8629588ffe6b55ff56e59aefdc053b9a971f1a14daa1b4593402640ff1d27c9c

Analysis

max time kernel
97s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Size 10.6MB
Sample260720-wj81vsb19v
SHA256 8629588ffe6b55ff56e59aefdc053b9a971f1a14daa1b4593402640ff1d27c9c
MD5 30e3ca7e33a09cf7a9be0750a573fbbe
SHA1 35ff461aa5c8fc34cfde94e6159fcb9865f024f2
SHA512 e0e2b848f124468fecd7821cb0a6efcee44a8cff4f170c1512cdbcdf371add97c440b5af0f6bb8f661d51a23419d8860d6efa10c90be4f0d1980bdd16eff4397
SSDEEP 196608:PZGmuesR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnesREJLODBWlX3d+NpvdHIol
TLSH
T16DB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2916	adlknjctzt.exe
4240	adlknjctzt.exe
5692	ujctchpkto.exe
5904	ujctchpkto.exe
4912	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
3984	hpgebrcozp.exe
5696	hpgebrcozp.exe
4964	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
1124	zzuapeevan.exe
1296	zzuapeevan.exe
244	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
3284	oyvqidhcen.exe
2960	oyvqidhcen.exe
5344	yngzuwtjms.exe
4280	yngzuwtjms.exe
880	gvoirnnssq.exe
6140	gvoirnnssq.exe
3000	yeyaclwkmo.exe
1216	yeyaclwkmo.exe
5136	jxwzgnuozw.exe
5132	jxwzgnuozw.exe
5544	llvqscbozh.exe
5960	llvqscbozh.exe
3892	yzzkzwmycx.exe
4904	yzzkzwmycx.exe
2968	sgkweaqqtk.exe
4612	sgkweaqqtk.exe
1932	idwnttkbsz.exe
3728	idwnttkbsz.exe
3856	uhqledsqiz.exe
2152	uhqledsqiz.exe
3732	kulkkzbqed.exe
4312	kulkkzbqed.exe
3112	xapvjrxlce.exe
4168	xapvjrxlce.exe
4640	eugmuwmqei.exe
4272	eugmuwmqei.exe
3096	pvefwcmude.exe
1292	pvefwcmude.exe
4196	pgqbprbluy.exe
4800	pgqbprbluy.exe
4736	jfqhypzgym.exe
3464	jfqhypzgym.exe
2752	uqsawuxsrm.exe
5232	uqsawuxsrm.exe
4244	wehtcwpkin.exe
2144	wehtcwpkin.exe
5716	rzxmtjkhhf.exe
1580	rzxmtjkhhf.exe
1020	opokadewjh.exe
5904	opokadewjh.exe
3980	hxtbwylagm.exe
3816	hxtbwylagm.exe
3244	gfzwhhisre.exe
3704	gfzwhhisre.exe
3744	ziqzggvrbw.exe
3900	ziqzggvrbw.exe
3188	ewulrknzyn.exe
2776	ewulrknzyn.exe
1652	gntdojnuid.exe
2788	gntdojnuid.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5012	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2916	adlknjctzt.exe
4240	adlknjctzt.exe
5692	ujctchpkto.exe
5904	ujctchpkto.exe
4912	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
3984	hpgebrcozp.exe
5696	hpgebrcozp.exe
4964	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
1124	zzuapeevan.exe
1296	zzuapeevan.exe
244	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
3284	oyvqidhcen.exe
2960	oyvqidhcen.exe
5344	yngzuwtjms.exe
4280	yngzuwtjms.exe
880	gvoirnnssq.exe
6140	gvoirnnssq.exe
3000	yeyaclwkmo.exe
1216	yeyaclwkmo.exe
5136	jxwzgnuozw.exe
5132	jxwzgnuozw.exe
5544	llvqscbozh.exe
5960	llvqscbozh.exe
3892	yzzkzwmycx.exe
4904	yzzkzwmycx.exe
2968	sgkweaqqtk.exe
4612	sgkweaqqtk.exe
1932	idwnttkbsz.exe
3728	idwnttkbsz.exe
3856	uhqledsqiz.exe
2152	uhqledsqiz.exe
3732	kulkkzbqed.exe
4312	kulkkzbqed.exe
3112	xapvjrxlce.exe
4168	xapvjrxlce.exe
4640	eugmuwmqei.exe
4272	eugmuwmqei.exe
3096	pvefwcmude.exe
1292	pvefwcmude.exe
4196	pgqbprbluy.exe
4800	pgqbprbluy.exe
4736	jfqhypzgym.exe
3464	jfqhypzgym.exe
2752	uqsawuxsrm.exe
5232	uqsawuxsrm.exe
4244	wehtcwpkin.exe
2144	wehtcwpkin.exe
5716	rzxmtjkhhf.exe
1580	rzxmtjkhhf.exe
1020	opokadewjh.exe
5904	opokadewjh.exe
3980	hxtbwylagm.exe
3816	hxtbwylagm.exe
3244	gfzwhhisre.exe
3704	gfzwhhisre.exe
3744	ziqzggvrbw.exe
3900	ziqzggvrbw.exe
3188	ewulrknzyn.exe
2776	ewulrknzyn.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjfqbmsxco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idwnttkbsz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pgqbprbluy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hxtbwylagm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewulrknzyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bikwfwazzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeaoxwfgza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xapvjrxlce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvefwcmude.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llvqscbozh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rzxmtjkhhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opokadewjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adlknjctzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yeyaclwkmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgkweaqqtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfqhypzgym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uqsawuxsrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wehtcwpkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gfzwhhisre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bykfvgyoej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzuapeevan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yeyaclwkmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xapvjrxlce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziqzggvrbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oyvqidhcen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eugmuwmqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eugmuwmqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rzxmtjkhhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gfzwhhisre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujpxdyupqw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzuapeevan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oyvqidhcen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gntdojnuid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adlknjctzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvefwcmude.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uqsawuxsrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujpxdyupqw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvoirnnssq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhqledsqiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhqledsqiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kulkkzbqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pgqbprbluy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpgebrcozp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeaoxwfgza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idwnttkbsz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opokadewjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziqzggvrbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvoirnnssq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yzzkzwmycx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujctchpkto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfqhypzgym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hxtbwylagm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gntdojnuid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujctchpkto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjfqbmsxco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpgebrcozp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yngzuwtjms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yngzuwtjms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yzzkzwmycx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgkweaqqtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kulkkzbqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bykfvgyoej.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5012	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5012	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2916	adlknjctzt.exe
