2d096b02435e8e2601b2c273fb1ef049b8ac57feebecf98129574a722795249f

Analysis

max time kernel
94s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Size 10.6MB
Sample260730-vpxz4ssgrc
SHA256 2d096b02435e8e2601b2c273fb1ef049b8ac57feebecf98129574a722795249f
MD5 ae45b1627b0120e82e07321750ea34a8
SHA1 92e0cc5dbe9e225b26a86f389792fb2a16b2677d
SHA512 b2e9459f1c37151a36b885a70d36ea7268e51e4e509ba9e7ed874402cbb3813b3905ba2b19f38747d2005665d3582cd03fb1b8ba46ac011688cefd52094ceed5
SSDEEP 196608:PZGmu6sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn6sREJLODBWlX3d+NpvdHIol
TLSH
T1D0B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 59 IoCs

pid	Process
720	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
4760	zulamadjbt.exe
5516	zulamadjbt.exe
1304	zhrxqkrvxf.exe
4612	zhrxqkrvxf.exe
2748	rldbupyktp.exe
2448	rldbupyktp.exe
2796	mshnsmyhka.exe
1148	mshnsmyhka.exe
5060	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
1268	trskyizkuy.exe
5640	trskyizkuy.exe
1444	bhjzgkcmgx.exe
5540	bhjzgkcmgx.exe
4516	qjatwscflk.exe
5888	qjatwscflk.exe
3292	tqdkcgdjld.exe
4524	tqdkcgdjld.exe
812	duxcfjomqp.exe
2376	duxcfjomqp.exe
5736	xbbpvfniia.exe
2556	xbbpvfniia.exe
564	vwazgnfwin.exe
5848	vwazgnfwin.exe
4372	cxiaxrjxtx.exe
5700	cxiaxrjxtx.exe
5828	cnskffdmko.exe
2988	cnskffdmko.exe
5816	mgcltmsuzc.exe
768	mgcltmsuzc.exe
1224	kittkqcazx.exe
5560	kittkqcazx.exe
2972	eiwcjqmuou.exe
2368	eiwcjqmuou.exe
1432	urxpxnxfil.exe
6056	urxpxnxfil.exe
4852	zifoknohsp.exe
1612	zifoknohsp.exe
6036	bwtzwwrvsa.exe
5680	bwtzwwrvsa.exe
4884	wgxazfaycg.exe
5376	wgxazfaycg.exe
4220	ggmijguyfn.exe
2392	ggmijguyfn.exe
6012	ozwmphdtjn.exe
5288	ozwmphdtjn.exe
5276	elnusjdbgc.exe
4260	elnusjdbgc.exe
2816	bbxfkkdilv.exe
5404	bbxfkkdilv.exe
4752	ownqbyqfcm.exe
4920	ownqbyqfcm.exe
2016	tvueutezgf.exe
4400	tvueutezgf.exe
3828	arohrzxxbm.exe
3892	arohrzxxbm.exe
3236	vxgvrdhfrn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 60 IoCs

pid	Process
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2156	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
720	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
4760	zulamadjbt.exe
5516	zulamadjbt.exe
1304	zhrxqkrvxf.exe
4612	zhrxqkrvxf.exe
2748	rldbupyktp.exe
2448	rldbupyktp.exe
2796	mshnsmyhka.exe
1148	mshnsmyhka.exe
5060	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
1268	trskyizkuy.exe
5640	trskyizkuy.exe
1444	bhjzgkcmgx.exe
5540	bhjzgkcmgx.exe
4516	qjatwscflk.exe
5888	qjatwscflk.exe
3292	tqdkcgdjld.exe
4524	tqdkcgdjld.exe
812	duxcfjomqp.exe
2376	duxcfjomqp.exe
5736	xbbpvfniia.exe
2556	xbbpvfniia.exe
564	vwazgnfwin.exe
5848	vwazgnfwin.exe
4372	cxiaxrjxtx.exe
5700	cxiaxrjxtx.exe
5828	cnskffdmko.exe
2988	cnskffdmko.exe
5816	mgcltmsuzc.exe
768	mgcltmsuzc.exe
1224	kittkqcazx.exe
5560	kittkqcazx.exe
2972	eiwcjqmuou.exe
2368	eiwcjqmuou.exe
1432	urxpxnxfil.exe
6056	urxpxnxfil.exe
4852	zifoknohsp.exe
1612	zifoknohsp.exe
6036	bwtzwwrvsa.exe
5680	bwtzwwrvsa.exe
4884	wgxazfaycg.exe
5376	wgxazfaycg.exe
4220	ggmijguyfn.exe
2392	ggmijguyfn.exe
6012	ozwmphdtjn.exe
5288	ozwmphdtjn.exe
5276	elnusjdbgc.exe
4260	elnusjdbgc.exe
2816	bbxfkkdilv.exe
5404	bbxfkkdilv.exe
4752	ownqbyqfcm.exe
4920	ownqbyqfcm.exe
2016	tvueutezgf.exe
4400	tvueutezgf.exe
3828	arohrzxxbm.exe
3892	arohrzxxbm.exe

