57669ed7a2ec1c78a12e2ef1ca352e51527204217aa3a87fed64e7dc8e76a48a

Analysis

max time kernel
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Size 10.4MB
Sample260705-tpazxady4w
SHA256 57669ed7a2ec1c78a12e2ef1ca352e51527204217aa3a87fed64e7dc8e76a48a
MD5 440620298e9221ac961ed22f0162d82e
SHA1 143a98a07cbf792d2fd055ec412698406dae9ae5
SHA512 958fd857f9e21ba0535180c460d780db384b8ce3fca405b97265c0541bf9c1890d83f33943f837342b558c59c040bded303a82f73d020c48256683f3e1bdd943
SSDEEP 196608:XZGmuGsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnGsREJLODBWlX3d+NpvdHIom
TLSH
T1C3B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5408	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
2984	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
5404	dxtxtapdml.exe
6896	dxtxtapdml.exe
3584	trcanpcmqn.exe
5364	trcanpcmqn.exe
6380	jdtwusylib.exe
2440	jdtwusylib.exe
3876	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
6796	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
7036	ynlewhmwil.exe
1496	ynlewhmwil.exe
5320	ygvhbqvrud.exe
1600	ygvhbqvrud.exe
2972	ijovonotkf.exe
5616	ijovonotkf.exe
5168	ickonwskcr.exe
1560	ickonwskcr.exe
7152	vxcmjcpmvf.exe
2116	vxcmjcpmvf.exe
5684	azedtokqmu.exe
2388	azedtokqmu.exe
1708	alpzskluey.exe
6836	alpzskluey.exe
1204	pmyfkcqasq.exe
5716	pmyfkcqasq.exe
988	axzgihhtdq.exe
5740	axzgihhtdq.exe
6460	dilnlezjqe.exe
5128	dilnlezjqe.exe
1140	sqeixsjhaj.exe
4352	sqeixsjhaj.exe
4436	hcnwdcghsw.exe
6724	hcnwdcghsw.exe
6700	xpxssedgks.exe
1892	xpxssedgks.exe
1476	nutobyujlf.exe
6632	nutobyujlf.exe
7140	uvbpskyjxi.exe
6804	uvbpskyjxi.exe
5108	uhwjfsgwyd.exe
4164	uhwjfsgwyd.exe
4656	ewkusijkpo.exe
1628	ewkusijkpo.exe
2948	kjpswmzjpe.exe
4812	kjpswmzjpe.exe
3204	mmbezwdygf.exe
2488	mmbezwdygf.exe
3856	ugkhtmqhsh.exe
2336	ugkhtmqhsh.exe
3268	mukngdxnwe.exe
5780	mukngdxnwe.exe
4816	mjtwxnocbl.exe
924	mjtwxnocbl.exe
2220	jsohkfamym.exe
5076	jsohkfamym.exe
1172	gukxflzvpr.exe
2880	gukxflzvpr.exe
3684	yqjlywwlnv.exe
1916	yqjlywwlnv.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3784	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5408	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
2984	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
5404	dxtxtapdml.exe
6896	dxtxtapdml.exe
3584	trcanpcmqn.exe
5364	trcanpcmqn.exe
6380	jdtwusylib.exe
2440	jdtwusylib.exe
3876	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
6796	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
7036	ynlewhmwil.exe
1496	ynlewhmwil.exe
5320	ygvhbqvrud.exe
1600	ygvhbqvrud.exe
2972	ijovonotkf.exe
5616	ijovonotkf.exe
5168	ickonwskcr.exe
1560	ickonwskcr.exe
7152	vxcmjcpmvf.exe
2116	vxcmjcpmvf.exe
5684	azedtokqmu.exe
2388	azedtokqmu.exe
1708	alpzskluey.exe
6836	alpzskluey.exe
1204	pmyfkcqasq.exe
5716	pmyfkcqasq.exe
988	axzgihhtdq.exe
5740	axzgihhtdq.exe
6460	dilnlezjqe.exe
5128	dilnlezjqe.exe
1140	sqeixsjhaj.exe
4352	sqeixsjhaj.exe
4436	hcnwdcghsw.exe
6724	hcnwdcghsw.exe
6700	xpxssedgks.exe
1892	xpxssedgks.exe
1476	nutobyujlf.exe
6632	nutobyujlf.exe
7140	uvbpskyjxi.exe
6804	uvbpskyjxi.exe
5108	uhwjfsgwyd.exe
4164	uhwjfsgwyd.exe
4656	ewkusijkpo.exe
1628	ewkusijkpo.exe
2948	kjpswmzjpe.exe
4812	kjpswmzjpe.exe
3204	mmbezwdygf.exe
2488	mmbezwdygf.exe
3856	ugkhtmqhsh.exe
2336	ugkhtmqhsh.exe
3268	mukngdxnwe.exe
5780	mukngdxnwe.exe
4816	mjtwxnocbl.exe
924	mjtwxnocbl.exe
2220	jsohkfamym.exe
5076	jsohkfamym.exe
1172	gukxflzvpr.exe
2880	gukxflzvpr.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsohkfamym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ievcdqnkbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vleddtitre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vleddtitre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cjhxvubwpz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygvhbqvrud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbgcaydwty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqjlywwlnv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbgcaydwty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azedtokqmu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjtwxnocbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsohkfamym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jomswctwln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akglbofkie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzdjovexiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvxxbelmuq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zkaahxlbor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xpxssedgks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	itowubacag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcnfgzyafp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzdjovexiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noqdpldzij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ozztqcpjxk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wycpeyqvzi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wzxqjnsdli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dilnlezjqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gukxflzvpr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmbezwdygf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npnulnyare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewkusijkpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmbezwdygf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhwjfsgwyd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yrpmuptzhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdtwusylib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqeixsjhaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjtwxnocbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zslgeuifbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpzskluey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmyfkcqasq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kjpswmzjpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izvgotfhwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adwhbfiopr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgflktyuwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxcmjcpmvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bnrjuwedbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drqmhmxljp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lphigofaot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cjhxvubwpz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zslgeuifbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ynlewhmwil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nutobyujlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqjlywwlnv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nyxyrghgoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxsemgkovu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ickonwskcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmyfkcqasq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izvgotfhwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxcmjcpmvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gukxflzvpr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nyxyrghgoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	itowubacag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxtxtapdml.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3784	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3784	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5408	ozztqcpjxk.exe