2916	adlknjctzt.exe
2916	adlknjctzt.exe
2916	adlknjctzt.exe
4240	adlknjctzt.exe
4240	adlknjctzt.exe
5692	ujctchpkto.exe
5692	ujctchpkto.exe
5692	ujctchpkto.exe
5692	ujctchpkto.exe
5904	ujctchpkto.exe
5904	ujctchpkto.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4912	mjfqbmsxco.exe
4912	mjfqbmsxco.exe
4912	mjfqbmsxco.exe
4912	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
2916	adlknjctzt.exe
2916	adlknjctzt.exe
5692	ujctchpkto.exe
5692	ujctchpkto.exe
3984	hpgebrcozp.exe
3984	hpgebrcozp.exe
3984	hpgebrcozp.exe
3984	hpgebrcozp.exe
5696	hpgebrcozp.exe
5696	hpgebrcozp.exe
4912	mjfqbmsxco.exe
4912	mjfqbmsxco.exe
4964	ujpxdyupqw.exe
4964	ujpxdyupqw.exe
4964	ujpxdyupqw.exe
4964	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
3984	hpgebrcozp.exe
3984	hpgebrcozp.exe
1124	zzuapeevan.exe
1124	zzuapeevan.exe
1124	zzuapeevan.exe
1124	zzuapeevan.exe
4964	ujpxdyupqw.exe
4964	ujpxdyupqw.exe
1296	zzuapeevan.exe
1296	zzuapeevan.exe
244	zeaoxwfgza.exe
244	zeaoxwfgza.exe
244	zeaoxwfgza.exe
244	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
1124	zzuapeevan.exe
1124	zzuapeevan.exe
3284	oyvqidhcen.exe
3284	oyvqidhcen.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5012	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
5012	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2916	adlknjctzt.exe
2916	adlknjctzt.exe
4240	adlknjctzt.exe
4240	adlknjctzt.exe
5692	ujctchpkto.exe
5692	ujctchpkto.exe
5904	ujctchpkto.exe
5904	ujctchpkto.exe
4912	mjfqbmsxco.exe
4912	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
5404	mjfqbmsxco.exe
3984	hpgebrcozp.exe
3984	hpgebrcozp.exe
5696	hpgebrcozp.exe
5696	hpgebrcozp.exe
4964	ujpxdyupqw.exe
4964	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
4400	ujpxdyupqw.exe
1124	zzuapeevan.exe
1124	zzuapeevan.exe
1296	zzuapeevan.exe
1296	zzuapeevan.exe
244	zeaoxwfgza.exe
244	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
2728	zeaoxwfgza.exe
3284	oyvqidhcen.exe
3284	oyvqidhcen.exe
2960	oyvqidhcen.exe
2960	oyvqidhcen.exe
5344	yngzuwtjms.exe
5344	yngzuwtjms.exe
4280	yngzuwtjms.exe
4280	yngzuwtjms.exe
880	gvoirnnssq.exe
880	gvoirnnssq.exe
6140	gvoirnnssq.exe
6140	gvoirnnssq.exe
3000	yeyaclwkmo.exe
3000	yeyaclwkmo.exe
1216	yeyaclwkmo.exe
1216	yeyaclwkmo.exe
5136	jxwzgnuozw.exe
5136	jxwzgnuozw.exe
5132	jxwzgnuozw.exe
5132	jxwzgnuozw.exe
5544	llvqscbozh.exe
5544	llvqscbozh.exe
5960	llvqscbozh.exe
5960	llvqscbozh.exe
3892	yzzkzwmycx.exe
3892	yzzkzwmycx.exe
4904	yzzkzwmycx.exe
4904	yzzkzwmycx.exe
2968	sgkweaqqtk.exe
2968	sgkweaqqtk.exe
4612	sgkweaqqtk.exe
4612	sgkweaqqtk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5012	4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	89
PID 4112 wrote to memory of 2916	4112	2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	90
PID 2916 wrote to memory of 4240	2916	adlknjctzt.exe	91
PID 2916 wrote to memory of 5692	2916	adlknjctzt.exe	92
PID 5692 wrote to memory of 5904	5692	ujctchpkto.exe	93
PID 5692 wrote to memory of 4912	5692	ujctchpkto.exe	94
PID 4912 wrote to memory of 5404	4912	mjfqbmsxco.exe	95
PID 4912 wrote to memory of 3984	4912	mjfqbmsxco.exe	96
PID 3984 wrote to memory of 5696	3984	hpgebrcozp.exe	97
PID 3984 wrote to memory of 4964	3984	hpgebrcozp.exe	98
PID 4964 wrote to memory of 4400	4964	ujpxdyupqw.exe	99
PID 4964 wrote to memory of 1124	4964	ujpxdyupqw.exe	100
PID 1124 wrote to memory of 1296	1124	zzuapeevan.exe	101
PID 1124 wrote to memory of 244	1124	zzuapeevan.exe	102
PID 244 wrote to memory of 2728	244	zeaoxwfgza.exe	103
PID 244 wrote to memory of 3284	244	zeaoxwfgza.exe	104
PID 3284 wrote to memory of 2960	3284	oyvqidhcen.exe	105
PID 3284 wrote to memory of 5344	3284	oyvqidhcen.exe	106
PID 5344 wrote to memory of 4280	5344	yngzuwtjms.exe	107
PID 5344 wrote to memory of 880	5344	yngzuwtjms.exe	109
PID 880 wrote to memory of 6140	880	gvoirnnssq.exe	110
PID 880 wrote to memory of 3000	880	gvoirnnssq.exe	111
PID 3000 wrote to memory of 1216	3000	yeyaclwkmo.exe	112
PID 3000 wrote to memory of 5136	3000	yeyaclwkmo.exe	113
PID 5136 wrote to memory of 5132	5136	jxwzgnuozw.exe	114
PID 5136 wrote to memory of 5544	5136	jxwzgnuozw.exe	115
PID 5544 wrote to memory of 5960	5544	llvqscbozh.exe	116
PID 5544 wrote to memory of 3892	5544	llvqscbozh.exe	117
PID 3892 wrote to memory of 4904	3892	yzzkzwmycx.exe	118
PID 3892 wrote to memory of 2968	3892	yzzkzwmycx.exe	119
PID 2968 wrote to memory of 4612	2968	sgkweaqqtk.exe	120
PID 2968 wrote to memory of 1932	2968	sgkweaqqtk.exe	121
PID 1932 wrote to memory of 3728	1932	idwnttkbsz.exe	122
PID 1932 wrote to memory of 3856	1932	idwnttkbsz.exe	123
PID 3856 wrote to memory of 2152	3856	uhqledsqiz.exe	124
PID 3856 wrote to memory of 3732	3856	uhqledsqiz.exe	125
PID 3732 wrote to memory of 4312	3732	kulkkzbqed.exe	126
PID 3732 wrote to memory of 3112	3732	kulkkzbqed.exe	127
PID 3112 wrote to memory of 4168	3112	xapvjrxlce.exe	128
PID 3112 wrote to memory of 4640	3112	xapvjrxlce.exe	129
PID 4640 wrote to memory of 4272	4640	eugmuwmqei.exe	130
PID 4640 wrote to memory of 3096	4640	eugmuwmqei.exe	131
PID 3096 wrote to memory of 1292	3096	pvefwcmude.exe	132
PID 3096 wrote to memory of 4196	3096	pvefwcmude.exe	133
PID 4196 wrote to memory of 4800	4196	pgqbprbluy.exe	134
PID 4196 wrote to memory of 4736	4196	pgqbprbluy.exe	135
PID 4736 wrote to memory of 3464	4736	jfqhypzgym.exe	136
PID 4736 wrote to memory of 2752	4736	jfqhypzgym.exe	137
PID 2752 wrote to memory of 5232	2752	uqsawuxsrm.exe	138
PID 2752 wrote to memory of 4244	2752	uqsawuxsrm.exe	139
PID 4244 wrote to memory of 2144	4244	wehtcwpkin.exe	140
PID 4244 wrote to memory of 5716	4244	wehtcwpkin.exe	141
PID 5716 wrote to memory of 1580	5716	rzxmtjkhhf.exe	142
PID 5716 wrote to memory of 1020	5716	rzxmtjkhhf.exe	143
PID 1020 wrote to memory of 5904	1020	opokadewjh.exe	144
PID 1020 wrote to memory of 3980	1020	opokadewjh.exe	145
PID 3980 wrote to memory of 3816	3980	hxtbwylagm.exe	146
PID 3980 wrote to memory of 3244	3980	hxtbwylagm.exe	147
PID 3244 wrote to memory of 3704	3244	gfzwhhisre.exe	148
PID 3244 wrote to memory of 3744	3244	gfzwhhisre.exe	149
PID 3744 wrote to memory of 3900	3744	ziqzggvrbw.exe	150
PID 3744 wrote to memory of 3188	3744	ziqzggvrbw.exe	151
PID 3188 wrote to memory of 2776	3188	ewulrknzyn.exe	152
PID 3188 wrote to memory of 1652	3188	ewulrknzyn.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-20_30e3ca7e33a09cf7a9be0750a573fbbe_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update adlknjctzt.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\adlknjctzt.exe
  C:\Users\Admin\AppData\Local\Temp\adlknjctzt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\adlknjctzt.exe
    C:\Users\Admin\AppData\Local\Temp\adlknjctzt.exe update ujctchpkto.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\ujctchpkto.exe
    C:\Users\Admin\AppData\Local\Temp\ujctchpkto.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\ujctchpkto.exe
      C:\Users\Admin\AppData\Local\Temp\ujctchpkto.exe update mjfqbmsxco.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\mjfqbmsxco.exe
      C:\Users\Admin\AppData\Local\Temp\mjfqbmsxco.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\mjfqbmsxco.exe
        
