:\Users\Admin\AppData\Local\Temp\qnbabahzyc.exe update gltdttzgcu.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\gltdttzgcu.exeC:\Users\Admin\AppData\Local\Temp\gltdttzgcu.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gltdttzgcu.exeC:\Users\Admin\AppData\Local\Temp\gltdttzgcu.exe update kvkzuvfzvq.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\kvkzuvfzvq.exeC:\Users\Admin\AppData\Local\Temp\kvkzuvfzvq.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kvkzuvfzvq.exeC:\Users\Admin\AppData\Local\Temp\kvkzuvfzvq.exe update vfliygtcax.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vfliygtcax.exeC:\Users\Admin\AppData\Local\Temp\vfliygtcax.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\vfliygtcax.exeC:\Users\Admin\AppData\Local\Temp\vfliygtcax.exe update dvjggaarff.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dvjggaarff.exeC:\Users\Admin\AppData\Local\Temp\dvjggaarff.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\dvjggaarff.exeC:\Users\Admin\AppData\Local\Temp\dvjggaarff.exe update xgxkpsapae.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xgxkpsapae.exeC:\Users\Admin\AppData\Local\Temp\xgxkpsapae.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\xgxkpsapae.exeC:\Users\Admin\AppData\Local\Temp\xgxkpsapae.exe update mlqzxhpgzl.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mlqzxhpgzl.exeC:\Users\Admin\AppData\Local\Temp\mlqzxhpgzl.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\mlqzxhpgzl.exeC:\Users\Admin\AppData\Local\Temp\mlqzxhpgzl.exe update eqbnhexeij.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\eqbnhexeij.exeC:\Users\Admin\AppData\Local\Temp\eqbnhexeij.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\eqbnhexeij.exeC:\Users\Admin\AppData\Local\Temp\eqbnhexeij.exe update colgfsnvyq.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\colgfsnvyq.exeC:\Users\Admin\AppData\Local\Temp\colgfsnvyq.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\colgfsnvyq.exeC:\Users\Admin\AppData\Local\Temp\colgfsnvyq.exe update onwcfepclm.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\onwcfepclm.exeC:\Users\Admin\AppData\Local\Temp\onwcfepclm.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\onwcfepclm.exeC:\Users\Admin\AppData\Local\Temp\onwcfepclm.exe update rmxnzkshrz.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rmxnzkshrz.exeC:\Users\Admin\AppData\Local\Temp\rmxnzkshrz.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\rmxnzkshrz.exeC:\Users\Admin\AppData\Local\Temp\rmxnzkshrz.exe update epbkmiwvwx.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\epbkmiwvwx.exeC:\Users\Admin\AppData\Local\Temp\epbkmiwvwx.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\epbkmiwvwx.exeC:\Users\Admin\AppData\Local\Temp\epbkmiwvwx.exe update ahoqijnlya.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ahoqijnlya.exeC:\Users\Admin\AppData\Local\Temp\ahoqijnlya.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\ahoqijnlya.exeC:\Users\Admin\AppData\Local\Temp\ahoqijnlya.exe update isaztelplk.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\isaztelplk.exeC:\Users\Admin\AppData\Local\Temp\isaztelplk.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\isaztelplk.exeC:\Users\Admin\AppData\Local\Temp\isaztelplk.exe update gvevoyldey.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gvevoyldey.exeC:\Users\Admin\AppData\Local\Temp\gvevoyldey.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\gvevoyldey.exeC:\Users\Admin\AppData\Local\Temp\gvevoyldey.exe update lxhqcsmzyu.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lxhqcsmzyu.exeC:\Users\Admin\AppData\Local\Temp\lxhqcsmzyu.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\lxhqcsmzyu.exeC:\Users\Admin\AppData\Local\Temp\lxhqcsmzyu.exe update qvohailqwv.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qvohailqwv.exeC:\Users\Admin\AppData\Local\Temp\qvohailqwv.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\qvohailqwv.exeC:\Users\Admin\AppData\Local\Temp\qvohailqwv.exe update ajanariebi.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ajanariebi.exeC:\Users\Admin\AppData\Local\Temp\ajanariebi.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\ajanariebi.exeC:\Users\Admin\AppData\Local\Temp\ajanariebi.exe update vbeodazhlo.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vbeodazhlo.exeC:\Users\Admin\AppData\Local\Temp\vbeodazhlo.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\vbeodazhlo.exeC:\Users\Admin\AppData\Local\Temp\vbeodazhlo.exe update krxxhbxnkf.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\krxxhbxnkf.exeC:\Users\Admin\AppData\Local\Temp\krxxhbxnkf.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\krxxhbxnkf.exeC:\Users\Admin\AppData\Local\Temp\krxxhbxnkf.exe update xxscvlnrni.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xxscvlnrni.exeC:\Users\Admin\AppData\Local\Temp\xxscvlnrni.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\xxscvlnrni.exeC:\Users\Admin\AppData\Local\Temp\xxscvlnrni.exe update czljclgxqm.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\czljclgxqm.exeC:\Users\Admin\AppData\Local\Temp\czljclgxqm.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\czljclgxqm.exeC:\Users\Admin\AppData\Local\Temp\czljclgxqm.exe update shhuawpuvd.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\shhuawpuvd.exeC:\Users\Admin\AppData\Local\Temp\shhuawpuvd.