5408	ozztqcpjxk.exe
5408	ozztqcpjxk.exe
5408	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2984	yrpmuptzhk.exe
2984	yrpmuptzhk.exe
2984	yrpmuptzhk.exe
2984	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
5408	ozztqcpjxk.exe
5408	ozztqcpjxk.exe
5404	dxtxtapdml.exe
5404	dxtxtapdml.exe
5404	dxtxtapdml.exe
5404	dxtxtapdml.exe
6896	dxtxtapdml.exe
6896	dxtxtapdml.exe
2984	yrpmuptzhk.exe
2984	yrpmuptzhk.exe
3584	trcanpcmqn.exe
3584	trcanpcmqn.exe
3584	trcanpcmqn.exe
3584	trcanpcmqn.exe
5364	trcanpcmqn.exe
5364	trcanpcmqn.exe
5404	dxtxtapdml.exe
5404	dxtxtapdml.exe
6380	jdtwusylib.exe
6380	jdtwusylib.exe
6380	jdtwusylib.exe
6380	jdtwusylib.exe
2440	jdtwusylib.exe
2440	jdtwusylib.exe
3584	trcanpcmqn.exe
3584	trcanpcmqn.exe
3876	wycpeyqvzi.exe
3876	wycpeyqvzi.exe
3876	wycpeyqvzi.exe
3876	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
6380	jdtwusylib.exe
6380	jdtwusylib.exe
6796	wzxqjnsdli.exe
6796	wzxqjnsdli.exe
6796	wzxqjnsdli.exe
6796	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
3876	wycpeyqvzi.exe
3876	wycpeyqvzi.exe
7036	ynlewhmwil.exe
7036	ynlewhmwil.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3784	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3784	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5408	ozztqcpjxk.exe
5408	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
6056	ozztqcpjxk.exe
2984	yrpmuptzhk.exe
2984	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
1256	yrpmuptzhk.exe
5404	dxtxtapdml.exe
5404	dxtxtapdml.exe
6896	dxtxtapdml.exe
6896	dxtxtapdml.exe
3584	trcanpcmqn.exe
3584	trcanpcmqn.exe
5364	trcanpcmqn.exe
5364	trcanpcmqn.exe
6380	jdtwusylib.exe
6380	jdtwusylib.exe
2440	jdtwusylib.exe
2440	jdtwusylib.exe
3876	wycpeyqvzi.exe
3876	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
4556	wycpeyqvzi.exe
6796	wzxqjnsdli.exe
6796	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
2736	wzxqjnsdli.exe
7036	ynlewhmwil.exe
7036	ynlewhmwil.exe
1496	ynlewhmwil.exe
1496	ynlewhmwil.exe
5320	ygvhbqvrud.exe
5320	ygvhbqvrud.exe
1600	ygvhbqvrud.exe
1600	ygvhbqvrud.exe
2972	ijovonotkf.exe
2972	ijovonotkf.exe
5616	ijovonotkf.exe
5616	ijovonotkf.exe
5168	ickonwskcr.exe
5168	ickonwskcr.exe
1560	ickonwskcr.exe
1560	ickonwskcr.exe
7152	vxcmjcpmvf.exe
7152	vxcmjcpmvf.exe
2116	vxcmjcpmvf.exe
2116	vxcmjcpmvf.exe
5684	azedtokqmu.exe
5684	azedtokqmu.exe
2388	azedtokqmu.exe
2388	azedtokqmu.exe
1708	alpzskluey.exe
1708	alpzskluey.exe
6836	alpzskluey.exe
6836	alpzskluey.exe
1204	pmyfkcqasq.exe
1204	pmyfkcqasq.exe
5716	pmyfkcqasq.exe
5716	pmyfkcqasq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6580 wrote to memory of 3784	6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	89
PID 6580 wrote to memory of 5408	6580	2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	90
PID 5408 wrote to memory of 6056	5408	ozztqcpjxk.exe	91
PID 5408 wrote to memory of 2984	5408	ozztqcpjxk.exe	92
PID 2984 wrote to memory of 1256	2984	yrpmuptzhk.exe	93
PID 2984 wrote to memory of 5404	2984	yrpmuptzhk.exe	94
PID 5404 wrote to memory of 6896	5404	dxtxtapdml.exe	95
PID 5404 wrote to memory of 3584	5404	dxtxtapdml.exe	96
PID 3584 wrote to memory of 5364	3584	trcanpcmqn.exe	97
PID 3584 wrote to memory of 6380	3584	trcanpcmqn.exe	98
PID 6380 wrote to memory of 2440	6380	jdtwusylib.exe	99
PID 6380 wrote to memory of 3876	6380	jdtwusylib.exe	100
PID 3876 wrote to memory of 4556	3876	wycpeyqvzi.exe	101
PID 3876 wrote to memory of 6796	3876	wycpeyqvzi.exe	102
PID 6796 wrote to memory of 2736	6796	wzxqjnsdli.exe	103
PID 6796 wrote to memory of 7036	6796	wzxqjnsdli.exe	104
PID 7036 wrote to memory of 1496	7036	ynlewhmwil.exe	105
PID 7036 wrote to memory of 5320	7036	ynlewhmwil.exe	106
PID 5320 wrote to memory of 1600	5320	ygvhbqvrud.exe	107
PID 5320 wrote to memory of 2972	5320	ygvhbqvrud.exe	108
PID 2972 wrote to memory of 5616	2972	ijovonotkf.exe	109
PID 2972 wrote to memory of 5168	2972	ijovonotkf.exe	110
PID 5168 wrote to memory of 1560	5168	ickonwskcr.exe	111
PID 5168 wrote to memory of 7152	5168	ickonwskcr.exe	112
PID 7152 wrote to memory of 2116	7152	vxcmjcpmvf.exe	113
PID 7152 wrote to memory of 5684	7152	vxcmjcpmvf.exe	114
PID 5684 wrote to memory of 2388	5684	azedtokqmu.exe	115
PID 5684 wrote to memory of 1708	5684	azedtokqmu.exe	116
PID 1708 wrote to memory of 6836	1708	alpzskluey.exe	117
PID 1708 wrote to memory of 1204	1708	alpzskluey.exe	118
PID 1204 wrote to memory of 5716	1204	pmyfkcqasq.exe	119
PID 1204 wrote to memory of 988	1204	pmyfkcqasq.exe	120
PID 988 wrote to memory of 5740	988	axzgihhtdq.exe	121
PID 988 wrote to memory of 6460	988	axzgihhtdq.exe	122
PID 6460 wrote to memory of 5128	6460	dilnlezjqe.exe	123
PID 6460 wrote to memory of 1140	6460	dilnlezjqe.exe	124
PID 1140 wrote to memory of 4352	1140	sqeixsjhaj.exe	125
PID 1140 wrote to memory of 4436	1140	sqeixsjhaj.exe	126
PID 4436 wrote to memory of 6724	4436	hcnwdcghsw.exe	127
PID 4436 wrote to memory of 6700	4436	hcnwdcghsw.exe	128
PID 6700 wrote to memory of 1892	6700	xpxssedgks.exe	129
PID 6700 wrote to memory of 1476	6700	xpxssedgks.exe	130
PID 1476 wrote to memory of 6632	1476	nutobyujlf.exe	131
PID 1476 wrote to memory of 7140	1476	nutobyujlf.exe	132
PID 7140 wrote to memory of 6804	7140	uvbpskyjxi.exe	133
PID 7140 wrote to memory of 5108	7140	uvbpskyjxi.exe	134
PID 5108 wrote to memory of 4164	5108	uhwjfsgwyd.exe	135
PID 5108 wrote to memory of 4656	5108	uhwjfsgwyd.exe	136
PID 4656 wrote to memory of 1628	4656	ewkusijkpo.exe	137
PID 4656 wrote to memory of 2948	4656	ewkusijkpo.exe	138
PID 2948 wrote to memory of 4812	2948	kjpswmzjpe.exe	139
PID 2948 wrote to memory of 3204	2948	kjpswmzjpe.exe	140
PID 3204 wrote to memory of 2488	3204	mmbezwdygf.exe	141
PID 3204 wrote to memory of 3856	3204	mmbezwdygf.exe	142
PID 3856 wrote to memory of 2336	3856	ugkhtmqhsh.exe	143
PID 3856 wrote to memory of 3268	3856	ugkhtmqhsh.exe	144
PID 3268 wrote to memory of 5780	3268	mukngdxnwe.exe	145
PID 3268 wrote to memory of 4816	3268	mukngdxnwe.exe	146
PID 4816 wrote to memory of 924	4816	mjtwxnocbl.exe	147
PID 4816 wrote to memory of 2220	4816	mjtwxnocbl.exe	148
PID 2220 wrote to memory of 5076	2220	jsohkfamym.exe	149
PID 2220 wrote to memory of 1172	2220	jsohkfamym.exe	150
PID 1172 wrote to memory of 2880	1172	gukxflzvpr.exe	151
PID 1172 wrote to memory of 3684	1172	gukxflzvpr.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6580
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-05_440620298e9221ac961ed22f0162d82e_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update ozztqcpjxk.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\ozztqcpjxk.exe
  C:\Users\Admin\AppData\Local\Temp\ozztqcpjxk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Users\Admin\AppData\Local\Temp\ozztqcpjxk.exe
    C:\Users\Admin\AppData\Local\Temp\ozztqcpjxk.exe update yrpmuptzhk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6056
- - C:\Users\Admin\AppData\Local\Temp\yrpmuptzhk.exe
    C:\Users\Admin\AppData\Local\Temp\yrpmuptzhk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\yrpmuptzhk.exe
      C:\Users\Admin\AppData\Local\Temp\yrpmuptzhk.exe update dxtxtapdml.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\dxtxtapdml.exe
      C:\Users\Admin\AppData\Local\Temp\dxtxtapdml.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\dxtxtapdml.exe
        