        C:\Users\Admin\AppData\Local\Temp\mjfqbmsxco.exe update hpgebrcozp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\hpgebrcozp.exe
        
        C:\Users\Admin\AppData\Local\Temp\hpgebrcozp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\hpgebrcozp.exe
        
        C:\Users\Admin\AppData\Local\Temp\hpgebrcozp.exe update ujpxdyupqw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\ujpxdyupqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ujpxdyupqw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\ujpxdyupqw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ujpxdyupqw.exe update zzuapeevan.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\zzuapeevan.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzuapeevan.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\zzuapeevan.exe
        
        C:\Users\Admin\AppData\Local\Temp\zzuapeevan.exe update zeaoxwfgza.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\zeaoxwfgza.exe
        
        C:\Users\Admin\AppData\Local\Temp\zeaoxwfgza.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\zeaoxwfgza.exe
        
        C:\Users\Admin\AppData\Local\Temp\zeaoxwfgza.exe update oyvqidhcen.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\oyvqidhcen.exe
        
        C:\Users\Admin\AppData\Local\Temp\oyvqidhcen.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\oyvqidhcen.exe
        
        C:\Users\Admin\AppData\Local\Temp\oyvqidhcen.exe update yngzuwtjms.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\yngzuwtjms.exe
        
        C:\Users\Admin\AppData\Local\Temp\yngzuwtjms.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\yngzuwtjms.exe
        
        C:\Users\Admin\AppData\Local\Temp\yngzuwtjms.exe update gvoirnnssq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\gvoirnnssq.exe
        
        C:\Users\Admin\AppData\Local\Temp\gvoirnnssq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\gvoirnnssq.exe
        
        C:\Users\Admin\AppData\Local\Temp\gvoirnnssq.exe update yeyaclwkmo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe
        
        C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe
        
        C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe update jxwzgnuozw.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\jxwzgnuozw.exe
        
        C:\Users\Admin\AppData\Local\Temp\jxwzgnuozw.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\jxwzgnuozw.exe
        
        C:\Users\Admin\AppData\Local\Temp\jxwzgnuozw.exe update llvqscbozh.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\llvqscbozh.exe
        
        C:\Users\Admin\AppData\Local\Temp\llvqscbozh.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\llvqscbozh.exe
        
        C:\Users\Admin\AppData\Local\Temp\llvqscbozh.exe update yzzkzwmycx.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\yzzkzwmycx.exe
        