System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshnsmyhka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trskyizkuy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bhjzgkcmgx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtzwwrvsa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtzwwrvsa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ozwmphdtjn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbxfkkdilv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arohrzxxbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kittkqcazx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arohrzxxbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggmijguyfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpsuddxtuu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zulamadjbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bhjzgkcmgx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qjatwscflk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duxcfjomqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xbbpvfniia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxiaxrjxtx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elnusjdbgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqdkcgdjld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnskffdmko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trskyizkuy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vwazgnfwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgxazfaycg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpsuddxtuu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zulamadjbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabnzfdjbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qjatwscflk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vwazgnfwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbxfkkdilv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zifoknohsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ozwmphdtjn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zhrxqkrvxf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshnsmyhka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgcltmsuzc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elnusjdbgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnskffdmko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eiwcjqmuou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urxpxnxfil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ownqbyqfcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggmijguyfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rldbupyktp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xbbpvfniia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgcltmsuzc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zifoknohsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabnzfdjbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqdkcgdjld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eiwcjqmuou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tvueutezgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxgvrdhfrn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rldbupyktp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duxcfjomqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zhrxqkrvxf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urxpxnxfil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxiaxrjxtx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kittkqcazx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgxazfaycg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ownqbyqfcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tvueutezgf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2156	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2156	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
720	kpsuddxtuu.exe
720	kpsuddxtuu.exe
720	kpsuddxtuu.exe
720	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
4760	zulamadjbt.exe
4760	zulamadjbt.exe
4760	zulamadjbt.exe
4760	zulamadjbt.exe
5516	zulamadjbt.exe
5516	zulamadjbt.exe
720	kpsuddxtuu.exe
720	kpsuddxtuu.exe
1304	zhrxqkrvxf.exe
1304	zhrxqkrvxf.exe
1304	zhrxqkrvxf.exe
1304	zhrxqkrvxf.exe
4760	zulamadjbt.exe
4760	zulamadjbt.exe
4612	zhrxqkrvxf.exe
4612	zhrxqkrvxf.exe
2748	rldbupyktp.exe
2748	rldbupyktp.exe
2748	rldbupyktp.exe
2748	rldbupyktp.exe
2448	rldbupyktp.exe
2448	rldbupyktp.exe
1304	zhrxqkrvxf.exe
1304	zhrxqkrvxf.exe
2796	mshnsmyhka.exe
2796	mshnsmyhka.exe
2796	mshnsmyhka.exe
2796	mshnsmyhka.exe
1148	mshnsmyhka.exe
1148	mshnsmyhka.exe
2748	rldbupyktp.exe
2748	rldbupyktp.exe
5060	dabnzfdjbz.exe
5060	dabnzfdjbz.exe
5060	dabnzfdjbz.exe
5060	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
2796	mshnsmyhka.exe
2796	mshnsmyhka.exe
1268	trskyizkuy.exe
1268	trskyizkuy.exe
1268	trskyizkuy.exe
1268	trskyizkuy.exe
5640	trskyizkuy.exe
5640	trskyizkuy.exe
5060	dabnzfdjbz.exe
5060	dabnzfdjbz.exe
1444	bhjzgkcmgx.exe
1444	bhjzgkcmgx.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2156	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
2156	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
720	kpsuddxtuu.exe
720	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
4484	kpsuddxtuu.exe
4760	zulamadjbt.exe
4760	zulamadjbt.exe
5516	zulamadjbt.exe
5516	zulamadjbt.exe
1304	zhrxqkrvxf.exe
1304	zhrxqkrvxf.exe
4612	zhrxqkrvxf.exe