        C:\Users\Admin\AppData\Local\Temp\dxtxtapdml.exe update trcanpcmqn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\trcanpcmqn.exe
        
        C:\Users\Admin\AppData\Local\Temp\trcanpcmqn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\trcanpcmqn.exe
        
        C:\Users\Admin\AppData\Local\Temp\trcanpcmqn.exe update jdtwusylib.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\jdtwusylib.exe
        
        C:\Users\Admin\AppData\Local\Temp\jdtwusylib.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\jdtwusylib.exe
        
        C:\Users\Admin\AppData\Local\Temp\jdtwusylib.exe update wycpeyqvzi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\wycpeyqvzi.exe
        
        C:\Users\Admin\AppData\Local\Temp\wycpeyqvzi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\wycpeyqvzi.exe
        
        C:\Users\Admin\AppData\Local\Temp\wycpeyqvzi.exe update wzxqjnsdli.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\wzxqjnsdli.exe
        
        C:\Users\Admin\AppData\Local\Temp\wzxqjnsdli.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\wzxqjnsdli.exe
        
        C:\Users\Admin\AppData\Local\Temp\wzxqjnsdli.exe update ynlewhmwil.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\ynlewhmwil.exe
        
        C:\Users\Admin\AppData\Local\Temp\ynlewhmwil.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\ynlewhmwil.exe
        
        C:\Users\Admin\AppData\Local\Temp\ynlewhmwil.exe update ygvhbqvrud.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\ygvhbqvrud.exe
        
        C:\Users\Admin\AppData\Local\Temp\ygvhbqvrud.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\ygvhbqvrud.exe
        
        C:\Users\Admin\AppData\Local\Temp\ygvhbqvrud.exe update ijovonotkf.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\ijovonotkf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ijovonotkf.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\ijovonotkf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ijovonotkf.exe update ickonwskcr.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\ickonwskcr.exe
        
        C:\Users\Admin\AppData\Local\Temp\ickonwskcr.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\ickonwskcr.exe
        
        C:\Users\Admin\AppData\Local\Temp\ickonwskcr.exe update vxcmjcpmvf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\vxcmjcpmvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\vxcmjcpmvf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\vxcmjcpmvf.exe
        
        C:\Users\Admin\AppData\Local\Temp\vxcmjcpmvf.exe update azedtokqmu.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\azedtokqmu.exe
        
        C:\Users\Admin\AppData\Local\Temp\azedtokqmu.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\azedtokqmu.exe
        
        C:\Users\Admin\AppData\Local\Temp\azedtokqmu.exe update alpzskluey.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\alpzskluey.exe
        
        C:\Users\Admin\AppData\Local\Temp\alpzskluey.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\alpzskluey.exe
        
        C:\Users\Admin\AppData\Local\Temp\alpzskluey.exe update pmyfkcqasq.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\pmyfkcqasq.exe
        