        C:\Users\Admin\AppData\Local\Temp\yzzkzwmycx.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\yzzkzwmycx.exe
        
        C:\Users\Admin\AppData\Local\Temp\yzzkzwmycx.exe update sgkweaqqtk.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\sgkweaqqtk.exe
        
        C:\Users\Admin\AppData\Local\Temp\sgkweaqqtk.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\sgkweaqqtk.exe
        
        C:\Users\Admin\AppData\Local\Temp\sgkweaqqtk.exe update idwnttkbsz.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\idwnttkbsz.exe
        
        C:\Users\Admin\AppData\Local\Temp\idwnttkbsz.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\idwnttkbsz.exe
        
        C:\Users\Admin\AppData\Local\Temp\idwnttkbsz.exe update uhqledsqiz.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\uhqledsqiz.exe
        
        C:\Users\Admin\AppData\Local\Temp\uhqledsqiz.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\uhqledsqiz.exe
        
        C:\Users\Admin\AppData\Local\Temp\uhqledsqiz.exe update kulkkzbqed.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\kulkkzbqed.exe
        
        C:\Users\Admin\AppData\Local\Temp\kulkkzbqed.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\kulkkzbqed.exe
        
        C:\Users\Admin\AppData\Local\Temp\kulkkzbqed.exe update xapvjrxlce.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\xapvjrxlce.exe
        
        C:\Users\Admin\AppData\Local\Temp\xapvjrxlce.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\xapvjrxlce.exe
        
        C:\Users\Admin\AppData\Local\Temp\xapvjrxlce.exe update eugmuwmqei.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\eugmuwmqei.exe
        
        C:\Users\Admin\AppData\Local\Temp\eugmuwmqei.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\eugmuwmqei.exe
        
        C:\Users\Admin\AppData\Local\Temp\eugmuwmqei.exe update pvefwcmude.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\pvefwcmude.exe
        
        C:\Users\Admin\AppData\Local\Temp\pvefwcmude.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\pvefwcmude.exe
        
        C:\Users\Admin\AppData\Local\Temp\pvefwcmude.exe update pgqbprbluy.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\pgqbprbluy.exe
        
        C:\Users\Admin\AppData\Local\Temp\pgqbprbluy.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\pgqbprbluy.exe
        
        C:\Users\Admin\AppData\Local\Temp\pgqbprbluy.exe update jfqhypzgym.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\jfqhypzgym.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfqhypzgym.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\jfqhypzgym.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfqhypzgym.exe update uqsawuxsrm.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\uqsawuxsrm.exe
        
        C:\Users\Admin\AppData\Local\Temp\uqsawuxsrm.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\uqsawuxsrm.exe
        
        C:\Users\Admin\AppData\Local\Temp\uqsawuxsrm.exe update wehtcwpkin.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\wehtcwpkin.exe
        
        C:\Users\Admin\AppData\Local\Temp\wehtcwpkin.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\wehtcwpkin.exe
        
        C:\Users\Admin\AppData\Local\Temp\wehtcwpkin.exe update rzxmtjkhhf.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\rzxmtjkhhf.exe
        
        C:\Users\Admin\AppData\Local\Temp\rzxmtjkhhf.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\rzxmtjkhhf.exe
        
        C:\Users\Admin\AppData\Local\Temp\rzxmtjkhhf.exe update opokadewjh.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\opokadewjh.exe
        
        C:\Users\Admin\AppData\Local\Temp\opokadewjh.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\opokadewjh.exe
        
        C:\Users\Admin\AppData\Local\Temp\opokadewjh.exe update hxtbwylagm.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\hxtbwylagm.exe
        
        C:\Users\Admin\AppData\Local\Temp\hxtbwylagm.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\hxtbwylagm.exe
        
        C:\Users\Admin\AppData\Local\Temp\hxtbwylagm.exe update gfzwhhisre.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\gfzwhhisre.exe
        
        C:\Users\Admin\AppData\Local\Temp\gfzwhhisre.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\gfzwhhisre.exe
        
        C:\Users\Admin\AppData\Local\Temp\gfzwhhisre.exe update ziqzggvrbw.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\ziqzggvrbw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ziqzggvrbw.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\ziqzggvrbw.exe
        
        C:\Users\Admin\AppData\Local\Temp\ziqzggvrbw.exe update ewulrknzyn.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\ewulrknzyn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ewulrknzyn.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\ewulrknzyn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ewulrknzyn.exe update gntdojnuid.exe
        33⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\gntdojnuid.exe
        
        C:\Users\Admin\AppData\Local\Temp\gntdojnuid.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\gntdojnuid.exe
        
        C:\Users\Admin\AppData\Local\Temp\gntdojnuid.exe update bikwfwazzu.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\bikwfwazzu.exe
        
        C:\Users\Admin\AppData\Local\Temp\bikwfwazzu.exe
        34⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\bikwfwazzu.exe
        
        C:\Users\Admin\AppData\Local\Temp\bikwfwazzu.exe update bykfvgyoej.exe
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\bykfvgyoej.exe
        
        C:\Users\Admin\AppData\Local\Temp\bykfvgyoej.exe
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\bykfvgyoej.exe
        
        C:\Users\Admin\AppData\Local\Temp\bykfvgyoej.exe update qocqghqvac.exe
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\qocqghqvac.exe
        
        C:\Users\Admin\AppData\Local\Temp\qocqghqvac.exe
        36⤵
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\qocqghqvac.exe
        
        C:\Users\Admin\AppData\Local\Temp\qocqghqvac.exe update jlfebdinzn.exe
        37⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\jlfebdinzn.exe
        
        C:\Users\Admin\AppData\Local\Temp\jlfebdinzn.exe
        37⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\jlfebdinzn.exe
        
        C:\Users\Admin\AppData\Local\Temp\jlfebdinzn.exe update lytsnxcowi.exe
        38⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\lytsnxcowi.exe
        
        C:\Users\Admin\AppData\Local\Temp\lytsnxcowi.exe
        38⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\lytsnxcowi.exe
        
        C:\Users\Admin\AppData\Local\Temp\lytsnxcowi.exe update ilaiduvaow.exe
        39⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\ilaiduvaow.exe
        
        C:\Users\Admin\AppData\Local\Temp\ilaiduvaow.exe
        39⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\ilaiduvaow.exe
        