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\shhuawpuvd.exeC:\Users\Admin\AppData\Local\Temp\shhuawpuvd.exe update sefuwhkfrr.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sefuwhkfrr.exeC:\Users\Admin\AppData\Local\Temp\sefuwhkfrr.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\sefuwhkfrr.exeC:\Users\Admin\AppData\Local\Temp\sefuwhkfrr.exe update carqdwykql.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\carqdwykql.exeC:\Users\Admin\AppData\Local\Temp\carqdwykql.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\carqdwykql.exeC:\Users\Admin\AppData\Local\Temp\carqdwykql.exe update amxottrpay.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\amxottrpay.exeC:\Users\Admin\AppData\Local\Temp\amxottrpay.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\amxottrpay.exeC:\Users\Admin\AppData\Local\Temp\amxottrpay.exe update xauzdwjxxp.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xauzdwjxxp.exeC:\Users\Admin\AppData\Local\Temp\xauzdwjxxp.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\xauzdwjxxp.exeC:\Users\Admin\AppData\Local\Temp\xauzdwjxxp.exe update syvxxwdwbu.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\syvxxwdwbu.exeC:\Users\Admin\AppData\Local\Temp\syvxxwdwbu.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\syvxxwdwbu.exeC:\Users\Admin\AppData\Local\Temp\syvxxwdwbu.exe update xxdqcrxizl.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xxdqcrxizl.exeC:\Users\Admin\AppData\Local\Temp\xxdqcrxizl.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\xxdqcrxizl.exeC:\Users\Admin\AppData\Local\Temp\xxdqcrxizl.exe update xqpmvymzqn.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xqpmvymzqn.exeC:\Users\Admin\AppData\Local\Temp\xqpmvymzqn.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\xqpmvymzqn.exeC:\Users\Admin\AppData\Local\Temp\xqpmvymzqn.exe update ucwkkuflis.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ucwkkuflis.exeC:\Users\Admin\AppData\Local\Temp\ucwkkuflis.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\ucwkkuflis.exeC:\Users\Admin\AppData\Local\Temp\ucwkkuflis.exe update uvqgejccsu.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exeC:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exeC:\Users\Admin\AppData\Local\Temp\uvqgejccsu.exe update fnehujspdk.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fnehujspdk.exeC:\Users\Admin\AppData\Local\Temp\fnehujspdk.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\fnehujspdk.exeC:\Users\Admin\AppData\Local\Temp\fnehujspdk.exe update pcrnvsqdax.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pcrnvsqdax.exeC:\Users\Admin\AppData\Local\Temp\pcrnvsqdax.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\pcrnvsqdax.exeC:\Users\Admin\AppData\Local\Temp\pcrnvsqdax.exe update rqggbupvaz.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rqggbupvaz.exeC:\Users\Admin\AppData\Local\Temp\rqggbupvaz.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\rqggbupvaz.exeC:\Users\Admin\AppData\Local\Temp\rqggbupvaz.exe update zgfpylbffp.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zgfpylbffp.exeC:\Users\Admin\AppData\Local\Temp\zgfpylbffp.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\zgfpylbffp.exeC:\Users\Admin\AppData\Local\Temp\zgfpylbffp.exe update uueajlgtca.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uueajlgtca.exeC:\Users\Admin\AppData\Local\Temp\uueajlgtca.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\uueajlgtca.exeC:\Users\Admin\AppData\Local\Temp\uueajlgtca.exe update euugtscfjp.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\euugtscfjp.exeC:\Users\Admin\AppData\Local\Temp\euugtscfjp.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\euugtscfjp.exeC:\Users\Admin\AppData\Local\Temp\euugtscfjp.exe update otpeookkun.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\otpeookkun.exeC:\Users\Admin\AppData\Local\Temp\otpeookkun.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\otpeookkun.exeC:\Users\Admin\AppData\Local\Temp\otpeookkun.exe update blxibkkaha.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\blxibkkaha.exeC:\Users\Admin\AppData\Local\Temp\blxibkkaha.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\blxibkkaha.exeC:\Users\Admin\AppData\Local\Temp\blxibkkaha.exe update orchmddvzz.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\orchmddvzz.exeC:\Users\Admin\AppData\Local\Temp\orchmddvzz.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\orchmddvzz.exeC:\Users\Admin\AppData\Local\Temp\orchmddvzz.exe update bmcyikgazj.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bmcyikgazj.exeC:\Users\Admin\AppData\Local\Temp\bmcyikgazj.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\bmcyikgazj.exeC:\Users\Admin\AppData\Local\Temp\bmcyikgazj.exe update dpoofvihsi.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dpoofvihsi.exeC:\Users\Admin\AppData\Local\Temp\dpoofvihsi.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\dpoofvihsi.exeC:\Users\Admin\AppData\Local\Temp\dpoofvihsi.exe update wievjpolej.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wievjpolej.exeC:\Users\Admin\AppData\Local\Temp\wievjpolej.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\wievjpolej.exeC:\Users\Admin\AppData\Local\Temp\wievjpolej.exe update oxzgkmnmme.