        C:\Users\Admin\AppData\Local\Temp\pmyfkcqasq.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\pmyfkcqasq.exe
        
        C:\Users\Admin\AppData\Local\Temp\pmyfkcqasq.exe update axzgihhtdq.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\axzgihhtdq.exe
        
        C:\Users\Admin\AppData\Local\Temp\axzgihhtdq.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\axzgihhtdq.exe
        
        C:\Users\Admin\AppData\Local\Temp\axzgihhtdq.exe update dilnlezjqe.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\dilnlezjqe.exe
        
        C:\Users\Admin\AppData\Local\Temp\dilnlezjqe.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\dilnlezjqe.exe
        
        C:\Users\Admin\AppData\Local\Temp\dilnlezjqe.exe update sqeixsjhaj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\sqeixsjhaj.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqeixsjhaj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\sqeixsjhaj.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqeixsjhaj.exe update hcnwdcghsw.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\hcnwdcghsw.exe
        
        C:\Users\Admin\AppData\Local\Temp\hcnwdcghsw.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\hcnwdcghsw.exe
        
        C:\Users\Admin\AppData\Local\Temp\hcnwdcghsw.exe update xpxssedgks.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\xpxssedgks.exe
        
        C:\Users\Admin\AppData\Local\Temp\xpxssedgks.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\xpxssedgks.exe
        
        C:\Users\Admin\AppData\Local\Temp\xpxssedgks.exe update nutobyujlf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\nutobyujlf.exe
        
        C:\Users\Admin\AppData\Local\Temp\nutobyujlf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\nutobyujlf.exe
        
        C:\Users\Admin\AppData\Local\Temp\nutobyujlf.exe update uvbpskyjxi.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\uvbpskyjxi.exe
        
        C:\Users\Admin\AppData\Local\Temp\uvbpskyjxi.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\uvbpskyjxi.exe
        
        C:\Users\Admin\AppData\Local\Temp\uvbpskyjxi.exe update uhwjfsgwyd.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\uhwjfsgwyd.exe
        
        C:\Users\Admin\AppData\Local\Temp\uhwjfsgwyd.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\uhwjfsgwyd.exe
        
        C:\Users\Admin\AppData\Local\Temp\uhwjfsgwyd.exe update ewkusijkpo.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\ewkusijkpo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ewkusijkpo.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\ewkusijkpo.exe
        
        C:\Users\Admin\AppData\Local\Temp\ewkusijkpo.exe update kjpswmzjpe.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\kjpswmzjpe.exe
        
        C:\Users\Admin\AppData\Local\Temp\kjpswmzjpe.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\kjpswmzjpe.exe
        
        C:\Users\Admin\AppData\Local\Temp\kjpswmzjpe.exe update mmbezwdygf.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\mmbezwdygf.exe
        
        C:\Users\Admin\AppData\Local\Temp\mmbezwdygf.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\mmbezwdygf.exe
        
        C:\Users\Admin\AppData\Local\Temp\mmbezwdygf.exe update ugkhtmqhsh.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\ugkhtmqhsh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ugkhtmqhsh.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\ugkhtmqhsh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ugkhtmqhsh.exe update mukngdxnwe.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\mukngdxnwe.exe
        
        C:\Users\Admin\AppData\Local\Temp\mukngdxnwe.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\mukngdxnwe.exe
        
        C:\Users\Admin\AppData\Local\Temp\mukngdxnwe.exe update mjtwxnocbl.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\mjtwxnocbl.exe
        
        C:\Users\Admin\AppData\Local\Temp\mjtwxnocbl.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\mjtwxnocbl.exe
        
        C:\Users\Admin\AppData\Local\Temp\mjtwxnocbl.exe update jsohkfamym.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\jsohkfamym.exe
        
        C:\Users\Admin\AppData\Local\Temp\jsohkfamym.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\jsohkfamym.exe
        
        C:\Users\Admin\AppData\Local\Temp\jsohkfamym.exe update gukxflzvpr.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\gukxflzvpr.exe
        
        C:\Users\Admin\AppData\Local\Temp\gukxflzvpr.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\gukxflzvpr.exe
        
        C:\Users\Admin\AppData\Local\Temp\gukxflzvpr.exe update yqjlywwlnv.exe
        33⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\yqjlywwlnv.exe
        
        C:\Users\Admin\AppData\Local\Temp\yqjlywwlnv.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\yqjlywwlnv.exe
        
        C:\Users\Admin\AppData\Local\Temp\yqjlywwlnv.exe update gndcvqqwmk.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\gndcvqqwmk.exe
        
        C:\Users\Admin\AppData\Local\Temp\gndcvqqwmk.exe
        34⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\gndcvqqwmk.exe
        
        C:\Users\Admin\AppData\Local\Temp\gndcvqqwmk.exe update tqvarxfxxy.exe
        35⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\tqvarxfxxy.exe
        
        C:\Users\Admin\AppData\Local\Temp\tqvarxfxxy.exe
        35⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\tqvarxfxxy.exe
        
        C:\Users\Admin\AppData\Local\Temp\tqvarxfxxy.exe update bnrjuwedbw.exe
        36⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\bnrjuwedbw.exe
        
        C:\Users\Admin\AppData\Local\Temp\bnrjuwedbw.exe
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\bnrjuwedbw.exe
        
        C:\Users\Admin\AppData\Local\Temp\bnrjuwedbw.exe update dbgcaydwty.exe
        37⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\dbgcaydwty.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbgcaydwty.exe
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\dbgcaydwty.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbgcaydwty.exe update jomswctwln.exe
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\jomswctwln.exe
        
        C:\Users\Admin\AppData\Local\Temp\jomswctwln.exe
        38⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\jomswctwln.exe
        
        C:\Users\Admin\AppData\Local\Temp\jomswctwln.exe update drqmhmxljp.exe
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\drqmhmxljp.exe
        
        C:\Users\Admin\AppData\Local\Temp\drqmhmxljp.exe
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\drqmhmxljp.exe
        
        C:\Users\Admin\AppData\Local\Temp\drqmhmxljp.exe update ievcdqnkbe.exe
        40⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\ievcdqnkbe.exe
        
        C:\Users\Admin\AppData\Local\Temp\ievcdqnkbe.exe
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\ievcdqnkbe.exe
        
        C:\Users\Admin\AppData\Local\Temp\ievcdqnkbe.exe update lphigofaot.exe
        41⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\lphigofaot.exe
        