        C:\Users\Admin\AppData\Local\Temp\ilaiduvaow.exe update ocrukjrvsy.exe
        40⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\ocrukjrvsy.exe
        
        C:\Users\Admin\AppData\Local\Temp\ocrukjrvsy.exe
        40⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\ocrukjrvsy.exe
        
        C:\Users\Admin\AppData\Local\Temp\ocrukjrvsy.exe update bejsyqgwdm.exe
        41⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\bejsyqgwdm.exe
        
        C:\Users\Admin\AppData\Local\Temp\bejsyqgwdm.exe
        41⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\bejsyqgwdm.exe
        
        C:\Users\Admin\AppData\Local\Temp\bejsyqgwdm.exe update dwzlbdcmvm.exe
        42⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe
        
        C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe
        42⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe
        
        C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe update nzjmzabgge.exe
        43⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        43⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe update sqrpgqxaso.exe
        44⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\sqrpgqxaso.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqrpgqxaso.exe
        44⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\sqrpgqxaso.exe
        
        C:\Users\Admin\AppData\Local\Temp\sqrpgqxaso.exe update kfdvogzkyd.exe
        45⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\kfdvogzkyd.exe
        
        C:\Users\Admin\AppData\Local\Temp\kfdvogzkyd.exe
        45⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\kfdvogzkyd.exe
        
        C:\Users\Admin\AppData\Local\Temp\kfdvogzkyd.exe update avwmagoiwc.exe
        46⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\avwmagoiwc.exe
        
        C:\Users\Admin\AppData\Local\Temp\avwmagoiwc.exe
        46⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\avwmagoiwc.exe
        
        C:\Users\Admin\AppData\Local\Temp\avwmagoiwc.exe update drlfxinaoe.exe
        47⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\drlfxinaoe.exe
        
        C:\Users\Admin\AppData\Local\Temp\drlfxinaoe.exe
        47⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\drlfxinaoe.exe
        
        C:\Users\Admin\AppData\Local\Temp\drlfxinaoe.exe update ngzrkrjonh.exe
        48⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\ngzrkrjonh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ngzrkrjonh.exe
        48⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\ngzrkrjonh.exe
        
        C:\Users\Admin\AppData\Local\Temp\ngzrkrjonh.exe update ncxfrkkrmu.exe
        49⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\ncxfrkkrmu.exe
        
        C:\Users\Admin\AppData\Local\Temp\ncxfrkkrmu.exe
        49⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\ncxfrkkrmu.exe
        
        C:\Users\Admin\AppData\Local\Temp\ncxfrkkrmu.exe update vlggqoorxe.exe
        50⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\vlggqoorxe.exe
        
        C:\Users\Admin\AppData\Local\Temp\vlggqoorxe.exe
        50⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\vlggqoorxe.exe
        
        C:\Users\Admin\AppData\Local\Temp\vlggqoorxe.exe update zyhwhomjxe.exe
        51⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\zyhwhomjxe.exe
        
        C:\Users\Admin\AppData\Local\Temp\zyhwhomjxe.exe
        51⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\zyhwhomjxe.exe
        
        C:\Users\Admin\AppData\Local\Temp\zyhwhomjxe.exe update zgsddlsgdc.exe
        52⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\zgsddlsgdc.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgsddlsgdc.exe
        52⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\zgsddlsgdc.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgsddlsgdc.exe update krujmyorqb.exe
        53⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\krujmyorqb.exe
        
        C:\Users\Admin\AppData\Local\Temp\krujmyorqb.exe
        53⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\krujmyorqb.exe
        
        C:\Users\Admin\AppData\Local\Temp\krujmyorqb.exe update hlaxnpvjpy.exe
        54⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\hlaxnpvjpy.exe
        
        C:\Users\Admin\AppData\Local\Temp\hlaxnpvjpy.exe
        54⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\hlaxnpvjpy.exe
        
        C:\Users\Admin\AppData\Local\Temp\hlaxnpvjpy.exe update jaorayqppb.exe
        55⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        55⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe update hjtaalshvm.exe
        56⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\hjtaalshvm.exe
        
        C:\Users\Admin\AppData\Local\Temp\hjtaalshvm.exe
        56⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\hjtaalshvm.exe
        
        C:\Users\Admin\AppData\Local\Temp\hjtaalshvm.exe update zjgybnvhou.exe
        57⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\zjgybnvhou.exe
        
        C:\Users\Admin\AppData\Local\Temp\zjgybnvhou.exe
        57⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\zjgybnvhou.exe
        
        C:\Users\Admin\AppData\Local\Temp\zjgybnvhou.exe update zrqfxsbeut.exe
        58⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\zrqfxsbeut.exe
        
        C:\Users\Admin\AppData\Local\Temp\zrqfxsbeut.exe
        58⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\zrqfxsbeut.exe
        
        C:\Users\Admin\AppData\Local\Temp\zrqfxsbeut.exe update jglqyiafug.exe
        59⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\jglqyiafug.exe
        
        C:\Users\Admin\AppData\Local\Temp\jglqyiafug.exe
        59⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\jglqyiafug.exe
        
        C:\Users\Admin\AppData\Local\Temp\jglqyiafug.exe update cwykzfzgub.exe
        60⤵
        
        PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

adlknjctzt.exe

Path C:\Users\Admin\AppData\Local\Temp\adlknjctzt.exe
Size 10.6MB
SHA256 8bf7a9fe607f77b4ee19520157c45e0ae5aaccdb377965add58bc9de11c8b4df
MD5 6490d1b6b52ae0ed537bac26dfe65a79
SHA1 866e1947a15672f5b5ad96a3f3467062d85b3072
SHA512 09eea0bc95f3a2c10aced6a906f3664221a6918111cb3c5d2087608e7fcd9a736fe9ea4f7230d464b9ebdc54ad788df831b1d4880c06ea4cdf7c6ee0745931a1
SSDEEP 196608:PZGmu3sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn3sREJLODBWlX3d+NpvdHIol
TLSH
T114B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eugmuwmqei.exe

