3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b

Analysis

max time kernel
90s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
Size 10.4MB
Sample260724-jb2wcstyey
SHA256 3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b
MD5 9a61403519540873c107e03fff990c7e
SHA1 210e04a12fbd099797ffb5b0fd5767693f8d9d1c
SHA512 f75173070da502dd7433ff8b9194e65f663dcc2f3ab5a6e1bd1594221194d0be5b2fbbf7445c429653a984b66043dfcd8ed7c188ff8b3e0cff0ead4b3da512f7
SSDEEP 196608:XZGmuHsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnHsREJLODBWlX3d+NpvdHIom
TLSH
T135B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 61 IoCs

pid	Process
2552	ajwfsprkya.exe
1504	ajwfsprkya.exe
3032	vihosqcffx.exe
2116	vihosqcffx.exe
3012	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
3620	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
4132	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
4860	zeqntzahhw.exe
3828	zeqntzahhw.exe
3004	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
1956	edrxwlugax.exe
4960	edrxwlugax.exe
1084	pagwuuvmug.exe
3848	pagwuuvmug.exe
3756	jvuflzhjta.exe
3804	jvuflzhjta.exe
1984	omoukaqdjt.exe
1948	omoukaqdjt.exe
1624	bxemymfozv.exe
4856	bxemymfozv.exe
2576	qyzeziltzp.exe
2456	qyzeziltzp.exe
1744	daixkpcdpw.exe
3892	daixkpcdpw.exe
3140	xltybnxbam.exe
3324	xltybnxbam.exe
2384	iourzjonsm.exe
1952	iourzjonsm.exe
4768	qhfnzfpzkq.exe
2652	qhfnzfpzkq.exe
4528	iacbbmlmqm.exe
2908	iacbbmlmqm.exe
2236	dzfxiymldb.exe
4868	dzfxiymldb.exe
1644	nzvlkfiybx.exe
2664	nzvlkfiybx.exe
4988	qoucwcpzjj.exe
2812	qoucwcpzjj.exe
4116	pofautwmvt.exe
4412	pofautwmvt.exe
4808	cxvehiwcif.exe
3768	cxvehiwcif.exe
2356	htytddkcix.exe
1688	htytddkcix.exe
3896	kpwruehmcw.exe
2004	kpwruehmcw.exe
4164	hueaeochaw.exe
4172	hueaeochaw.exe
2864	sfggnsztnm.exe
4396	sfggnsztnm.exe
2620	upqcqaqjic.exe
3844	upqcqaqjic.exe
208	wasdaydisk.exe
4628	wasdaydisk.exe
5060	rhmjupxhww.exe
3792	rhmjupxhww.exe
3772	bgjkdirhhd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 63 IoCs

pid	Process
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3880	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
2552	ajwfsprkya.exe
1504	ajwfsprkya.exe
3032	vihosqcffx.exe
2116	vihosqcffx.exe
3012	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
3620	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
4132	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
4860	zeqntzahhw.exe
3828	zeqntzahhw.exe
3004	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
1956	edrxwlugax.exe
4960	edrxwlugax.exe
1084	pagwuuvmug.exe
3848	pagwuuvmug.exe
3756	jvuflzhjta.exe
3804	jvuflzhjta.exe
1984	omoukaqdjt.exe
1948	omoukaqdjt.exe
1624	bxemymfozv.exe
4856	bxemymfozv.exe
2576	qyzeziltzp.exe
2456	qyzeziltzp.exe
1744	daixkpcdpw.exe
3892	daixkpcdpw.exe
3140	xltybnxbam.exe
3324	xltybnxbam.exe
2384	iourzjonsm.exe
1952	iourzjonsm.exe
4768	qhfnzfpzkq.exe
2652	qhfnzfpzkq.exe
4528	iacbbmlmqm.exe
2908	iacbbmlmqm.exe
2236	dzfxiymldb.exe
4868	dzfxiymldb.exe
1644	nzvlkfiybx.exe
2664	nzvlkfiybx.exe
4988	qoucwcpzjj.exe
2812	qoucwcpzjj.exe
4116	pofautwmvt.exe
4412	pofautwmvt.exe
4808	cxvehiwcif.exe
3768	cxvehiwcif.exe
2356	htytddkcix.exe
1688	htytddkcix.exe
3896	kpwruehmcw.exe
2004	kpwruehmcw.exe
4164	hueaeochaw.exe
4172	hueaeochaw.exe
2864	sfggnsztnm.exe
4396	sfggnsztnm.exe
2620	upqcqaqjic.exe
3844	upqcqaqjic.exe
208	wasdaydisk.exe
4628	wasdaydisk.exe
5060	rhmjupxhww.exe
3792	rhmjupxhww.exe
3772	bgjkdirhhd.exe