        C:\Users\Admin\AppData\Local\Temp\lphigofaot.exe
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\lphigofaot.exe
        
        C:\Users\Admin\AppData\Local\Temp\lphigofaot.exe update gznhojduzq.exe
        42⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\gznhojduzq.exe
        
        C:\Users\Admin\AppData\Local\Temp\gznhojduzq.exe
        42⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\gznhojduzq.exe
        
        C:\Users\Admin\AppData\Local\Temp\gznhojduzq.exe update vleddtitre.exe
        43⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\vleddtitre.exe
        
        C:\Users\Admin\AppData\Local\Temp\vleddtitre.exe
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\vleddtitre.exe
        
        C:\Users\Admin\AppData\Local\Temp\vleddtitre.exe update izvgotfhwp.exe
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\izvgotfhwp.exe
        
        C:\Users\Admin\AppData\Local\Temp\izvgotfhwp.exe
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\izvgotfhwp.exe
        
        C:\Users\Admin\AppData\Local\Temp\izvgotfhwp.exe update adwhbfiopr.exe
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\adwhbfiopr.exe
        
        C:\Users\Admin\AppData\Local\Temp\adwhbfiopr.exe
        45⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\adwhbfiopr.exe
        
        C:\Users\Admin\AppData\Local\Temp\adwhbfiopr.exe update nyxyrghgoq.exe
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\nyxyrghgoq.exe
        
        C:\Users\Admin\AppData\Local\Temp\nyxyrghgoq.exe
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\nyxyrghgoq.exe
        
        C:\Users\Admin\AppData\Local\Temp\nyxyrghgoq.exe update itowubacag.exe
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\itowubacag.exe
        
        C:\Users\Admin\AppData\Local\Temp\itowubacag.exe
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\itowubacag.exe
        
        C:\Users\Admin\AppData\Local\Temp\itowubacag.exe update qcnfgzyafp.exe
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\qcnfgzyafp.exe
        
        C:\Users\Admin\AppData\Local\Temp\qcnfgzyafp.exe
        48⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\qcnfgzyafp.exe
        
        C:\Users\Admin\AppData\Local\Temp\qcnfgzyafp.exe update aumevmaisf.exe
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\aumevmaisf.exe
        
        C:\Users\Admin\AppData\Local\Temp\aumevmaisf.exe
        49⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\aumevmaisf.exe
        
        C:\Users\Admin\AppData\Local\Temp\aumevmaisf.exe update npnulnyare.exe
        50⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\npnulnyare.exe
        
        C:\Users\Admin\AppData\Local\Temp\npnulnyare.exe
        50⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\npnulnyare.exe
        
        C:\Users\Admin\AppData\Local\Temp\npnulnyare.exe update akglbofkie.exe
        51⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\akglbofkie.exe
        
        C:\Users\Admin\AppData\Local\Temp\akglbofkie.exe
        51⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\akglbofkie.exe
        
        C:\Users\Admin\AppData\Local\Temp\akglbofkie.exe update cjhxvubwpz.exe
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\cjhxvubwpz.exe
        
        C:\Users\Admin\AppData\Local\Temp\cjhxvubwpz.exe
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\cjhxvubwpz.exe
        
        C:\Users\Admin\AppData\Local\Temp\cjhxvubwpz.exe update cgflktyuwo.exe
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\cgflktyuwo.exe
        
        C:\Users\Admin\AppData\Local\Temp\cgflktyuwo.exe
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\cgflktyuwo.exe
        
        C:\Users\Admin\AppData\Local\Temp\cgflktyuwo.exe update uzdjovexiw.exe
        54⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\uzdjovexiw.exe
        
        C:\Users\Admin\AppData\Local\Temp\uzdjovexiw.exe
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\uzdjovexiw.exe
        
        C:\Users\Admin\AppData\Local\Temp\uzdjovexiw.exe update noqdpldzij.exe
        55⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\noqdpldzij.exe
        
        C:\Users\Admin\AppData\Local\Temp\noqdpldzij.exe
        55⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\noqdpldzij.exe
        
        C:\Users\Admin\AppData\Local\Temp\noqdpldzij.exe update kxsemgkovu.exe
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\kxsemgkovu.exe
        
        C:\Users\Admin\AppData\Local\Temp\kxsemgkovu.exe
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\kxsemgkovu.exe
        
        C:\Users\Admin\AppData\Local\Temp\kxsemgkovu.exe update zkaahxlbor.exe
        57⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\zkaahxlbor.exe
        
        C:\Users\Admin\AppData\Local\Temp\zkaahxlbor.exe
        57⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\zkaahxlbor.exe
        
        C:\Users\Admin\AppData\Local\Temp\zkaahxlbor.exe update zslgeuifbq.exe
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\zslgeuifbq.exe
        
        C:\Users\Admin\AppData\Local\Temp\zslgeuifbq.exe
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\zslgeuifbq.exe
        
        C:\Users\Admin\AppData\Local\Temp\zslgeuifbq.exe update cvxxbelmuq.exe
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\cvxxbelmuq.exe
        
        C:\Users\Admin\AppData\Local\Temp\cvxxbelmuq.exe
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\cvxxbelmuq.exe
        
        C:\Users\Admin\AppData\Local\Temp\cvxxbelmuq.exe update tzhihcxktl.exe
        60⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\tzhihcxktl.exe
        
        C:\Users\Admin\AppData\Local\Temp\tzhihcxktl.exe
        60⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\tzhihcxktl.exe
        
        C:\Users\Admin\AppData\Local\Temp\tzhihcxktl.exe update mvgkacwmnx.exe
        61⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\mvgkacwmnx.exe
        
        C:\Users\Admin\AppData\Local\Temp\mvgkacwmnx.exe
        61⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\mvgkacwmnx.exe
        
        C:\Users\Admin\AppData\Local\Temp\mvgkacwmnx.exe update ovivvjsrtj.exe
        62⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\ovivvjsrtj.exe
        
        C:\Users\Admin\AppData\Local\Temp\ovivvjsrtj.exe
        62⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\ovivvjsrtj.exe
        
        C:\Users\Admin\AppData\Local\Temp\ovivvjsrtj.exe update whbbprcmrh.exe
        63⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\whbbprcmrh.exe
        
        C:\Users\Admin\AppData\Local\Temp\whbbprcmrh.exe
        63⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\whbbprcmrh.exe
        