Path C:\Users\Admin\AppData\Local\Temp\eugmuwmqei.exe
Size 10.6MB
SHA256 5c070dc5350e97be1c9f39108310ae81c35a8af178ecb65937f04b71021c4455
MD5 7218c78a361c11aaed335db8b2789ec9
SHA1 27f7237372e2a4d29d5c2be50a4a05e91c972f8d
SHA512 cf6e49e3a4682457e582b7097f429e38d7d14379674b523f4477a9d5ce27f3a2cff36b183f703b7c4d8f05e4d04bc82d75a71030e87f8319cb4724a794340df0
SSDEEP 196608:PZGmuosR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnosREJLODBWlX3d+NpvdHIol
TLSH
T1C8B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gvoirnnssq.exe

Path C:\Users\Admin\AppData\Local\Temp\gvoirnnssq.exe
Size 10.6MB
SHA256 543839f574e542aa16e3fe222cddfb4be7c36ab59c02cfa6c343f4f6819acb79
MD5 004aae4e66abdc6ead547623bf1f3ed7
SHA1 176230ca7bef5a4516db042e1b0bc1304d1a82dc
SHA512 c1169a5a21c6df6a2337e1983c4e7622ec22d71b722c42d5b49732cbba417a244fffd412dfcb6923450576277960fb8605c61394783ae29678e874a1bf84c29a
SSDEEP 196608:PZGmuZsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnZsREJLODBWlX3d+NpvdHIol
TLSH
T118B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hpgebrcozp.exe

Path C:\Users\Admin\AppData\Local\Temp\hpgebrcozp.exe
Size 10.6MB
SHA256 880a8cabf31c0573c547cce632ea65f5738f370d76425d9b104cae2b181a3d69
MD5 a9af3c5db145fe255434c387d2ecf2dd
SHA1 5c6ff69813baccbf0a69d7cd78e8730a6a9ee179
SHA512 a7f80d5ac885a54d141ab1cfa6fdd3631a60872f0b13abeb7c4cc173e93b674e16df6e8066e399dc7e2f1099cd301882c9ed9a6b25c804a2986e76b645c2e325
SSDEEP 196608:PZGmuVsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnVsREJLODBWlX3d+NpvdHIol
TLSH
T149B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idwnttkbsz.exe

Path C:\Users\Admin\AppData\Local\Temp\idwnttkbsz.exe
Size 10.6MB
SHA256 23b842d4170dc6cf4d984a7f4706cd344194fd79765f3345730cdb34183510d1
MD5 ebd6d36c71375d05d1e9c7c76e99996d
SHA1 8b340c1c78bd9557ee14945f6d6ac6b21151de9c
SHA512 cabcfc36ee0d0420cfc458b557719c987589540e429ca0e17abbfc10f70df1ce57fc55d997db8dcfc9bc5a18f86440ba20448f89f2057093c4c7a35b7ab32624
SSDEEP 196608:PZGmu5sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn5sREJLODBWlX3d+NpvdHIol
TLSH
T143B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jxwzgnuozw.exe

Path C:\Users\Admin\AppData\Local\Temp\jxwzgnuozw.exe
Size 10.6MB
SHA256 b5e2a53a12c1d175cf74465c1f90b785e65b5d7352d9963fd05e072a6d589a1d
MD5 eee32a205401bcacf82adaf4a665a78d
SHA1 82cc930142461eddeebf3be75b4fd1e34e7541ea
SHA512 fda6e832af74d021582486da57767813b9be54c948e80b8155ce070638777e3349bb7604d4dfe35537b66e9ddde845de58f9e4b25ea84325ee32a0efc76d9b0d
SSDEEP 196608:PZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnPsREJLODBWlX3d+NpvdHIol
TLSH
T137B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kulkkzbqed.exe

Path C:\Users\Admin\AppData\Local\Temp\kulkkzbqed.exe
Size 10.6MB
SHA256 b23d10612b30d952528d12e5e77b0a7ead0813742db151f7029a6bbbf247af7c
MD5 13e56b9072cd8258c38ad44c9c7b96de
SHA1 992d5de659018437405beab01b1a94e8d612a9b9
SHA512 2f87aa58d18c3f581607bbffc04f5b58b904076fd7481b951640d1f915a888fc71d5f9ebd7974925d69032cfbe575394f43ec1abbb1048df2fb0281c32a95088
SSDEEP 196608:PZGmumsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnmsREJLODBWlX3d+NpvdHIol
TLSH
T1DCB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

llvqscbozh.exe

Path C:\Users\Admin\AppData\Local\Temp\llvqscbozh.exe
Size 10.6MB
SHA256 46404e5e02f3e7bce541221328d55f3e9e460ea006a4ccf1e56653c91da7230e
MD5 c64480668205088492b791fe86fd9a59
SHA1 78cba59b309635aba21dfb22b0d49c1944722d8f
SHA512 bd4dfcbf696bec99cc91bd756517c4577c89bbfa624e3466c20d24d9d98e7d02ad59a74f955b2e122af2425157b46d0de5b056b381f7ac4320da76e6294d8597
SSDEEP 196608:PZGmuxsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnxsREJLODBWlX3d+NpvdHIol
TLSH
T1AEB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjfqbmsxco.exe

Path C:\Users\Admin\AppData\Local\Temp\mjfqbmsxco.exe
Size 10.6MB
SHA256 d217b7992bc8594a4ba858548ce25bc3dc6d9c4a2a205a49aa2b8dabd6c9cd65
MD5 798d6e32998410b0278f4f172fcf3b27
SHA1 248d765175bc7e7265a27591005ebf90f8715526
SHA512 9e63a2a02c83b52a0218ddb68a2b7d524ee310e04f47546059e4dd6548246092380ae2a0a9df079b8b8a9379d214e2a30ecf919c91ca8265ac52aa392eab0544
SSDEEP 196608:PZGmuEsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnEsREJLODBWlX3d+NpvdHIol
TLSH
T178B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oyvqidhcen.exe

Path C:\Users\Admin\AppData\Local\Temp\oyvqidhcen.exe
Size 10.6MB
SHA256 261c0f147e25ba888ddc0c4069c1c1540f4dd4c2590bfe02c4415ca7fd3fd95a
MD5 f8a06f75d512b259fcac73c62db49980
SHA1 6de2d818257dff2f7adbc82552fcd65113d57327
SHA512 ddfa66e28e3d80a21337e5a3c32a546a2a141fccac99216ff402844d7654a55c8355a547786e6cca9ed0ce4f06af751177a3c5e8c2ccc8b0852fc9eff98c2737
SSDEEP 196608:PZGmuFsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnFsREJLODBWlX3d+NpvdHIol
TLSH
T10EB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgkweaqqtk.exe