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahxzwbzkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upqcqaqjic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhmjupxhww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvehiwcif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	htytddkcix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iourzjonsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iacbbmlmqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyzeziltzp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iourzjonsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhfnzfpzkq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzvlkfiybx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pofautwmvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyzeziltzp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iacbbmlmqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpwruehmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxdoynvqtw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vihosqcffx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wasdaydisk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pagwuuvmug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daixkpcdpw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wasdaydisk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahjyvcvexg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeqntzahhw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxdoynvqtw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edrxwlugax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edrxwlugax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoucwcpzjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pofautwmvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hueaeochaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeqntzahhw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pagwuuvmug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jvuflzhjta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xltybnxbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzfxiymldb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upqcqaqjic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgjkdirhhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vihosqcffx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jvuflzhjta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bxemymfozv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzfxiymldb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoucwcpzjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	htytddkcix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfggnsztnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ajwfsprkya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahjyvcvexg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmshqfvmvv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xltybnxbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhfnzfpzkq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omoukaqdjt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvehiwcif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhmjupxhww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ajwfsprkya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omoukaqdjt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daixkpcdpw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzvlkfiybx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfggnsztnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bxemymfozv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpwruehmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hueaeochaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahxzwbzkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmshqfvmvv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3880	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3880	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
2552	ajwfsprkya.exe
2552	ajwfsprkya.exe
2552	ajwfsprkya.exe
2552	ajwfsprkya.exe
1504	ajwfsprkya.exe
1504	ajwfsprkya.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3032	vihosqcffx.exe
3032	vihosqcffx.exe
3032	vihosqcffx.exe
3032	vihosqcffx.exe
2552	ajwfsprkya.exe
2552	ajwfsprkya.exe
2116	vihosqcffx.exe
2116	vihosqcffx.exe
3012	ahjyvcvexg.exe
3012	ahjyvcvexg.exe
3012	ahjyvcvexg.exe
3012	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
3620	pmshqfvmvv.exe
3620	pmshqfvmvv.exe
3620	pmshqfvmvv.exe
3620	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
3032	vihosqcffx.exe
3032	vihosqcffx.exe
3012	ahjyvcvexg.exe
3012	ahjyvcvexg.exe
4132	sahxzwbzkg.exe
4132	sahxzwbzkg.exe
4132	sahxzwbzkg.exe
4132	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
3620	pmshqfvmvv.exe
3620	pmshqfvmvv.exe
4860	zeqntzahhw.exe
4860	zeqntzahhw.exe
4860	zeqntzahhw.exe
4860	zeqntzahhw.exe
3828	zeqntzahhw.exe
3828	zeqntzahhw.exe
4132	sahxzwbzkg.exe
4132	sahxzwbzkg.exe
3004	zxdoynvqtw.exe
3004	zxdoynvqtw.exe
3004	zxdoynvqtw.exe
3004	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
4860	zeqntzahhw.exe
4860	zeqntzahhw.exe
1956	edrxwlugax.exe
1956	edrxwlugax.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3880	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
3880	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
2552	ajwfsprkya.exe
2552	ajwfsprkya.exe
1504	ajwfsprkya.exe
1504	ajwfsprkya.exe
3032	vihosqcffx.exe
3032	vihosqcffx.exe
2116	vihosqcffx.exe
2116	vihosqcffx.exe
3012	ahjyvcvexg.exe
3012	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
4972	ahjyvcvexg.exe
3620	pmshqfvmvv.exe
3620	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
4116	pmshqfvmvv.exe
4132	sahxzwbzkg.exe
4132	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
4540	sahxzwbzkg.exe
4860	zeqntzahhw.exe
4860	zeqntzahhw.exe
3828	zeqntzahhw.exe
3828	zeqntzahhw.exe
3004	zxdoynvqtw.exe
3004	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
4356	zxdoynvqtw.exe
1956	edrxwlugax.exe
1956	edrxwlugax.exe
4960	edrxwlugax.exe
4960	edrxwlugax.exe
1084	pagwuuvmug.exe
1084	pagwuuvmug.exe
3848	pagwuuvmug.exe
3848	pagwuuvmug.exe
3756	jvuflzhjta.exe
3756	jvuflzhjta.exe
3804	jvuflzhjta.exe
3804	jvuflzhjta.exe
1984	omoukaqdjt.exe
1984	omoukaqdjt.exe
1948	omoukaqdjt.exe
1948	omoukaqdjt.exe
1624	bxemymfozv.exe
1624	bxemymfozv.exe
4856	bxemymfozv.exe
4856	bxemymfozv.exe
2576	qyzeziltzp.exe
2576	qyzeziltzp.exe
2456	qyzeziltzp.exe
2456	qyzeziltzp.exe
1744	daixkpcdpw.exe
1744	daixkpcdpw.exe
3892	daixkpcdpw.exe
3892	daixkpcdpw.exe
3140	xltybnxbam.exe
3140	xltybnxbam.exe
3324	xltybnxbam.exe
3324	xltybnxbam.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3880	4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe	84
PID 4184 wrote to memory of 2552	4184	3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe	85
PID 2552 wrote to memory of 1504	2552	ajwfsprkya.exe	86
PID 2552 wrote to memory of 3032	2552	ajwfsprkya.exe	88
PID 3032 wrote to memory of 2116	3032	vihosqcffx.exe	89
PID 3032 wrote to memory of 3012	3032	vihosqcffx.exe	90
PID 3012 wrote to memory of 4972	3012	ahjyvcvexg.exe	91
PID 3012 wrote to memory of 3620	3012	ahjyvcvexg.exe	92
PID 3620 wrote to memory of 4116	3620	pmshqfvmvv.exe	93
PID 3620 wrote to memory of 4132	3620	pmshqfvmvv.exe	94
PID 4132 wrote to memory of 4540	4132	sahxzwbzkg.exe	95
PID 4132 wrote to memory of 4860	4132	sahxzwbzkg.exe	96
PID 4860 wrote to memory of 3828	4860	zeqntzahhw.exe	97
PID 4860 wrote to memory of 3004	4860	zeqntzahhw.exe	98
PID 3004 wrote to memory of 4356	3004	zxdoynvqtw.exe	99
PID 3004 wrote to memory of 1956	3004	zxdoynvqtw.exe	100
PID 1956 wrote to memory of 4960	1956	edrxwlugax.exe	101
PID 1956 wrote to memory of 1084	1956	edrxwlugax.exe	102
PID 1084 wrote to memory of 3848	1084	pagwuuvmug.exe	103
PID 1084 wrote to memory of 3756	1084	pagwuuvmug.exe	104
PID 3756 wrote to memory of 3804	3756	jvuflzhjta.exe	105
PID 3756 wrote to memory of 1984	3756	jvuflzhjta.exe	106
PID 1984 wrote to memory of 1948	1984	omoukaqdjt.exe	107
PID 1984 wrote to memory of 1624	1984	omoukaqdjt.exe	111
PID 1624 wrote to memory of 4856	1624	bxemymfozv.exe	154
PID 1624 wrote to memory of 2576	1624	bxemymfozv.exe	113
PID 2576 wrote to memory of 2456	2576	qyzeziltzp.exe	114
PID 2576 wrote to memory of 1744	2576	qyzeziltzp.exe	115
PID 1744 wrote to memory of 3892	1744	daixkpcdpw.exe	116
PID 1744 wrote to memory of 3140	1744	daixkpcdpw.exe	117
PID 3140 wrote to memory of 3324	3140	xltybnxbam.exe	118
PID 3140 wrote to memory of 2384	3140	xltybnxbam.exe	119
PID 2384 wrote to memory of 1952	2384	iourzjonsm.exe	120
PID 2384 wrote to memory of 4768	2384	iourzjonsm.exe	121
PID 4768 wrote to memory of 2652	4768	qhfnzfpzkq.exe	122
PID 4768 wrote to memory of 4528	4768	qhfnzfpzkq.exe	123
PID 4528 wrote to memory of 2908	4528	iacbbmlmqm.exe	124
PID 4528 wrote to memory of 2236	4528	iacbbmlmqm.exe	125
PID 2236 wrote to memory of 4868	2236	dzfxiymldb.exe	166
PID 2236 wrote to memory of 1644	2236	dzfxiymldb.exe	127
PID 1644 wrote to memory of 2664	1644	nzvlkfiybx.exe	168
PID 1644 wrote to memory of 4988	1644	nzvlkfiybx.exe	129
PID 4988 wrote to memory of 2812	4988	qoucwcpzjj.exe	169
PID 4988 wrote to memory of 4116	4988	qoucwcpzjj.exe	131
PID 4116 wrote to memory of 4412	4116	pofautwmvt.exe	132
PID 4116 wrote to memory of 4808	4116	pofautwmvt.exe	133
PID 4808 wrote to memory of 3768	4808	cxvehiwcif.exe	134
PID 4808 wrote to memory of 2356	4808	cxvehiwcif.exe	135
PID 2356 wrote to memory of 1688	2356	htytddkcix.exe	136
PID 2356 wrote to memory of 3896	2356	htytddkcix.exe	137
PID 3896 wrote to memory of 2004	3896	kpwruehmcw.exe	138
PID 3896 wrote to memory of 4164	3896	kpwruehmcw.exe	139
PID 4164 wrote to memory of 4172	4164	hueaeochaw.exe	182
PID 4164 wrote to memory of 2864	4164	hueaeochaw.exe	141
PID 2864 wrote to memory of 4396	2864	sfggnsztnm.exe	142
PID 2864 wrote to memory of 2620	2864	sfggnsztnm.exe	143
PID 2620 wrote to memory of 3844	2620	upqcqaqjic.exe	144
PID 2620 wrote to memory of 208	2620	upqcqaqjic.exe	145
PID 208 wrote to memory of 4628	208	wasdaydisk.exe	146
PID 208 wrote to memory of 5060	208	wasdaydisk.exe	147
PID 5060 wrote to memory of 3792	5060	rhmjupxhww.exe	148
PID 5060 wrote to memory of 3772	5060	rhmjupxhww.exe	149