        C:\Users\Admin\AppData\Local\Temp\whbbprcmrh.exe update tmkykidgse.exe
        64⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\tmkykidgse.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmkykidgse.exe
        64⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\tmkykidgse.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmkykidgse.exe update idezpddwfh.exe
        65⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\idezpddwfh.exe
        
        C:\Users\Admin\AppData\Local\Temp\idezpddwfh.exe
        65⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\idezpddwfh.exe
        
        C:\Users\Admin\AppData\Local\Temp\idezpddwfh.exe update ikpflaiskf.exe
        66⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\ikpflaiskf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ikpflaiskf.exe
        66⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\ikpflaiskf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ikpflaiskf.exe update gyfbhrjndd.exe
        67⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\gyfbhrjndd.exe
        
        C:\Users\Admin\AppData\Local\Temp\gyfbhrjndd.exe
        67⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\gyfbhrjndd.exe
        
        C:\Users\Admin\AppData\Local\Temp\gyfbhrjndd.exe update sbgaujbphb.exe
        68⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\sbgaujbphb.exe
        
        C:\Users\Admin\AppData\Local\Temp\sbgaujbphb.exe
        68⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\sbgaujbphb.exe
        
        C:\Users\Admin\AppData\Local\Temp\sbgaujbphb.exe update nhkrtizyic.exe
        69⤵
        
        PID:6520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alpzskluey.exe

Path C:\Users\Admin\AppData\Local\Temp\alpzskluey.exe
Size 10.4MB
SHA256 0fa0809131b3119ca19860b8ca045cf63ef822e3955583cad57462c7ad6cf759
MD5 def55a52470edaa76aa1559ed779954f
SHA1 f7ff145ab72bdcd5a2b3c0d48531896a80b40c2b
SHA512 9fd550be6975fced60297e30c0f9c21ff453c52d9b574d139234f7462f38d95cf6400a5369784c68b871716d0bea7f23916ba74a8a1fb7414cedfb3301d4eae0
SSDEEP 196608:XZGmuXsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnXsREJLODBWlX3d+NpvdHIom
TLSH
T187B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axzgihhtdq.exe

Path C:\Users\Admin\AppData\Local\Temp\axzgihhtdq.exe
Size 10.4MB
SHA256 6b135980067d36221c7c77189d18c352f4b038f1c58eb2aceed7ef049813056b
MD5 e7b758e5d8ccae19a93a677828f9417b
SHA1 9355f19833cb16992a30b22b1748af55c0ab8f34
SHA512 7b59601f5537122b1370739abe71e104d0e0ff5eb55ba221f03c2ef5e6ec640f5b95cf3f9f2a8fcdf4c6b5176b03bc705a14a3b47a27a291ac85acfa858a331c
SSDEEP 196608:XZGmu3sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn3sREJLODBWlX3d+NpvdHIom
TLSH
T187B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

azedtokqmu.exe

Path C:\Users\Admin\AppData\Local\Temp\azedtokqmu.exe
Size 10.4MB
SHA256 fc6d1a24b70e492f6d00cd06a8f518d03ac6e0021347770119fffbbf994b6a2d
MD5 15f239e14d6ba10c9e11e63c0ba381d7
SHA1 b7936cf0323bfd044270cd395eb67d610dfef92b
SHA512 4e1f47c9c90fba8ae4dd018f378ec070c051f6b63d4eb21974c2d13ba436a7d771cf70fad58c5c54e521240566c15c1553f0e40c8ad14a9eac6651852da20396
SSDEEP 196608:XZGmuCsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnCsREJLODBWlX3d+NpvdHIom
TLSH
T1AAB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dilnlezjqe.exe

Path C:\Users\Admin\AppData\Local\Temp\dilnlezjqe.exe
Size 10.4MB
SHA256 b423c7a9d5323243d4b769241e2c589b34eb208f4cfcf2cbc1f81c8837d86fea
MD5 a7f27f67e18d08a60a5f6e41b851c2c6
SHA1 7b950e6971288a0b3399c28a467b6c6ac2d7660b
SHA512 48a9ac038e0699c13f0c7edb1b0c1680745fe549c1208ee24881b0b56491896226b3a4d15e59f786e6698c8147666a52f8f8baa39e722b0711e8ec728f9f02dd
SSDEEP 196608:XZGmuIsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnIsREJLODBWlX3d+NpvdHIom
TLSH
T108B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxtxtapdml.exe

Path C:\Users\Admin\AppData\Local\Temp\dxtxtapdml.exe
Size 10.4MB
SHA256 303f436a695689bf4df04049220820cd265701e01e391395dc9d024a1edde564
MD5 f761e29137e497adfc12267ad30d043a
SHA1 920ba622a40bd7e85268712089ce8d4c76f79cb4
SHA512 81da599cfd714c56c794dc8027d21e37194ddb7acd68ad3a234efe5897b97e44237dc55e40b1ea4d6823080f62b765f6beb6b50e78f5b7cb705aa1bb60880eb9
SSDEEP 196608:XZGmuAsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnAsREJLODBWlX3d+NpvdHIom
TLSH
T1BEB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcnwdcghsw.exe

Path C:\Users\Admin\AppData\Local\Temp\hcnwdcghsw.exe
Size 10.4MB
SHA256 867f65bba7b9bd329a791d829b62fbfa174a0102a4b7e95b879e54dca1571d25
MD5 7228e7193148bcf285fd980e9cf29307
SHA1 7a249d2475b99259c86958c1ea2c53ecf8cb08b9
SHA512 ef07420c8526e2d2edede5ad80fc9bd15ce1a4014e12117b5d78a825ba5a28039611c58b0b288c55a2bcd4c680bd3cb13eef8363dfd63cedba109f6fe0600acf
SSDEEP 196608:XZGmuasR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnasREJLODBWlX3d+NpvdHIom
TLSH
T14BB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ickonwskcr.exe

Path C:\Users\Admin\AppData\Local\Temp\ickonwskcr.exe
Size 10.4MB
SHA256 cfd23562cc0158614d920256153701d6fc8c672d6acba768184a265a4e543bcd
MD5 224aad3c3515d94e7cd4cbc9dae6f188
SHA1 e599dfbab111ecc8e8705f47329f018ff9bf186e
SHA512 af8e2316dd89f7b2f4a5bb55a42c5b5c864a4efb680fd0d76a25130cadc0fc171adccdba788f12eb78c72febf660b4414f02f1451c5d46bc5e341aa00418db83
SSDEEP 196608:XZGmuusR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnusREJLODBWlX3d+NpvdHIom
TLSH
T1D6B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ijovonotkf.exe