Path C:\Users\Admin\AppData\Local\Temp\sgkweaqqtk.exe
Size 10.6MB
SHA256 3a754da07c89e1726bdf5a449531154228591af7061c71fdb0369be2b64ca13d
MD5 b6ceeea0b00c718158e6d0e2cec0805c
SHA1 315a22880bc13ba772b7ef184830af79739c80c0
SHA512 ccf4cbab84ac87622b25cc0dc15c9006a65e61f457b26fb5d3530dfa4fedb8fab51c0f5972cb9815f9c6184c5cb602e5039b0dcc01b06a296490fa004102270c
SSDEEP 196608:PZGmuksR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnksREJLODBWlX3d+NpvdHIol
TLSH
T155B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uhqledsqiz.exe

Path C:\Users\Admin\AppData\Local\Temp\uhqledsqiz.exe
Size 10.6MB
SHA256 f84a02a4fb8bed40bc3ef220ae5bafcd038821742589a098c3acfc97752d5f91
MD5 bdbc90ebd89a5d6d97587652df45dab2
SHA1 bd77508e8348bdb71175fe682c8acbc56a24f43b
SHA512 e18f30b7794265a7b06cf2a05684108b01c6910d59bed640c03f9eacb55da34b260682c808e89268706f92f116d959881899ccc6e83f97d591beaf6289a5e7bf
SSDEEP 196608:PZGmuvsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnvsREJLODBWlX3d+NpvdHIol
TLSH
T148B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujctchpkto.exe

Path C:\Users\Admin\AppData\Local\Temp\ujctchpkto.exe
Size 10.6MB
SHA256 f728adf2065be0b07b1b117e6064ce60f1156af9305df5319c29b6060baaebb8
MD5 39f0544e2eeeceba793071da82715bb7
SHA1 c1bb53ffb2a1d7b3cc9dfa29d2692e4e42b66811
SHA512 f90f83f39eed4c52cb912762ebeb12b28376da263df53bb1bdcca8027246a91fbba9fafdfce6d8a9389bff5afc8f959f8a33ed0bc5b4a82852a4b56b923054a0
SSDEEP 196608:PZGmuisR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnisREJLODBWlX3d+NpvdHIol
TLSH
T1F8B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujpxdyupqw.exe

Path C:\Users\Admin\AppData\Local\Temp\ujpxdyupqw.exe
Size 10.6MB
SHA256 3fdb2bb4b8499b5109bd59302bc856dad567a832c0aa1ac00a5734f6dcd516de
MD5 6d4909dcf9198deeca7affcf6c63a254
SHA1 765268b8122385f5222383cc6bfb05d4ca0c3f89
SHA512 059dd4fa304c35368938e90205142345851d9379f1b1a51d942f5356b3d77876bba7b3b0c25cb8b10039e4de7a2d56a58e37aaec3b24b9fc38f5057b1bbd8c70
SSDEEP 196608:PZGmuGsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnGsREJLODBWlX3d+NpvdHIol
TLSH
T141B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 1cb72bcca9af2078e5322a44900fcb982d9d9deec203fb2a6b1a79d1da676a48
MD5 253b0bd0d4ad23ec1d2e96c5f157f87e
SHA1 15bd0a08170fe2a5817e4db96d2143f6effa52c5
SHA512 8e4f8946932860226e9879c58426ec3c247aff0e0c75098d14df429b607f6360561fd96b0f3e1563dde1e888c70bfe75b1a6af4332c22355ecf10b86930f1b61
SSDEEP 196608:PZGmuGsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnGsREJLODBWlX3d+NpvdHIol
TLSH
T119B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 16038b1ed3f1f87f4ec55af4d15449e41424b5620df96e85ec5aa1261aaf5225
MD5 dcdcc5a445a2bee9fbbe83cf3c284f0c
SHA1 3f051e61fa1659c2e4eb1c48859a5076128e2ace
SHA512 08accc5fca25cbb56c30c67a596872626aa85eebb6c15a08497855fd63adbd1ac860a8b3c6fb303cdb8e7b92d5caf354ad9f0de4c22bee9b59e40b2384927ad3
SSDEEP 196608:PZGmulsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnlsREJLODBWlX3d+NpvdHIol
TLSH
T10FB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 3a2ca9fdb7ee610acfc7080458010da00ca7f1d565fda2c7bdde569418a99673
MD5 71e8f1cac9007c6c1e644322ffb23e70
SHA1 f47bbf8097a3d1c3abc4745bd6bfc9fc1ccbad54
SHA512 58a36b5035fb55e9faec7311fd6ab02e3cf136cd847c1c91f1bebaff2f545ee6c5279e70c727909e1240ecb31055f3357bd542dead54867312db51bfd509f546
SSDEEP 196608:PZGmuYsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnYsREJLODBWlX3d+NpvdHIol
TLSH
T1D5B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 23c0b57e4a212c3abbf73a549acf4fb9ba371346fa9d06ad5b02dc7aa22a8bab
MD5 e61e46c7e89b319acead5375ae56bcef
SHA1 accb8db5919f756dc8cd2f945a6f5e22447f33f5
SHA512 feb40c88ab99e599081d86777d999129a87ef39853aa761273a22ddc18189f70ea0a31672499f515dc4dd45536ffc28fb0a9735d69cd480e6d3515ab1ea44cd5
SSDEEP 196608:PZGmuUsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnUsREJLODBWlX3d+NpvdHIol
TLSH
T122B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 404236db88e517d8272ec25aeda506acaaefd260dc23e3fa4be4f0c5ffae37ab
MD5 a4b4de7c10888e0a95de8f3ef1f96249
SHA1 dd1d71dbf28d61c65f33959fd8a28fab0ed6a76b
SHA512 8b149e90f825a19e25677685b2d075261db56ee9017d5e37d3955083dfacaa30c2ef58f2173f7dcfe23ac99a4235829f2e23aba35cadb7ee6880cc555ef136d0
SSDEEP 196608:PZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGngsREJLODBWlX3d+NpvdHIol
TLSH
T13FB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 9fe1373e81993ee0d4076a8d99ba8f25167c7ef903507f04f35c7e751703cd5c
MD5 b5770b151d84bd6b0f1ab20025eb64dd
SHA1 56d8df388445d8bcf6848c67a09548bfe3f4952c
SHA512 ae24966be9c47e31b13aa5282ce8a77589e96cc9d7e708602aed357c155d9b1121cf336b1eba89d2fe9a30264424ad6a676448d557d7092dc8aa63e622b2b7dd
SSDEEP 196608:PZGmubsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnbsREJLODBWlX3d+NpvdHIol
TLSH
T13CB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xapvjrxlce.exe