C:\Users\Admin\AppData\Local\Temp\3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
"C:\Users\Admin\AppData\Local\Temp\3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe
  C:\Users\Admin\AppData\Local\Temp\3700d3f7e5df45e14c33fa3b47a5324989dc9df9bbb31604ab70c3e184feef2b.exe update ajwfsprkya.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\ajwfsprkya.exe
  C:\Users\Admin\AppData\Local\Temp\ajwfsprkya.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\ajwfsprkya.exe
    C:\Users\Admin\AppData\Local\Temp\ajwfsprkya.exe update vihosqcffx.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\vihosqcffx.exe
    C:\Users\Admin\AppData\Local\Temp\vihosqcffx.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\vihosqcffx.exe
      C:\Users\Admin\AppData\Local\Temp\vihosqcffx.exe update ahjyvcvexg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\ahjyvcvexg.exe
      C:\Users\Admin\AppData\Local\Temp\ahjyvcvexg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\ahjyvcvexg.exe
        
        C:\Users\Admin\AppData\Local\Temp\ahjyvcvexg.exe update pmshqfvmvv.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\pmshqfvmvv.exe
        
        C:\Users\Admin\AppData\Local\Temp\pmshqfvmvv.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\pmshqfvmvv.exe
        
        C:\Users\Admin\AppData\Local\Temp\pmshqfvmvv.exe update sahxzwbzkg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\sahxzwbzkg.exe
        
        C:\Users\Admin\AppData\Local\Temp\sahxzwbzkg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\sahxzwbzkg.exe
        
        C:\Users\Admin\AppData\Local\Temp\sahxzwbzkg.exe update zeqntzahhw.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\zeqntzahhw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zeqntzahhw.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\zeqntzahhw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zeqntzahhw.exe update zxdoynvqtw.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\zxdoynvqtw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zxdoynvqtw.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\zxdoynvqtw.exe
        
        C:\Users\Admin\AppData\Local\Temp\zxdoynvqtw.exe update edrxwlugax.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\edrxwlugax.exe
        
        C:\Users\Admin\AppData\Local\Temp\edrxwlugax.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\edrxwlugax.exe
        
        C:\Users\Admin\AppData\Local\Temp\edrxwlugax.exe update pagwuuvmug.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\pagwuuvmug.exe
        
        C:\Users\Admin\AppData\Local\Temp\pagwuuvmug.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\pagwuuvmug.exe
        
        C:\Users\Admin\AppData\Local\Temp\pagwuuvmug.exe update jvuflzhjta.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\jvuflzhjta.exe
        
        C:\Users\Admin\AppData\Local\Temp\jvuflzhjta.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\jvuflzhjta.exe
        
        C:\Users\Admin\AppData\Local\Temp\jvuflzhjta.exe update omoukaqdjt.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\omoukaqdjt.exe
        
        C:\Users\Admin\AppData\Local\Temp\omoukaqdjt.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\omoukaqdjt.exe
        
        C:\Users\Admin\AppData\Local\Temp\omoukaqdjt.exe update bxemymfozv.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\bxemymfozv.exe
        
        C:\Users\Admin\AppData\Local\Temp\bxemymfozv.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\bxemymfozv.exe
        
        C:\Users\Admin\AppData\Local\Temp\bxemymfozv.exe update qyzeziltzp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe
        
        C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe
        
        C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe update daixkpcdpw.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\daixkpcdpw.exe
        
        C:\Users\Admin\AppData\Local\Temp\daixkpcdpw.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\daixkpcdpw.exe
        
        C:\Users\Admin\AppData\Local\Temp\daixkpcdpw.exe update xltybnxbam.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\xltybnxbam.exe
        