4612	zhrxqkrvxf.exe
2748	rldbupyktp.exe
2748	rldbupyktp.exe
2448	rldbupyktp.exe
2448	rldbupyktp.exe
2796	mshnsmyhka.exe
2796	mshnsmyhka.exe
1148	mshnsmyhka.exe
1148	mshnsmyhka.exe
5060	dabnzfdjbz.exe
5060	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
5004	dabnzfdjbz.exe
1268	trskyizkuy.exe
1268	trskyizkuy.exe
5640	trskyizkuy.exe
5640	trskyizkuy.exe
1444	bhjzgkcmgx.exe
1444	bhjzgkcmgx.exe
5540	bhjzgkcmgx.exe
5540	bhjzgkcmgx.exe
4516	qjatwscflk.exe
4516	qjatwscflk.exe
5888	qjatwscflk.exe
5888	qjatwscflk.exe
3292	tqdkcgdjld.exe
3292	tqdkcgdjld.exe
4524	tqdkcgdjld.exe
4524	tqdkcgdjld.exe
812	duxcfjomqp.exe
812	duxcfjomqp.exe
2376	duxcfjomqp.exe
2376	duxcfjomqp.exe
5736	xbbpvfniia.exe
5736	xbbpvfniia.exe
2556	xbbpvfniia.exe
2556	xbbpvfniia.exe
564	vwazgnfwin.exe
564	vwazgnfwin.exe
5848	vwazgnfwin.exe
5848	vwazgnfwin.exe
4372	cxiaxrjxtx.exe
4372	cxiaxrjxtx.exe
5700	cxiaxrjxtx.exe
5700	cxiaxrjxtx.exe
5828	cnskffdmko.exe
5828	cnskffdmko.exe
2988	cnskffdmko.exe
2988	cnskffdmko.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2156	3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	89
PID 3360 wrote to memory of 720	3360	2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe	90
PID 720 wrote to memory of 4484	720	kpsuddxtuu.exe	91
PID 720 wrote to memory of 4760	720	kpsuddxtuu.exe	92
PID 4760 wrote to memory of 5516	4760	zulamadjbt.exe	93
PID 4760 wrote to memory of 1304	4760	zulamadjbt.exe	94
PID 1304 wrote to memory of 4612	1304	zhrxqkrvxf.exe	95
PID 1304 wrote to memory of 2748	1304	zhrxqkrvxf.exe	96
PID 2748 wrote to memory of 2448	2748	rldbupyktp.exe	97
PID 2748 wrote to memory of 2796	2748	rldbupyktp.exe	98
PID 2796 wrote to memory of 1148	2796	mshnsmyhka.exe	99
PID 2796 wrote to memory of 5060	2796	mshnsmyhka.exe	100
PID 5060 wrote to memory of 5004	5060	dabnzfdjbz.exe	101
PID 5060 wrote to memory of 1268	5060	dabnzfdjbz.exe	102
PID 1268 wrote to memory of 5640	1268	trskyizkuy.exe	103
PID 1268 wrote to memory of 1444	1268	trskyizkuy.exe	105
PID 1444 wrote to memory of 5540	1444	bhjzgkcmgx.exe	106
PID 1444 wrote to memory of 4516	1444	bhjzgkcmgx.exe	107
PID 4516 wrote to memory of 5888	4516	qjatwscflk.exe	108
PID 4516 wrote to memory of 3292	4516	qjatwscflk.exe	109
PID 3292 wrote to memory of 4524	3292	tqdkcgdjld.exe	110
PID 3292 wrote to memory of 812	3292	tqdkcgdjld.exe	111
PID 812 wrote to memory of 2376	812	duxcfjomqp.exe	112
PID 812 wrote to memory of 5736	812	duxcfjomqp.exe	113
PID 5736 wrote to memory of 2556	5736	xbbpvfniia.exe	114
PID 5736 wrote to memory of 564	5736	xbbpvfniia.exe	115
PID 564 wrote to memory of 5848	564	vwazgnfwin.exe	116
PID 564 wrote to memory of 4372	564	vwazgnfwin.exe	117
PID 4372 wrote to memory of 5700	4372	cxiaxrjxtx.exe	118
PID 4372 wrote to memory of 5828	4372	cxiaxrjxtx.exe	119
PID 5828 wrote to memory of 2988	5828	cnskffdmko.exe	120
PID 5828 wrote to memory of 5816	5828	cnskffdmko.exe	121
PID 5816 wrote to memory of 768	5816	mgcltmsuzc.exe	122
PID 5816 wrote to memory of 1224	5816	mgcltmsuzc.exe	123
PID 1224 wrote to memory of 5560	1224	kittkqcazx.exe	124
PID 1224 wrote to memory of 2972	1224	kittkqcazx.exe	125
PID 2972 wrote to memory of 2368	2972	eiwcjqmuou.exe	126
PID 2972 wrote to memory of 1432	2972	eiwcjqmuou.exe	127
PID 1432 wrote to memory of 6056	1432	urxpxnxfil.exe	128
PID 1432 wrote to memory of 4852	1432	urxpxnxfil.exe	129
PID 4852 wrote to memory of 1612	4852	zifoknohsp.exe	130
PID 4852 wrote to memory of 6036	4852	zifoknohsp.exe	131
PID 6036 wrote to memory of 5680	6036	bwtzwwrvsa.exe	132
PID 6036 wrote to memory of 4884	6036	bwtzwwrvsa.exe	133
PID 4884 wrote to memory of 5376	4884	wgxazfaycg.exe	134
PID 4884 wrote to memory of 4220	4884	wgxazfaycg.exe	135
PID 4220 wrote to memory of 2392	4220	ggmijguyfn.exe	136
PID 4220 wrote to memory of 6012	4220	ggmijguyfn.exe	137
PID 6012 wrote to memory of 5288	6012	ozwmphdtjn.exe	138
PID 6012 wrote to memory of 5276	6012	ozwmphdtjn.exe	139
PID 5276 wrote to memory of 4260	5276	elnusjdbgc.exe	140
PID 5276 wrote to memory of 2816	5276	elnusjdbgc.exe	141
PID 2816 wrote to memory of 5404	2816	bbxfkkdilv.exe	142
PID 2816 wrote to memory of 4752	2816	bbxfkkdilv.exe	143
PID 4752 wrote to memory of 4920	4752	ownqbyqfcm.exe	144
PID 4752 wrote to memory of 2016	4752	ownqbyqfcm.exe	145
PID 2016 wrote to memory of 4400	2016	tvueutezgf.exe	146
PID 2016 wrote to memory of 3828	2016	tvueutezgf.exe	147
PID 3828 wrote to memory of 3892	3828	arohrzxxbm.exe	148
PID 3828 wrote to memory of 3236	3828	arohrzxxbm.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_ae45b1627b0120e82e07321750ea34a8_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update kpsuddxtuu.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\kpsuddxtuu.exe
  C:\Users\Admin\AppData\Local\Temp\kpsuddxtuu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Users\Admin\AppData\Local\Temp\kpsuddxtuu.exe
    C:\Users\Admin\AppData\Local\Temp\kpsuddxtuu.exe update zulamadjbt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\zulamadjbt.exe
    C:\Users\Admin\AppData\Local\Temp\zulamadjbt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\zulamadjbt.exe
      C:\Users\Admin\AppData\Local\Temp\zulamadjbt.exe update zhrxqkrvxf.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\zhrxqkrvxf.exe
      C:\Users\Admin\AppData\Local\Temp\zhrxqkrvxf.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\zhrxqkrvxf.exe
        