Path C:\Users\Admin\AppData\Local\Temp\xapvjrxlce.exe
Size 10.6MB
SHA256 2043dbf334769fb876a446b9743ef7c40e30c957259045f8d0bf65cbbd56624d
MD5 7e5c7ad64c1803af3a99a39408aa2780
SHA1 a9be949c4ba9b5de757a83086ac009d14f92e2b8
SHA512 d28b9716fe5c624188c900d65f7bb02c0aa3c40588c62cc343f2c866b9aafee34bb3c1e84aa0fa84099cf4b170f1869daa90625036490a5ce0bae83045369376
SSDEEP 196608:PZGmuisR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnisREJLODBWlX3d+NpvdHIol
TLSH
T18FB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yeyaclwkmo.exe

Path C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe
Size 10.6MB
SHA256 5499b5d518c4d5b6241cbb645678ce9be694abf585b98145235af6ed6c7ea993
MD5 04ed76c653e587ecf5eaabe25f2fc1c7
SHA1 a3ad1ba8e6e23afb3aeaca42b1545d75cbdce92c
SHA512 23dd7ab7eb01def10daf7c6c23ba7b6668eae2489434d13ad089492a2853b1f9035bf5874f3dff377a6c2837d2f779439072ab3efff9064411af36c15841459a
SSDEEP 196608:PZGmu9sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn9sREJLODBWlX3d+NpvdHIol
TLSH
T19DB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yngzuwtjms.exe

Path C:\Users\Admin\AppData\Local\Temp\yngzuwtjms.exe
Size 10.6MB
SHA256 e776eb1cef2c44207b481cb54e6a6c82431eae4bcef803efc59fe667c0406008
MD5 e621404b7c67d705b278c89c36aa1430
SHA1 fdc4be0f832e6240555f0cd09f4d403621cf3a1b
SHA512 6648145351ab1921fa171732cf14692f5a3682aa081bbad66d3cde716e83068aa5cf0b83816c54bc68c9ccfebe75de543b135796ce0eb7d4140cee8e521a13e6
SSDEEP 196608:PZGmuNsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnNsREJLODBWlX3d+NpvdHIol
TLSH
T10AB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yzzkzwmycx.exe

Path C:\Users\Admin\AppData\Local\Temp\yzzkzwmycx.exe
Size 10.6MB
SHA256 ab2384063f010f10116438ac68409d849340aae40e5c284ad5eb2ef65a26e024
MD5 23e8d0bacf2c90bf6cddae24f7f08e39
SHA1 f450d2c6573937174430fb137ecf67749364d99c
SHA512 407d4310ed93c2313f60f2464e1d2c3e513ca79b5b42398f8b86a92ef7490f78a6730d6fd260a69ad630220fe9d64065516a155f3845fbc840d34086cf9be6c1
SSDEEP 196608:PZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnPsREJLODBWlX3d+NpvdHIol
TLSH
T1F5B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zeaoxwfgza.exe

Path C:\Users\Admin\AppData\Local\Temp\zeaoxwfgza.exe
Size 10.6MB
SHA256 caa8f08deb444071a3e49818c96777969ab1def4c6a5c6045f9b74b6eb73a2e1
MD5 fce69a8ded7687669ac71be50f1ea3da
SHA1 8e6726d2c6d0039da3263c6a407a6787560fb6db
SHA512 99dc868b25f7af76531947ee0855f3e36cf89bf3f17a7f1088de80919bf4b5bad5a387f55490a4a50d20c6de668e35028c226af204286c07a97b4972db434911
SSDEEP 196608:PZGmufsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnfsREJLODBWlX3d+NpvdHIol
TLSH
T181B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zzuapeevan.exe

Path C:\Users\Admin\AppData\Local\Temp\zzuapeevan.exe
Size 10.6MB
SHA256 158f292f31a12b58dce8b6d1047270e86b18738c7c685a562c4cb70e6a294b85
MD5 cee97d9b093778b2c6f9ad4b614835e6
SHA1 2dc33e8e499147fbfb6fbdadd29240d53d2dfda5
SHA512 4924e22fcd31f31702cb6eeef36d0c52120cf3dcf02cd41a83c662b860b3e5ddd76f8e2e854e44db34774c7aceda19918371e373d69051fca861a31f352b9cf3
SSDEEP 196608:PZGmuSsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnSsREJLODBWlX3d+NpvdHIol
TLSH
T10FB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-59-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/244-58-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/880-84-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/880-85-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1124-50-0x0000000002C20000-0x0000000002C21000-memory.dmp

Download

memory/1124-51-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1216-96-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1292-180-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1296-54-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1932-139-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2152-150-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2728-62-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2916-7-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/2916-8-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2960-70-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2968-129-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2968-128-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3000-93-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3096-178-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3112-165-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3284-67-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3464-190-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3728-142-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3732-155-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3856-147-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3892-119-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3892-118-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download

memory/3984-32-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3984-31-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4112-0-0x0000000002C00000-0x0000000002C01000-memory.dmp

Download

memory/4112-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4168-168-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4196-183-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4240-10-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/4240-11-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4272-174-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4280-78-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4312-158-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4400-46-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4612-132-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4612-131-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/4640-172-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4736-188-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4800-185-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4904-122-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4912-24-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4912-23-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/4964-43-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5012-3-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5132-103-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/5132-104-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5136-101-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5344-75-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5404-27-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5544-111-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5692-15-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/5692-16-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5696-37-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/5696-38-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5904-19-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5904-18-0x0000000001220000-0x0000000001221000-memory.dmp

Download

memory/5960-114-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6140-88-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6140-87-0x0000000001000000-0x0000000001001000-memory.dmp

Download