        C:\Users\Admin\AppData\Local\Temp\xltybnxbam.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\xltybnxbam.exe
        
        C:\Users\Admin\AppData\Local\Temp\xltybnxbam.exe update iourzjonsm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\iourzjonsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iourzjonsm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\iourzjonsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iourzjonsm.exe update qhfnzfpzkq.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\qhfnzfpzkq.exe
        
        C:\Users\Admin\AppData\Local\Temp\qhfnzfpzkq.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\qhfnzfpzkq.exe
        
        C:\Users\Admin\AppData\Local\Temp\qhfnzfpzkq.exe update iacbbmlmqm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\iacbbmlmqm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iacbbmlmqm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\iacbbmlmqm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iacbbmlmqm.exe update dzfxiymldb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe
        
        C:\Users\Admin\AppData\Local\Temp\dzfxiymldb.exe update nzvlkfiybx.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe update qoucwcpzjj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\qoucwcpzjj.exe
        
        C:\Users\Admin\AppData\Local\Temp\qoucwcpzjj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\qoucwcpzjj.exe
        
        C:\Users\Admin\AppData\Local\Temp\qoucwcpzjj.exe update pofautwmvt.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\pofautwmvt.exe
        
        C:\Users\Admin\AppData\Local\Temp\pofautwmvt.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\pofautwmvt.exe
        
        C:\Users\Admin\AppData\Local\Temp\pofautwmvt.exe update cxvehiwcif.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\cxvehiwcif.exe
        
        C:\Users\Admin\AppData\Local\Temp\cxvehiwcif.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\cxvehiwcif.exe
        
        C:\Users\Admin\AppData\Local\Temp\cxvehiwcif.exe update htytddkcix.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\htytddkcix.exe
        
        C:\Users\Admin\AppData\Local\Temp\htytddkcix.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\htytddkcix.exe
        
        C:\Users\Admin\AppData\Local\Temp\htytddkcix.exe update kpwruehmcw.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\kpwruehmcw.exe
        
        C:\Users\Admin\AppData\Local\Temp\kpwruehmcw.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\kpwruehmcw.exe
        
        C:\Users\Admin\AppData\Local\Temp\kpwruehmcw.exe update hueaeochaw.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\hueaeochaw.exe
        
        C:\Users\Admin\AppData\Local\Temp\hueaeochaw.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\hueaeochaw.exe
        
        C:\Users\Admin\AppData\Local\Temp\hueaeochaw.exe update sfggnsztnm.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\sfggnsztnm.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfggnsztnm.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\sfggnsztnm.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfggnsztnm.exe update upqcqaqjic.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\upqcqaqjic.exe
        
        C:\Users\Admin\AppData\Local\Temp\upqcqaqjic.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\upqcqaqjic.exe
        
        C:\Users\Admin\AppData\Local\Temp\upqcqaqjic.exe update wasdaydisk.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\wasdaydisk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wasdaydisk.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\wasdaydisk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wasdaydisk.exe update rhmjupxhww.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\rhmjupxhww.exe
        
        C:\Users\Admin\AppData\Local\Temp\rhmjupxhww.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\rhmjupxhww.exe
        
        C:\Users\Admin\AppData\Local\Temp\rhmjupxhww.exe update bgjkdirhhd.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\bgjkdirhhd.exe
        
        C:\Users\Admin\AppData\Local\Temp\bgjkdirhhd.exe
        32⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\bgjkdirhhd.exe
        
        C:\Users\Admin\AppData\Local\Temp\bgjkdirhhd.exe update zthitfltrq.exe
        33⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\zthitfltrq.exe
        
        C:\Users\Admin\AppData\Local\Temp\zthitfltrq.exe
        33⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\zthitfltrq.exe
        
        C:\Users\Admin\AppData\Local\Temp\zthitfltrq.exe update jwqbxqgaks.exe
        34⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\jwqbxqgaks.exe
        
        C:\Users\Admin\AppData\Local\Temp\jwqbxqgaks.exe
        34⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\jwqbxqgaks.exe
        
        C:\Users\Admin\AppData\Local\Temp\jwqbxqgaks.exe update onyztzeluw.exe
        35⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\onyztzeluw.exe
        
        C:\Users\Admin\AppData\Local\Temp\onyztzeluw.exe
        35⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\onyztzeluw.exe
        
        C:\Users\Admin\AppData\Local\Temp\onyztzeluw.exe update uegtxuqosn.exe
        36⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\uegtxuqosn.exe
        
        C:\Users\Admin\AppData\Local\Temp\uegtxuqosn.exe
        36⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\uegtxuqosn.exe
        
        C:\Users\Admin\AppData\Local\Temp\uegtxuqosn.exe update zgijzgltjd.exe
        37⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\zgijzgltjd.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgijzgltjd.exe
        37⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\zgijzgltjd.exe
        
        C:\Users\Admin\AppData\Local\Temp\zgijzgltjd.exe update exrmgvhnon.exe
        38⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\exrmgvhnon.exe
        
        C:\Users\Admin\AppData\Local\Temp\exrmgvhnon.exe
        38⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\exrmgvhnon.exe
        
        C:\Users\Admin\AppData\Local\Temp\exrmgvhnon.exe update lqgomgpjhz.exe
        39⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\lqgomgpjhz.exe
        
        C:\Users\Admin\AppData\Local\Temp\lqgomgpjhz.exe
        39⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\lqgomgpjhz.exe
        
        C:\Users\Admin\AppData\Local\Temp\lqgomgpjhz.exe update tcthrwxviv.exe
        40⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\tcthrwxviv.exe
        
        C:\Users\Admin\AppData\Local\Temp\tcthrwxviv.exe
        40⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\tcthrwxviv.exe
        
        C:\Users\Admin\AppData\Local\Temp\tcthrwxviv.exe update wfhiddextl.exe
        41⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\wfhiddextl.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfhiddextl.exe
        41⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\wfhiddextl.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfhiddextl.exe update iszliegxqm.exe
        42⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\iszliegxqm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iszliegxqm.exe
        42⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\iszliegxqm.exe
        