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oxzgkmnmme.exeC:\Users\Admin\AppData\Local\Temp\oxzgkmnmme.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\oxzgkmnmme.exeC:\Users\Admin\AppData\Local\Temp\oxzgkmnmme.exe update lkdvstxrmd.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lkdvstxrmd.exeC:\Users\Admin\AppData\Local\Temp\lkdvstxrmd.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\lkdvstxrmd.exeC:\Users\Admin\AppData\Local\Temp\lkdvstxrmd.exe update qbwwevbbzy.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qbwwevbbzy.exeC:\Users\Admin\AppData\Local\Temp\qbwwevbbzy.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\qbwwevbbzy.exeC:\Users\Admin\AppData\Local\Temp\qbwwevbbzy.exe update afivquhvth.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\afivquhvth.exeC:\Users\Admin\AppData\Local\Temp\afivquhvth.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\afivquhvth.exeC:\Users\Admin\AppData\Local\Temp\afivquhvth.exe update icgoqtktmd.exe58⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
ahoqijnlya.exe
bbbcakripy.exe
colgfsnvyq.exe
dhlyzgamdm.exe
dvjggaarff.exe
epbkmiwvwx.exe
eqbnhexeij.exe
gltdttzgcu.exe
kvkzuvfzvq.exe
mlqzxhpgzl.exe
nyxtncphsc.exe
obgapmxefw.exe
onwcfepclm.exe
qnbabahzyc.exe
rmxnzkshrz.exe
rvtqqjinkw.exe
tisegjgmge.exe
update.exe
update.exe
vcejsjvbkx.exe
vfliygtcax.exe
wemrctlyxr.exe
xgxkpsapae.exe
memory/252-399-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/372-160-0x0000025213D80000-0x0000025213E80000-memory.dmp
memory/372-145-0x00000252001E0000-0x00000252002E0000-memory.dmp
memory/372-159-0x0000025203920000-0x0000025203940000-memory.dmp
memory/372-190-0x0000025214100000-0x0000025214120000-memory.dmp
memory/372-175-0x0000025203D00000-0x0000025203D20000-memory.dmp
memory/700-139-0x000001B074820000-0x000001B074C54000-memory.dmp
memory/1056-0-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1056-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1132-97-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1132-96-0x0000000001000000-0x0000000001001000-memory.dmp
memory/1224-100-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1276-342-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1368-15-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1368-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1376-360-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1668-92-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1708-339-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1752-106-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1848-295-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1932-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2128-84-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2180-334-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2392-388-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2492-391-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2500-76-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2500-75-0x0000000001130000-0x0000000001131000-memory.dmp
memory/2512-60-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2568-352-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2620-41-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2632-136-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2672-73-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2836-65-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2840-363-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3260-331-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3564-2-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3564-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3864-31-0x0000000001040000-0x0000000001041000-memory.dmp
memory/3864-32-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3972-44-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4000-109-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4000-110-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4000-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4268-408-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4312-324-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4380-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4400-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4504-48-0x0000000001080000-0x0000000001081000-memory.dmp
memory/4504-49-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4528-51-0x0000000001030000-0x0000000001031000-memory.dmp
memory/4528-52-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4536-56-0x0000000001120000-0x0000000001121000-memory.dmp
memory/4536-57-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4552-133-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4828-68-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4848-81-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4848-80-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/5692-406-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5732-397-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6028-349-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6036-89-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6128-35-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6132-7-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/6132-8-0x0000000000400000-0x0000000000E90000-memory.dmp