Path C:\Users\Admin\AppData\Local\Temp\ijovonotkf.exe
Size 10.4MB
SHA256 27aa9684e6fa7a81458d70a79630d078cb0b446042ea48a79b759a6a24b3edcd
MD5 8925c85d5f17133621182f7648669885
SHA1 5a5c4d72e53f8ff909c468fcf3027e82316de440
SHA512 92e9254f75acc3c59ad1af0ec64376a7bded5cc95a4060a450f3514b9d00445cda3f3936e7fb2803da84c26e6346dfd47f1d8a10f3f469270df5999c3b81e180
SSDEEP 196608:XZGmuwsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnwsREJLODBWlX3d+NpvdHIom
TLSH
T1F3B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdtwusylib.exe

Path C:\Users\Admin\AppData\Local\Temp\jdtwusylib.exe
Size 10.4MB
SHA256 ce04a0f8717740420239441a7bcf51b61ad7f363e9da446126dbe51420034eb1
MD5 1213d9f87b825675130fd492a0f12fcb
SHA1 aa23107d2ec07fcd41cb70a79f652816ecbfbf5a
SHA512 dd5b4269641d0c48aa1de54fb33d81742da0ca768c3c4b6f6cf654eb84d084b06a013240478da017a5eddd5289169e586b0450399a608c08b29af45e765c1da0
SSDEEP 196608:XZGmuLsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnLsREJLODBWlX3d+NpvdHIom
TLSH
T1E7B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nutobyujlf.exe

Path C:\Users\Admin\AppData\Local\Temp\nutobyujlf.exe
Size 10.4MB
SHA256 8e3d672a70377fff0aa606ea0c7a9a148d48c35ebb9659b10d8f3a923089f98b
MD5 20b845a1a06b9144900b0edc0f603cd0
SHA1 19731b5a5d23e2d1ddc2542c7e0c910d8af76b3d
SHA512 5462cbf1dc867b5a545595428eedf28936161b489a32335b25cb48af57e0185266455c2bd3cffb95d6048ea59357fd737737ef64addb855e42aae074d401854b
SSDEEP 196608:XZGmu8sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn8sREJLODBWlX3d+NpvdHIom
TLSH
T1D3B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ozztqcpjxk.exe

Path C:\Users\Admin\AppData\Local\Temp\ozztqcpjxk.exe
Size 10.4MB
SHA256 eeb54ed21e4a26e4fdd66019c768d6712f82d7636f06daa9e9a4d6b05397f719
MD5 10c9e1499c0ccf4beb4248ec5ab83961
SHA1 3f721a4ea62cc219179d956c120473e585c12d81
SHA512 24de8f5fc18b50e8e30d5e321ae98f3b6c1e3137d7b8ccbf5fae1bca9488bb9f776393778a71c535a78ab1a8637b6b3775be800032497669228ae67aa742f683
SSDEEP 196608:XZGmussR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnssREJLODBWlX3d+NpvdHIom
TLSH
T187B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmyfkcqasq.exe

Path C:\Users\Admin\AppData\Local\Temp\pmyfkcqasq.exe
Size 10.4MB
SHA256 07106938cfb81e1be3189a1454d469779272b61cb405f3022e7ee205d7b8c92f
MD5 cdd64e9e67efea3a4a87007b298b9897
SHA1 cd3f0bdf3fad7524fb5387ee6baf8ee340e80ff1
SHA512 dc490d4cdb7d397dcafd7865057924156cce031b5d4a64ffc958bb93f6892ec2ee32eaac32acc4e85811b8e76605f494bbc0f970cea711350d2d25d441ad7fea
SSDEEP 196608:XZGmuksR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnksREJLODBWlX3d+NpvdHIom
TLSH
T13DB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqeixsjhaj.exe

Path C:\Users\Admin\AppData\Local\Temp\sqeixsjhaj.exe
Size 10.4MB
SHA256 33ddde7504ba59e22ad0ddc8f78daa4f46e42c4da13770ba88f842d067b7f0df
MD5 0d9043eb7e9c26c62d41857296be7d31
SHA1 2266042d0643a661099dd13b02d172877ee8abb9
SHA512 7c9d1661bdceca5cdac14dc7ee62bf9f246faea35d7e3e37f97e91906dbf2f6ad358ce98db46ef923571fd29f0c5765b9983e76b3addbfa93e3afec7882577f4
SSDEEP 196608:XZGmu5sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn5sREJLODBWlX3d+NpvdHIom
TLSH
T176B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trcanpcmqn.exe

Path C:\Users\Admin\AppData\Local\Temp\trcanpcmqn.exe
Size 10.4MB
SHA256 70f53ada0bf9365bf95409ac1d7717c47061b70ecc20b80b808838ef8faefefb
MD5 c016d3fbd3dd251bd59c6d37293c6e9e
SHA1 fd0fc3c2d7b2c904942f1abfa1ffbdbb66438a61
SHA512 1ef0472bfc38f63e60dc365b22f3e94e92605e1144cb2234a154ac863b2390e0d3140b238a54650f0b491c77847a5cf27d386a068ea8c87737e2046e712ebaf3
SSDEEP 196608:XZGmu3sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn3sREJLODBWlX3d+NpvdHIom
TLSH
T1C2B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uvbpskyjxi.exe

Path C:\Users\Admin\AppData\Local\Temp\uvbpskyjxi.exe
Size 10.4MB
SHA256 805dc64b9632d41bed1dac37878750a341ba7961ec9baf9a1e56577bc4de9e2b
MD5 9630c8894b6bb4852534db2099fa31b0
SHA1 08839fb84e24610261234452e999b6ed1e7d544a
SHA512 3e48377fd98b11c117cc65b9367b2b88340cbf680bf4235dcf1e85c8ff4f0e549c7fd1957c91eddbabc16db91a3d87e0af6a71ce89a3855aa5604c906144c71a
SSDEEP 196608:XZGmuwsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnwsREJLODBWlX3d+NpvdHIom
TLSH
T183B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vxcmjcpmvf.exe