        C:\Users\Admin\AppData\Local\Temp\iszliegxqm.exe update iiiuqhemvt.exe
        43⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\iiiuqhemvt.exe
        
        C:\Users\Admin\AppData\Local\Temp\iiiuqhemvt.exe
        43⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\iiiuqhemvt.exe
        
        C:\Users\Admin\AppData\Local\Temp\iiiuqhemvt.exe update quqszxldew.exe
        44⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\quqszxldew.exe
        
        C:\Users\Admin\AppData\Local\Temp\quqszxldew.exe
        44⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\quqszxldew.exe
        
        C:\Users\Admin\AppData\Local\Temp\quqszxldew.exe update qgfwmdcxpy.exe
        45⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\qgfwmdcxpy.exe
        
        C:\Users\Admin\AppData\Local\Temp\qgfwmdcxpy.exe
        45⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\qgfwmdcxpy.exe
        
        C:\Users\Admin\AppData\Local\Temp\qgfwmdcxpy.exe update nzjmzabgge.exe
        46⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        46⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe
        
        C:\Users\Admin\AppData\Local\Temp\nzjmzabgge.exe update npjuqkrult.exe
        47⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\npjuqkrult.exe
        
        C:\Users\Admin\AppData\Local\Temp\npjuqkrult.exe
        47⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\npjuqkrult.exe
        
        C:\Users\Admin\AppData\Local\Temp\npjuqkrult.exe update lfbyiljbpl.exe
        48⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        48⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe update dqsbhcxazd.exe
        49⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\dqsbhcxazd.exe
        
        C:\Users\Admin\AppData\Local\Temp\dqsbhcxazd.exe
        49⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\dqsbhcxazd.exe
        
        C:\Users\Admin\AppData\Local\Temp\dqsbhcxazd.exe update ahizclvljp.exe
        50⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\ahizclvljp.exe
        
        C:\Users\Admin\AppData\Local\Temp\ahizclvljp.exe
        50⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\ahizclvljp.exe
        
        C:\Users\Admin\AppData\Local\Temp\ahizclvljp.exe update fmeknontgg.exe
        51⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\fmeknontgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\fmeknontgg.exe
        51⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\fmeknontgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\fmeknontgg.exe update dviwzhzddz.exe
        52⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\dviwzhzddz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dviwzhzddz.exe
        52⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\dviwzhzddz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dviwzhzddz.exe update klewcgzjiy.exe
        53⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\klewcgzjiy.exe
        
        C:\Users\Admin\AppData\Local\Temp\klewcgzjiy.exe
        53⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\klewcgzjiy.exe
        
        C:\Users\Admin\AppData\Local\Temp\klewcgzjiy.exe update kxtaqmqdar.exe
        54⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\kxtaqmqdar.exe
        
        C:\Users\Admin\AppData\Local\Temp\kxtaqmqdar.exe
        54⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\kxtaqmqdar.exe
        
        C:\Users\Admin\AppData\Local\Temp\kxtaqmqdar.exe update stoqyrgtqf.exe
        55⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\stoqyrgtqf.exe
        
        C:\Users\Admin\AppData\Local\Temp\stoqyrgtqf.exe
        55⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\stoqyrgtqf.exe
        
        C:\Users\Admin\AppData\Local\Temp\stoqyrgtqf.exe update hvkhtxfchk.exe
        56⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\hvkhtxfchk.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvkhtxfchk.exe
        56⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\hvkhtxfchk.exe
        
        C:\Users\Admin\AppData\Local\Temp\hvkhtxfchk.exe update cenhwgwfrq.exe
        57⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\cenhwgwfrq.exe
        
        C:\Users\Admin\AppData\Local\Temp\cenhwgwfrq.exe
        57⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\cenhwgwfrq.exe
        
        C:\Users\Admin\AppData\Local\Temp\cenhwgwfrq.exe update zdfkohomvr.exe
        58⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\zdfkohomvr.exe
        
        C:\Users\Admin\AppData\Local\Temp\zdfkohomvr.exe
        58⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\zdfkohomvr.exe
        
        C:\Users\Admin\AppData\Local\Temp\zdfkohomvr.exe update hwpouqxizj.exe
        59⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\hwpouqxizj.exe
        
        C:\Users\Admin\AppData\Local\Temp\hwpouqxizj.exe
        59⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\hwpouqxizj.exe
        
        C:\Users\Admin\AppData\Local\Temp\hwpouqxizj.exe update crfhldseqb.exe
        60⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\crfhldseqb.exe
        
        C:\Users\Admin\AppData\Local\Temp\crfhldseqb.exe
        60⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\crfhldseqb.exe
        
        C:\Users\Admin\AppData\Local\Temp\crfhldseqb.exe update kwtxuqicoo.exe
        61⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\kwtxuqicoo.exe
        
        C:\Users\Admin\AppData\Local\Temp\kwtxuqicoo.exe
        61⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\kwtxuqicoo.exe
        
        C:\Users\Admin\AppData\Local\Temp\kwtxuqicoo.exe update fjiqskhngp.exe
        62⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\fjiqskhngp.exe
        
        C:\Users\Admin\AppData\Local\Temp\fjiqskhngp.exe
        62⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\fjiqskhngp.exe
        
        C:\Users\Admin\AppData\Local\Temp\fjiqskhngp.exe update msoulcvfqh.exe
        63⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        63⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe
        
        C:\Users\Admin\AppData\Local\Temp\msoulcvfqh.exe update sfukhfsfix.exe
        64⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe
        64⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe
        
        C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe update esmvmyuffy.exe
        65⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\esmvmyuffy.exe
        
        C:\Users\Admin\AppData\Local\Temp\esmvmyuffy.exe
        65⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\esmvmyuffy.exe
        
        C:\Users\Admin\AppData\Local\Temp\esmvmyuffy.exe update ewjrsedzya.exe
        66⤵
        
        PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahjyvcvexg.exe

Path C:\Users\Admin\AppData\Local\Temp\ahjyvcvexg.exe
Size 10.4MB
SHA256 047f9da454f372df816bef7c3f8a9ea1d90583c50378c8e44bdee0c663f0f3f1
MD5 13deeed2b3ec857a67cb4f770ba38c51
SHA1 d202840c963c1ace4723714222748d507c0e03dc
SHA512 135d0a3dffa6335ce19b35a7d3c035c1ca72cb3336ecf573623a6ecddfecb89b61e6432947a5d255d603a7b7c1dbe7aa0db2fe8ccf98761fa3506fb65a3e6169
SSDEEP 196608:XZGmu+sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn+sREJLODBWlX3d+NpvdHIom
TLSH
T10CB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ajwfsprkya.exe

Path C:\Users\Admin\AppData\Local\Temp\ajwfsprkya.exe
Size 10.4MB
SHA256 6d094d17c528e1b4ca1add98a5224c8bdb3e78c79849cf0589ae15d3d6bc66fc
MD5 71d1f8b3bf47766c3870e37450559fdd
SHA1 d1b2575096bd1d391ca942a5d8dcc53452c57c8d
SHA512 cd2c635e96b558559410f009763e6597c14947848f15ac9ca350998665ec2c3721c4eaaf278e3af46ee2448f6fbb609dc6822d4db79dc6fd4a73772436a2b451
SSDEEP 196608:XZGmuUsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnUsREJLODBWlX3d+NpvdHIom
TLSH
T194B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bxemymfozv.exe

Path C:\Users\Admin\AppData\Local\Temp\bxemymfozv.exe
Size 10.4MB
SHA256 1aabd0230ffd14c914b0ca7dd51371a41af849cf0da92f494585eea83c33dd1e
MD5 788cda2271653ba06343514ae4bb1c6c
SHA1 92c0144583a1db10785a84a2e915793a11d5310b
SHA512 3ec482fb164da3f7c9b433002542c1a7d33dbddc004a9a3809a6aae28f5f2cb1d992e5a75170fab1e668117798ceef6a109fac1350de71e77f88c4db8f07bf3b
SSDEEP 196608:XZGmuQsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnQsREJLODBWlX3d+NpvdHIom
TLSH
T134B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daixkpcdpw.exe

Path C:\Users\Admin\AppData\Local\Temp\daixkpcdpw.exe
Size 10.4MB
SHA256 cdcb75f8d8f644f5baf69bc3cbb5c1a3afbc2ede542c66dff30b3c8c917bf0c5
MD5 52b3f2e1f7a51525cfff6b1986d1da27
SHA1 d2515355c4385c06ba7408a60e015af22cdd62f2
SHA512 68c2a52233242965775133d7e83bd705ba377902e27cb1666decb8d3cc90016311314894a3ac4d7a7bf68b87820c6d720beb236f2277163ac67e0abe67dc1bcd
SSDEEP 196608:XZGmu8sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn8sREJLODBWlX3d+NpvdHIom
TLSH
T133B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edrxwlugax.exe

Path C:\Users\Admin\AppData\Local\Temp\edrxwlugax.exe
Size 10.4MB
SHA256 e539c3dd077fb43536ed553679b1f83f85030d6c65c25ff9f68e4ba09f53256f
MD5 f8918741344af95b1fb75409b6cd831e
SHA1 cec3d63a8f6e98c4697cd14eab1a0755a5db182b
SHA512 4a90782e917192b1260d15180bc242e59aeeaff92e5b5f81a7ad4a2c73f46dfd9621df4beb35bfc32b06d264f313a24b9f6748a59489011570405cc3e40cc9a7
SSDEEP 196608:XZGmuhsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnhsREJLODBWlX3d+NpvdHIom
TLSH
T157B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iacbbmlmqm.exe

Path C:\Users\Admin\AppData\Local\Temp\iacbbmlmqm.exe
Size 10.4MB
SHA256 d2df306d003c40a7fe6029e9f75adbfd609574fda9eed041ccd8001212ee75ff
MD5 85ba1e5e787afb88ba0ae16e89f3b759
SHA1 068c82a6ef92d3526f58b5a198e3c87aed137eb2
SHA512 97011250ef15023e15dc66a47bbf5e8248cecf43205052811e09d6aac67e9abe73dd1400c0f617b1166bf1353450cd6cad52220347332f3334dc1d38cb239e55
SSDEEP 196608:XZGmuYsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnYsREJLODBWlX3d+NpvdHIom
TLSH
T1A0B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iourzjonsm.exe

Path C:\Users\Admin\AppData\Local\Temp\iourzjonsm.exe
Size 10.4MB
SHA256 2a872dc8c6b3ac224b752afaf034b7ee5efdca536496fcf254a27f785a13558d
MD5 07c434ac889df555de37a1a8a0887838
SHA1 5b42290c2721c6159838cc8301caddaf71bd33c9
SHA512 297809141d965ab0f5e5eab36229bbaf733d1be84a0f88950af27e1b27e44cb1f67a9c1dd67b231910a96188cdcf3b0e203ab669fc13d21933238fe1b09c3341
SSDEEP 196608:XZGmuOsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnOsREJLODBWlX3d+NpvdHIom
TLSH
T1C4B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvuflzhjta.exe

Path C:\Users\Admin\AppData\Local\Temp\jvuflzhjta.exe
Size 10.4MB
SHA256 563d098bfac1c978f05255e733d1cfa98538f4f44a5218617c30a4c4262f4aac
MD5 2a3345d81e3ce97bde42450ff01d4d93
SHA1 032a5eb56583f57818bb079cd531dd33742ae553
SHA512 6dbaf224027fe68bae42f920e8e8dff807356253066ad6bfa391079f4a12efbff88463c1dfd64251da80a23ca7937b001ac45d1dd662a542d183134ee01041d0
SSDEEP 196608:XZGmuTsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnTsREJLODBWlX3d+NpvdHIom
TLSH
T1A4B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omoukaqdjt.exe

Path C:\Users\Admin\AppData\Local\Temp\omoukaqdjt.exe
Size 10.4MB
SHA256 e94e54338a0c5e42c80892c475963b0d78139871f1a04ad5edb01019d4bf062b
MD5 3c07d33e29f1bf2f1826d05dd5d44933
SHA1 48c93009111031a8d09c476995478b97be9110af
SHA512 8a6c84a414b53236334cdd8cac9454bd1ab7d9d22985b5b90c6865e8b3aab27cc36c78d62a6fff2c55ed3383d4de607b25d2230f7801abeee4e8af3de67c994a
SSDEEP 196608:XZGmuxsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnxsREJLODBWlX3d+NpvdHIom
TLSH
T1A7B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pagwuuvmug.exe