        C:\Users\Admin\AppData\Local\Temp\zhrxqkrvxf.exe update rldbupyktp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\rldbupyktp.exe
        
        C:\Users\Admin\AppData\Local\Temp\rldbupyktp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\rldbupyktp.exe
        
        C:\Users\Admin\AppData\Local\Temp\rldbupyktp.exe update mshnsmyhka.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\mshnsmyhka.exe
        
        C:\Users\Admin\AppData\Local\Temp\mshnsmyhka.exe
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\mshnsmyhka.exe
        
        C:\Users\Admin\AppData\Local\Temp\mshnsmyhka.exe update dabnzfdjbz.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\dabnzfdjbz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dabnzfdjbz.exe
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\dabnzfdjbz.exe
        
        C:\Users\Admin\AppData\Local\Temp\dabnzfdjbz.exe update trskyizkuy.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\trskyizkuy.exe
        
        C:\Users\Admin\AppData\Local\Temp\trskyizkuy.exe
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\trskyizkuy.exe
        
        C:\Users\Admin\AppData\Local\Temp\trskyizkuy.exe update bhjzgkcmgx.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\bhjzgkcmgx.exe
        
        C:\Users\Admin\AppData\Local\Temp\bhjzgkcmgx.exe
        9⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\bhjzgkcmgx.exe
        
        C:\Users\Admin\AppData\Local\Temp\bhjzgkcmgx.exe update qjatwscflk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\qjatwscflk.exe
        
        C:\Users\Admin\AppData\Local\Temp\qjatwscflk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\qjatwscflk.exe
        
        C:\Users\Admin\AppData\Local\Temp\qjatwscflk.exe update tqdkcgdjld.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\tqdkcgdjld.exe
        
        C:\Users\Admin\AppData\Local\Temp\tqdkcgdjld.exe
        11⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\tqdkcgdjld.exe
        
        C:\Users\Admin\AppData\Local\Temp\tqdkcgdjld.exe update duxcfjomqp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\duxcfjomqp.exe
        
        C:\Users\Admin\AppData\Local\Temp\duxcfjomqp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\duxcfjomqp.exe
        
        C:\Users\Admin\AppData\Local\Temp\duxcfjomqp.exe update xbbpvfniia.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\xbbpvfniia.exe
        
        C:\Users\Admin\AppData\Local\Temp\xbbpvfniia.exe
        13⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\xbbpvfniia.exe
        
        C:\Users\Admin\AppData\Local\Temp\xbbpvfniia.exe update vwazgnfwin.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\vwazgnfwin.exe
        
        C:\Users\Admin\AppData\Local\Temp\vwazgnfwin.exe
        14⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\vwazgnfwin.exe
        
        C:\Users\Admin\AppData\Local\Temp\vwazgnfwin.exe update cxiaxrjxtx.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe
        
        C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe
        15⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe
        
        C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe update cnskffdmko.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\cnskffdmko.exe
        
        C:\Users\Admin\AppData\Local\Temp\cnskffdmko.exe
        16⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\cnskffdmko.exe
        