Path C:\Users\Admin\AppData\Local\Temp\vxcmjcpmvf.exe
Size 10.4MB
SHA256 144cdd784edf922568088844b6dd76ebc9d96783d2d49f342ca039c5a3e29007
MD5 6b876f85972520e53406fda4cc782d12
SHA1 034f2dbd4f4484cd1b6a8a9b46f20a0ab70922f9
SHA512 7ce8ffaa0d6d8722a556145b58b09733ff9e65b1befc855e44f42e6ea3a92d566a5380a5cca83c8f82c2b7321c4da50577cc3c9b08a7a50c275b9c0ce4fd3cb0
SSDEEP 196608:XZGmuxsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnxsREJLODBWlX3d+NpvdHIom
TLSH
T18EB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wycpeyqvzi.exe

Path C:\Users\Admin\AppData\Local\Temp\wycpeyqvzi.exe
Size 10.4MB
SHA256 b0f2072a7735fc61beed3540fe2ace65ad38f8503c98e98b1bae2eb00fbcabeb
MD5 091067b97152df9c277b666e34d6bd03
SHA1 cff1ad87e7f3c6cc7f94865781996f606485c1db
SHA512 ad876b1eb64e74ffe5dba7b2cb3f66ab24f343c102912d04d3e9dcfbf3015605dc6fad7294ec6e36a34e67c1f979e7b271250554448f11084e70164ff1f19967
SSDEEP 196608:XZGmuZsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnZsREJLODBWlX3d+NpvdHIom
TLSH
T197B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzxqjnsdli.exe

Path C:\Users\Admin\AppData\Local\Temp\wzxqjnsdli.exe
Size 10.4MB
SHA256 6fc2de80c96bd1dcbb8787ed88376897b27511ebd46f78c6a3456f92eba3955b
MD5 18c45e4ed39e59652d733cdc9d773b3c
SHA1 03e457fd2ada497485b874a0eab27c8e765243bc
SHA512 b7a93fae768e40f966296d8ae6d08796e4bf955f2a36f37599f42b4e4d074659d511cb0beaaa3efe2af3cbeaf697519a91a06122b10c3a8de9ec2ee08b0bf785
SSDEEP 196608:XZGmu2sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn2sREJLODBWlX3d+NpvdHIom
TLSH
T1E3B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpxssedgks.exe

Path C:\Users\Admin\AppData\Local\Temp\xpxssedgks.exe
Size 10.4MB
SHA256 f2e4ec83d4e8c9bd345586176e040ae632a59ddb2acf5e65ba791742955bd106
MD5 9ea022029a9a2e29a2ab4d4296832017
SHA1 0a1e8b4ceef0b5bd8ec2aa335f4a2864784c24e6
SHA512 3b11b669fc6c4ec43a00fafe6dea0322ef2c16df93f54eb4f86627080e3d09974cd173e0db088a9bbf59dd3ba8ed09b7916133f08cf841086a5ae0b5f1d6074b
SSDEEP 196608:XZGmuGsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnGsREJLODBWlX3d+NpvdHIom
TLSH
T1A1B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ygvhbqvrud.exe

Path C:\Users\Admin\AppData\Local\Temp\ygvhbqvrud.exe
Size 10.4MB
SHA256 e461cc76f5d0dad5e0a1de2fafe10126f786e9e537be56f542fd0ff5f21f2918
MD5 b8b15fb15a2c6e8d355e83ebe70837c4
SHA1 f667edb8b2ab22fba1a08bdf523a2a71e7452fb7
SHA512 24bc9ae3884913a0e19d33cf7e3f374d97ee62be3078a0f3e4d70f026a369077e3e3767a95e2fafcbe510cc2172bfdfbb094466b76fc48cba29577e22a129d92
SSDEEP 196608:XZGmubsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnbsREJLODBWlX3d+NpvdHIom
TLSH
T141B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ynlewhmwil.exe

Path C:\Users\Admin\AppData\Local\Temp\ynlewhmwil.exe
Size 10.4MB
SHA256 d79c9193e89e228671acdcba7ffc4971c4f01a494f4fe77a1be05a3ff6f59565
MD5 a0558a78a00164aded3b1e75866e86d1
SHA1 e9a80e4f4b2a89c9bb53fbceeba7e40cda5e65fb
SHA512 0d5bde9c153062dd1ed096a5ecaefb26c171698d5a6b38e2d6c8deeaf32081b9545bed0fa961398bfd5503c134032f3b5f386f9583a802b880d0e665dea0be34
SSDEEP 196608:XZGmuQsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnQsREJLODBWlX3d+NpvdHIom
TLSH
T19DB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yrpmuptzhk.exe

Path C:\Users\Admin\AppData\Local\Temp\yrpmuptzhk.exe
Size 10.4MB
SHA256 afa01d617a2df374a365ddfa4437564ccccb71c582009fc63764af61dd0d26ec
MD5 0e2aac7c267d0645723632eafb1cc7d2
SHA1 12c86aa8690c62e8ca5c91e01da055c0829566d3
SHA512 23c72c55be4035af0501727db1f4054c985eb8563c19b6b9714c503578003ec8232806c9985407f7f80d0247b63d084c1583dd0ff8a2b92ce7882e5bb9b4a03e
SSDEEP 196608:XZGmujsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnjsREJLODBWlX3d+NpvdHIom
TLSH
T1DFB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-129-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1140-145-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1204-121-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1256-19-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1476-169-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1496-67-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1496-66-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/1560-92-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1600-75-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1628-189-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1708-113-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1892-164-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2116-100-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2388-108-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2440-43-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2440-42-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/2736-59-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2948-192-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2972-81-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2984-16-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2984-15-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3204-197-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3584-32-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3784-2-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/3784-3-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3876-48-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4164-184-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4352-148-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4436-152-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/4436-153-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4556-51-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4556-50-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/4656-187-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4812-193-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4812-194-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5108-182-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5128-140-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5168-89-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5320-72-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5364-35-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5404-24-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5408-7-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/5408-8-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5616-84-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5684-105-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5716-124-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5740-132-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6056-11-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6056-10-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/6380-40-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6460-137-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6580-0-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/6580-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6632-172-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6632-171-0x0000000001220000-0x0000000001221000-memory.dmp

Download

memory/6700-161-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6724-156-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6796-56-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6804-178-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6836-116-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6896-27-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/7036-64-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/7140-176-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/7152-97-0x0000000000400000-0x0000000000E90000-memory.dmp

Download