Path C:\Users\Admin\AppData\Local\Temp\pagwuuvmug.exe
Size 10.4MB
SHA256 a29429faadd5fc5727e14506cb859d776f6e2c3eeb31d2d57314b79b4c57084c
MD5 efd279f27be58d4565bf98d030e41c14
SHA1 08d0646c81deab703969eac798017202dbf614b0
SHA512 a1072c94c1c4d327095eb634ac5eaacaae2ccebef1b1a180f932ca3645c1e91815a6f96cc0f7060706951754f67145d699777ff77b879f83da9abdbf5631a28b
SSDEEP 196608:XZGmu4sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn4sREJLODBWlX3d+NpvdHIom
TLSH
T11CB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmshqfvmvv.exe

Path C:\Users\Admin\AppData\Local\Temp\pmshqfvmvv.exe
Size 10.4MB
SHA256 8fa9f7b559caea5ab8c5927173ca685a0a22fd77b513852c727fcc16a6e015f6
MD5 f2cbcc2f7cb5ef97684bdb46310fc1dd
SHA1 d3ae437c941cf5f4e6414827f494c3de520e399f
SHA512 8ed1b6d9dd33c335e5eaeb4001077ff05fe9622965896a26fc53dc1afb9591db88b6087837cfe1bad4b2441f4e4edf77f0e70226c0d7a9a6a6bcdb9346d27c96
SSDEEP 196608:XZGmuQsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnQsREJLODBWlX3d+NpvdHIom
TLSH
T119B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhfnzfpzkq.exe

Path C:\Users\Admin\AppData\Local\Temp\qhfnzfpzkq.exe
Size 10.4MB
SHA256 98646c5800e44ff13360ebf7c077b4a29017e62ed5c0695c479ccefcd5dcf63b
MD5 bfaf822f65fbe60d0f1ce6b22c1662ce
SHA1 54c9ed5f30106f6e8e52ddf1e24fe22a48a37025
SHA512 06b6454b8a807a905c9194b023642790a5c2bdfaca9e074de2cb69d09ed2008b907dd113c3f107460b8b7e2175a7ddf4f8a62b675ed1b3d5c91eeedaffa2621f
SSDEEP 196608:XZGmufsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnfsREJLODBWlX3d+NpvdHIom
TLSH
T1A5B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qyzeziltzp.exe

Path C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe
Size 10.4MB
SHA256 8d9344cffbb47ec01cbc82b4b61e86c9c94b3feae0fc8c720a72e388beb2b674
MD5 00519d3830e76dcdaeee3e9ce8aa138f
SHA1 87b68f95f7c96eaf5589423df9b7fe8cb94f4c5e
SHA512 31d54c2bf355979ce8e3dc3064eb07e22ce4aef8f0cb128ae439c81a57262862b4ad8330c4e89eae11cc03cad7784813a3f261b2a9a7125418abb4e5e6cede43
SSDEEP 196608:XZGmu1sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn1sREJLODBWlX3d+NpvdHIom
TLSH
T1A8B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sahxzwbzkg.exe

Path C:\Users\Admin\AppData\Local\Temp\sahxzwbzkg.exe
Size 10.4MB
SHA256 58f1480411876c09fb87245ab2cac7b0a7076ac4f82e77bd9176f4e80c96910a
MD5 f1cbee1945a4b7a1d40b9f2a68081ddc
SHA1 0c7e87314f4ed94e7d5360a8367a5c2d31897774
SHA512 e226ce4f7aceab7877777b6d2945e96593232f5518ca5913a3cbf2824e352c8e8f0e4128c258e1bd7b0d1ab1651094ff7a20c2dcaf0a9a89ccb56746a868abad
SSDEEP 196608:XZGmumsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnmsREJLODBWlX3d+NpvdHIom
TLSH
T120B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 18e504bb90385ba38092a920cc40874a46152fccccf5b16ec8eeb55f4e0563b0
MD5 d6f3182c04d88a3480f1db5633f3f6c8
SHA1 04d30b43f8e21dc80f9c8e3159bc602e1b3fb708
SHA512 329ba6b3072c5e244d5dd81e815d0fc709cbe75802c5de8852bbca3c1bb99b607a8dec3d2e96a05d1dc07fd949557e2983cc4262dcf3b261a8e5e22a930efa3b
SSDEEP 196608:XZGmuTsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnTsREJLODBWlX3d+NpvdHIom
TLSH
T1D5B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 0cd62630c95c625eb67476c193802f8b57264e5376e3ce62687c3bfbcba847d1
MD5 d776c3843a91f3869db9812299fba367
SHA1 7e93dc07777458376dc231ce8a6f782b09b6ee3d
SHA512 6ecf30bcbdf25f3eef91f0dae8d3e8de9a10d34ef6a32b4375542616677b564f5c47bdb1717c065be1220b2bb21469b16b97e8a8d4a822acf548622bc450e7e8
SSDEEP 196608:XZGmuysR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnysREJLODBWlX3d+NpvdHIom
TLSH
T14DB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 3912565367a4bf8000f57f7231891406e8951170ee81356bcf562514fb2ce588
MD5 082c787bc558036a00ca510fcc89ea54
SHA1 8490e18d1dcc0a7fc437dc19edadb4026c65861f
SHA512 3d58da0d012947d1adfd2be49c68a65594e07d3645d6588640be20f34646dc13d0296d62187a580b0c0d45130a4eea08c23b22c0800a18b15e1a636754ec0d52
SSDEEP 196608:XZGmuMsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnMsREJLODBWlX3d+NpvdHIom
TLSH
T19AB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 1c475c91e0e206c8e970e1c0e7bed8de0f0ab5aae4aac2499b9706add13afe5d
MD5 b2c8ec4933b3b286ed57f448781110ad
SHA1 63234f9ba60ea75a06ef2840c8685bb3f9a40a72
SHA512 336e4ae16ea5f5c129d2f4ca25ad948baea0a93f8f39ae35724e1eb617e8b2de38dc9a1bc2bb93fa364bc6305eb3dc00353d8fc33f6927031057c1b0d7ee76a6
SSDEEP 196608:XZGmuNsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnNsREJLODBWlX3d+NpvdHIom
TLSH
T192B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 133fd2d5dcdd21cdb0dc303e834267d1f8045229368664d7e95796cb94ae722b
MD5 e8c34b03d2e96b354f526f33486302b3
SHA1 07cd16433aa7204d64c24468307854d16c735263
SHA512 48a731fe7ba209741d4a92cb0aea34771eb7f400b026b8a2589f729d5ba141771962b60892ff242f0d9e0d52b39c2e5284f5311a6efaac821399013f1bcd7915
SSDEEP 196608:XZGmuHsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnHsREJLODBWlX3d+NpvdHIom
TLSH
T135B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 cc2ff054eb0dba19943ec0cb99be596c69e3d3b871dd6e49d1027d5920b10aaa
MD5 e2f784f039d95250a79ec787f57ba756
SHA1 f6eec4016241f2da527e152bd73404259fdea9b5
SHA512 e018dca612a414037e581e89dbd6290ed098cb24b616a16954cdfad2ab38fedf3fbf0c305bdaf73d3881147603f70c40d4454369f94dd41f46f16a39856c5484
SSDEEP 196608:XZGmussR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnssREJLODBWlX3d+NpvdHIom
TLSH
T19AB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.4MB
SHA256 7f44a17b88aebe952673cec62539b4deccb050927b4409b6be83e3751792b53e
MD5 005454e246b1a96506db88caf627eb78
SHA1 6c0672fcd9befd29d3a3fee15e9eb3568d8ca722
SHA512 f1bab38e51a727545eafb4eb0d7b0e40a69a630c8b2cc713a4c062a03139cddb9bb6ab6b83c8a79083e129e210a326319071563a6d6e9451053b9f8e64b103ba
SSDEEP 196608:XZGmulsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnlsREJLODBWlX3d+NpvdHIom
TLSH
T1AAB61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vihosqcffx.exe