        C:\Users\Admin\AppData\Local\Temp\cnskffdmko.exe update mgcltmsuzc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\mgcltmsuzc.exe
        
        C:\Users\Admin\AppData\Local\Temp\mgcltmsuzc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\mgcltmsuzc.exe
        
        C:\Users\Admin\AppData\Local\Temp\mgcltmsuzc.exe update kittkqcazx.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\kittkqcazx.exe
        
        C:\Users\Admin\AppData\Local\Temp\kittkqcazx.exe
        18⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\kittkqcazx.exe
        
        C:\Users\Admin\AppData\Local\Temp\kittkqcazx.exe update eiwcjqmuou.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\eiwcjqmuou.exe
        
        C:\Users\Admin\AppData\Local\Temp\eiwcjqmuou.exe
        19⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\eiwcjqmuou.exe
        
        C:\Users\Admin\AppData\Local\Temp\eiwcjqmuou.exe update urxpxnxfil.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\urxpxnxfil.exe
        
        C:\Users\Admin\AppData\Local\Temp\urxpxnxfil.exe
        20⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\urxpxnxfil.exe
        
        C:\Users\Admin\AppData\Local\Temp\urxpxnxfil.exe update zifoknohsp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\zifoknohsp.exe
        
        C:\Users\Admin\AppData\Local\Temp\zifoknohsp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\zifoknohsp.exe
        
        C:\Users\Admin\AppData\Local\Temp\zifoknohsp.exe update bwtzwwrvsa.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\bwtzwwrvsa.exe
        
        C:\Users\Admin\AppData\Local\Temp\bwtzwwrvsa.exe
        22⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\bwtzwwrvsa.exe
        
        C:\Users\Admin\AppData\Local\Temp\bwtzwwrvsa.exe update wgxazfaycg.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\wgxazfaycg.exe
        
        C:\Users\Admin\AppData\Local\Temp\wgxazfaycg.exe
        23⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\wgxazfaycg.exe
        
        C:\Users\Admin\AppData\Local\Temp\wgxazfaycg.exe update ggmijguyfn.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\ggmijguyfn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ggmijguyfn.exe
        24⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\ggmijguyfn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ggmijguyfn.exe update ozwmphdtjn.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\ozwmphdtjn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ozwmphdtjn.exe
        25⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\ozwmphdtjn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ozwmphdtjn.exe update elnusjdbgc.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\elnusjdbgc.exe
        
        C:\Users\Admin\AppData\Local\Temp\elnusjdbgc.exe
        26⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\elnusjdbgc.exe
        
        C:\Users\Admin\AppData\Local\Temp\elnusjdbgc.exe update bbxfkkdilv.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\bbxfkkdilv.exe
        
        C:\Users\Admin\AppData\Local\Temp\bbxfkkdilv.exe
        27⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\bbxfkkdilv.exe
        
        C:\Users\Admin\AppData\Local\Temp\bbxfkkdilv.exe update ownqbyqfcm.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\ownqbyqfcm.exe
        
        C:\Users\Admin\AppData\Local\Temp\ownqbyqfcm.exe
        28⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\ownqbyqfcm.exe
        
        C:\Users\Admin\AppData\Local\Temp\ownqbyqfcm.exe update tvueutezgf.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\tvueutezgf.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvueutezgf.exe
        29⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\tvueutezgf.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvueutezgf.exe update arohrzxxbm.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\arohrzxxbm.exe
        
        C:\Users\Admin\AppData\Local\Temp\arohrzxxbm.exe
        30⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\arohrzxxbm.exe
        
        C:\Users\Admin\AppData\Local\Temp\arohrzxxbm.exe update vxgvrdhfrn.exe
        31⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\vxgvrdhfrn.exe
        
        C:\Users\Admin\AppData\Local\Temp\vxgvrdhfrn.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\vxgvrdhfrn.exe
        
        C:\Users\Admin\AppData\Local\Temp\vxgvrdhfrn.exe update thbbswwybh.exe
        32⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\thbbswwybh.exe
        
        C:\Users\Admin\AppData\Local\Temp\thbbswwybh.exe
        32⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\thbbswwybh.exe
        
        C:\Users\Admin\AppData\Local\Temp\thbbswwybh.exe update dkboxtpsra.exe
        33⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\dkboxtpsra.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkboxtpsra.exe
        33⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\dkboxtpsra.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkboxtpsra.exe update bezusvynvc.exe
        34⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\bezusvynvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bezusvynvc.exe
        34⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\bezusvynvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bezusvynvc.exe update dslvhfqkfj.exe
        35⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe
        
        C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe
        35⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe
        
        C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe update fdnwrvlipz.exe
        36⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\fdnwrvlipz.exe
        
        C:\Users\Admin\AppData\Local\Temp\fdnwrvlipz.exe
        36⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\fdnwrvlipz.exe
        
        C:\Users\Admin\AppData\Local\Temp\fdnwrvlipz.exe update icfjfgzmnb.exe
        37⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\icfjfgzmnb.exe
        
        C:\Users\Admin\AppData\Local\Temp\icfjfgzmnb.exe
        37⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\icfjfgzmnb.exe
        
        C:\Users\Admin\AppData\Local\Temp\icfjfgzmnb.exe update nsuhtpyxxg.exe
        38⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\nsuhtpyxxg.exe
        
        C:\Users\Admin\AppData\Local\Temp\nsuhtpyxxg.exe
        38⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\nsuhtpyxxg.exe
        
        C:\Users\Admin\AppData\Local\Temp\nsuhtpyxxg.exe update lfbyiljbpl.exe
        39⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        39⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe
        
        C:\Users\Admin\AppData\Local\Temp\lfbyiljbpl.exe update cjbljxgrfx.exe
        40⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\cjbljxgrfx.exe
        
        C:\Users\Admin\AppData\Local\Temp\cjbljxgrfx.exe
        40⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\cjbljxgrfx.exe
        
        C:\Users\Admin\AppData\Local\Temp\cjbljxgrfx.exe update qpunvcwrxo.exe
        41⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\qpunvcwrxo.exe
        
        C:\Users\Admin\AppData\Local\Temp\qpunvcwrxo.exe
        41⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\qpunvcwrxo.exe
        
        C:\Users\Admin\AppData\Local\Temp\qpunvcwrxo.exe update fyainapeiq.exe
        42⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\fyainapeiq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fyainapeiq.exe
        42⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\fyainapeiq.exe
        
        C:\Users\Admin\AppData\Local\Temp\fyainapeiq.exe update vvmzkuihgf.exe
        43⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\vvmzkuihgf.exe
        
        C:\Users\Admin\AppData\Local\Temp\vvmzkuihgf.exe
        43⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\vvmzkuihgf.exe
        
        C:\Users\Admin\AppData\Local\Temp\vvmzkuihgf.exe update ifaxmjlnrt.exe
        44⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\ifaxmjlnrt.exe
        
        C:\Users\Admin\AppData\Local\Temp\ifaxmjlnrt.exe
        44⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\ifaxmjlnrt.exe
        
        C:\Users\Admin\AppData\Local\Temp\ifaxmjlnrt.exe update pyltmedsjx.exe
        45⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\pyltmedsjx.exe
        
        C:\Users\Admin\AppData\Local\Temp\pyltmedsjx.exe
        45⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\pyltmedsjx.exe
        
        C:\Users\Admin\AppData\Local\Temp\pyltmedsjx.exe update kmamkgdkiy.exe
        46⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\kmamkgdkiy.exe
        
        C:\Users\Admin\AppData\Local\Temp\kmamkgdkiy.exe
        46⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\kmamkgdkiy.exe
        
        C:\Users\Admin\AppData\Local\Temp\kmamkgdkiy.exe update krzarzwvhm.exe
        47⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\krzarzwvhm.exe
        
        C:\Users\Admin\AppData\Local\Temp\krzarzwvhm.exe
        47⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\krzarzwvhm.exe
        
        C:\Users\Admin\AppData\Local\Temp\krzarzwvhm.exe update pzqdyhsplo.exe
        48⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\pzqdyhsplo.exe
        
        C:\Users\Admin\AppData\Local\Temp\pzqdyhsplo.exe
        48⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\pzqdyhsplo.exe
        
        C:\Users\Admin\AppData\Local\Temp\pzqdyhsplo.exe update mmxmhqvsjn.exe
        49⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\mmxmhqvsjn.exe
        
        C:\Users\Admin\AppData\Local\Temp\mmxmhqvsjn.exe
        49⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\mmxmhqvsjn.exe
        
        C:\Users\Admin\AppData\Local\Temp\mmxmhqvsjn.exe update zwnqvmviwa.exe
        50⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\zwnqvmviwa.exe
        
        C:\Users\Admin\AppData\Local\Temp\zwnqvmviwa.exe
        50⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\zwnqvmviwa.exe
        
        C:\Users\Admin\AppData\Local\Temp\zwnqvmviwa.exe update jaorayqppb.exe
        51⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        51⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaorayqppb.exe update hyhhdhnnoa.exe
        52⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe
        
        C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe
        52⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe
        
        C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe update uwldeelisn.exe
        53⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\uwldeelisn.exe
        
        C:\Users\Admin\AppData\Local\Temp\uwldeelisn.exe
        53⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\uwldeelisn.exe
        
        C:\Users\Admin\AppData\Local\Temp\uwldeelisn.exe update whyctonoln.exe
        54⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\whyctonoln.exe
        