Path C:\Users\Admin\AppData\Local\Temp\vihosqcffx.exe
Size 10.4MB
SHA256 47d8f34c6e20a6943c707fbe7be50e1bf8af3ae057baeb8664c05e7ba046c6a9
MD5 3f01b5aecb6a4b4ba83ba7f8e7cd2c03
SHA1 bad8c7dd6bbbf2a3f6fb285786d94c3bdacf2c40
SHA512 3ce6b736d1f04bd2bfa8b9660218ca160b5fca714e12cd386a126fd54810a7e957a1b77ca5c94245d94988c1e5c7930f1e69fc752173d091c08614321d6cf6b1
SSDEEP 196608:XZGmu7sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGn7sREJLODBWlX3d+NpvdHIom
TLSH
T1F8B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xltybnxbam.exe

Path C:\Users\Admin\AppData\Local\Temp\xltybnxbam.exe
Size 10.4MB
SHA256 18c77cef3a9f34f2fd2447ead19b86d4b06e164ff975a300c7165a19ce4db818
MD5 4d3fb006dd8b79c6da5e012dfadf1998
SHA1 910411af3a0c8c6ac25f2b12341ec2c473e7cfb8
SHA512 68f389504ade118fffa417bc807d7e0ecc085f7c216b8b1287144d45e5a62a0874e54f0a9b487bf546805f4af23eb281371d5b63b021edec5a1ee31292c10fd5
SSDEEP 196608:XZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnPsREJLODBWlX3d+NpvdHIom
TLSH
T110B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zeqntzahhw.exe

Path C:\Users\Admin\AppData\Local\Temp\zeqntzahhw.exe
Size 10.4MB
SHA256 e3d6c672428c422ddad71c30a4f97b75cb8af0bcaeb3a1deaac6d90ea3d076fe
MD5 bdadc8d78a805f19b0ba37f0746a8f16
SHA1 e568ce8e2e89c09c8e157481559cf7c7a19cbfd3
SHA512 168a011fe906b850fa84d37da6837d0412635907cd59d3dfc91aeb2f8d9f87c74b3a71fd56e24e78cc2da727706c518281ede27e40cd821d25c9841af824bc4b
SSDEEP 196608:XZGmussR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGnssREJLODBWlX3d+NpvdHIom
TLSH
T173B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxdoynvqtw.exe

Path C:\Users\Admin\AppData\Local\Temp\zxdoynvqtw.exe
Size 10.4MB
SHA256 bb91137a5a192c2dec989cf0262974eeadc31d609656b5dfd852d00ae11f6551
MD5 259d38b1bbc170ca90bfc9428f98936e
SHA1 4f9e3fe9ab07331ea0e7fc6509b7d0c111021cfc
SHA512 20e371ea4fc27b1b04ecac9bc536247c7823bec2412bdedf8235b729f113589920ebcf7ebd58af19de2100504339c2b09bdf94fd802617a816a08a0e59c47ecf
SSDEEP 196608:XZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSB:XZGngsREJLODBWlX3d+NpvdHIom
TLSH
T1E5B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-84-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1504-12-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1504-11-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/1624-125-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1644-198-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/1644-199-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1688-230-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1744-143-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1948-119-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1952-166-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1956-75-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1984-116-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2004-237-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2116-20-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/2116-21-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2236-192-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2356-227-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2384-163-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2456-137-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2552-9-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2552-8-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/2576-134-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2652-177-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2664-201-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2812-208-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2908-187-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3004-62-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/3004-63-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3012-27-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3032-18-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3140-154-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3324-157-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3620-36-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3756-97-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3768-223-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3804-102-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3828-57-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3828-56-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/3848-89-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3880-3-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3880-2-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/3892-148-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3896-234-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4116-39-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4116-38-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/4116-213-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4132-45-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4164-242-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4172-244-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4184-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4184-0-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/4356-67-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4412-216-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4528-183-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4540-48-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4768-174-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4808-221-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4856-128-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4860-54-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4868-194-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4960-78-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4972-29-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/4972-30-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4988-206-0x0000000000400000-0x0000000000E90000-memory.dmp

Download