        C:\Users\Admin\AppData\Local\Temp\whyctonoln.exe
        54⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\whyctonoln.exe
        
        C:\Users\Admin\AppData\Local\Temp\whyctonoln.exe update uyqsmepisw.exe
        55⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\uyqsmepisw.exe
        
        C:\Users\Admin\AppData\Local\Temp\uyqsmepisw.exe
        55⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\uyqsmepisw.exe
        
        C:\Users\Admin\AppData\Local\Temp\uyqsmepisw.exe update bzymdhtbdy.exe
        56⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\bzymdhtbdy.exe
        
        C:\Users\Admin\AppData\Local\Temp\bzymdhtbdy.exe
        56⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\bzymdhtbdy.exe
        
        C:\Users\Admin\AppData\Local\Temp\bzymdhtbdy.exe update wjfpftpmqu.exe
        57⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\wjfpftpmqu.exe
        
        C:\Users\Admin\AppData\Local\Temp\wjfpftpmqu.exe
        57⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\wjfpftpmqu.exe
        
        C:\Users\Admin\AppData\Local\Temp\wjfpftpmqu.exe update yurocdrsju.exe
        58⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        58⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe
        
        C:\Users\Admin\AppData\Local\Temp\yurocdrsju.exe update ovxxuqtlxe.exe
        59⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\ovxxuqtlxe.exe
        
        C:\Users\Admin\AppData\Local\Temp\ovxxuqtlxe.exe
        59⤵
        
        PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bhjzgkcmgx.exe

Path C:\Users\Admin\AppData\Local\Temp\bhjzgkcmgx.exe
Size 10.6MB
SHA256 daaeb5b020f08159d9aff7d2acde4621b2a3499b2054da8c1cd347575ee58058
MD5 32e8e09b75a5615c8ae3a0bc9b4960e6
SHA1 e6eaa5aecb1a3fc5dab8c41c8e59cf1e40821767
SHA512 41a514ecba527df126d1f496b2bdbdd051fe420a660b34397bb65dfc7f43db89def5b0c8702964a55216a5bcd1b09e5340ed35b4bc8f537a9df05f159de39efd
SSDEEP 196608:PZGmuzsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnzsREJLODBWlX3d+NpvdHIol
TLSH
T156B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cnskffdmko.exe

Path C:\Users\Admin\AppData\Local\Temp\cnskffdmko.exe
Size 10.6MB
SHA256 0e633bde3fc9c7799835023b744b7622c1fa287e00f71242a8cf8483ff678eaa
MD5 1b6a90778218ab13d0d13abf24723976
SHA1 7929bb31e3881b04f02c8011839419b376de0faf
SHA512 2c369edddb48082f8ff9572096f8d82337cd833b0a54611c90d5a7abe49e7252be282744a5f8bf51bc4bfb277a514b3d6ac13ce3c19a89878d1b8fad4e5ee248
SSDEEP 196608:PZGmuksR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnksREJLODBWlX3d+NpvdHIol
TLSH
T107B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxiaxrjxtx.exe

Path C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe
Size 10.6MB
SHA256 6e5704045929b0fca06bb4cc1bf03e20ea9198e00361bcf6b16a523ec0a5f152
MD5 e47234c5dd4fe729bfd999616226b34c
SHA1 6e64600323e8fa63cadab342084653d6e8fca8dc
SHA512 38c01dea6d42f90d65b958ff5ec4f90cf73a46153523b61c9d4041331b7af46f8b83c1ad233127f34b048673f592a2944853ac788d14a0e73469c0721012f98f
SSDEEP 196608:PZGmuNsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnNsREJLODBWlX3d+NpvdHIol
TLSH
T164B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dabnzfdjbz.exe

Path C:\Users\Admin\AppData\Local\Temp\dabnzfdjbz.exe
Size 10.6MB
SHA256 df1279b91591798f4bd467aff6f2b06d98dfe65e791500f0485c2bf8df54bb45
MD5 d8a61203f5d5ff06daab576adb53aa4c
SHA1 c30916794125270520f4ca4f2f0b3f5433892a46
SHA512 f7f49994aaa4e591bc8d636224c7ca8353223055fa947975ae855d4ce0e6a6739faeddfb568d7f2840e86055675454238ddd87929f74cfff380da27e9c1e5e82
SSDEEP 196608:PZGmuLsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnLsREJLODBWlX3d+NpvdHIol
TLSH
T1E3B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

duxcfjomqp.exe

Path C:\Users\Admin\AppData\Local\Temp\duxcfjomqp.exe
Size 10.6MB
SHA256 37ed587cbdfbc6bb1ecc5768e80b75b41bfdb5f98d3b1297dabe469713afd648
MD5 e28ccac775c15ff235bc68a0d934cf0e
SHA1 4352598c4d48c0e7dd0d85f47aca75f2a6b3490c
SHA512 06c3cc9da8dae5f5acf5117b8966ba5c7406b4b6b3344cf2a6f67557b3af8c4fe021c90214bc97c0794eb6e580ba6c5357cfe57990c1ef314309dace0320e2bd
SSDEEP 196608:PZGmuosR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnosREJLODBWlX3d+NpvdHIol
TLSH
T18DB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eiwcjqmuou.exe

Path C:\Users\Admin\AppData\Local\Temp\eiwcjqmuou.exe
Size 10.6MB
SHA256 49ee38cab71b29438b19a0bae525be93b76f5bdf1202b748f50462e780b63b7f
MD5 0c01cecd4e450c2fb743375d5bfa4978
SHA1 183a8600a6ad86f1a316948578e9ff81f9034385
SHA512 c6a2243b0c046a4566ed565aa9d0e2a9c6a77fb8ffd220d555bfeaf78231ca3f6f273d6a1f3f5dde6cae7e0d9fa28f0e48b9706979885ab30db2375cc9111337
SSDEEP 196608:PZGmu6sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn6sREJLODBWlX3d+NpvdHIol
TLSH
T1A7B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kittkqcazx.exe

Path C:\Users\Admin\AppData\Local\Temp\kittkqcazx.exe
Size 10.6MB
SHA256 78ac3a11508f21eb97e1845674763103700960bba239e96e76f38b5647aa3b90
MD5 fc431f637b1192def0a3b0c5c4ecbd71
SHA1 25069a0d35d8e37c6085ad9c0e75184a43d76e07
SHA512 20131efe3b0bed56e4d6307cabd74cf1bbf38bd8d4c8fcd3a38c7c289538534d471e2eb79215d3d584f9a1d9b8535f37ca2733bff0138d21c5f599e5215d781c
SSDEEP 196608:PZGmuqsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnqsREJLODBWlX3d+NpvdHIol
TLSH
T1AAB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpsuddxtuu.exe

Path C:\Users\Admin\AppData\Local\Temp\kpsuddxtuu.exe
Size 10.6MB
SHA256 c77a7776175515f7c9b0c725653106d914d7ff6757241ca27bb6c76901afd0e0
MD5 837bc72bd0406ae7308c43618bc81ba7
SHA1 ae4be61b7441cec7eb5ab74a1abb64e1665b96d1
SHA512 9322a65e052e04c91a6a2f66ec77d7d6137d1854259561740d77c704c565b5c8dd1366d21bdfd8ddf9b93f16c818cb9af6851308d750b6aeb8c651064c7c5071
SSDEEP 196608:PZGmu7sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn7sREJLODBWlX3d+NpvdHIol
TLSH
T1D1B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgcltmsuzc.exe

Path C:\Users\Admin\AppData\Local\Temp\mgcltmsuzc.exe
Size 10.6MB
SHA256 4684ac1c0126112c2f69d8851ff31d8ba7f35823cfce70f82bbd02bd9090631d
MD5 f85d857c3106f48e6e74863881a005d6
SHA1 b1a185aef3d79bfaf2a01f158db2399258c781c7
SHA512 8def68d25eec42af9ff5c8f7a9d0e25416106aae1dea624d33bf4051307d3705b9cc7eaf05671b9692e5d30f179018a4201be0a64f4a65bdfeff758362623bc2
SSDEEP 196608:PZGmu2sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn2sREJLODBWlX3d+NpvdHIol
TLSH
T125B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshnsmyhka.exe

Path C:\Users\Admin\AppData\Local\Temp\mshnsmyhka.exe
Size 10.6MB
SHA256 82a44ab8eaaf6649b95ceff7e75cbdd66ede33fbb36fec26e721235df42d3a41
MD5 9e08e5169285c38e6d6ec049448426c8
SHA1 5f6c02353fa96d4807622d3e8950ecc25a312584
SHA512 43a350faed139142e8e592071685e069b991dc91198198e9e0972bc2031aa3918b4ba9cd505c92472375da1654f86f9df66fe8ba7a943339f13106c97c1ff934
SSDEEP 196608:PZGmussR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnssREJLODBWlX3d+NpvdHIol
TLSH
T108B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjatwscflk.exe

Path C:\Users\Admin\AppData\Local\Temp\qjatwscflk.exe
Size 10.6MB
SHA256 7cf7ee1c155aa6471ee3b33942d1dde9903c8cd4d1df33003e260f56e0f284fd
MD5 3c647b6783b7843cb4b64ddcfbebfa86
SHA1 7e73d2777cdb88e8344c6a79029c495d0b888c9d
SHA512 cbe5bd1ac4447b5e88caa42d2073b7de44884f1fdbcbf5838e2b2a4b8673b00943aaddb6e1a2403b2988262ea6c5537c4ce8831dcf5d8edfa45b376528c0f27c
SSDEEP 196608:PZGmuwsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnwsREJLODBWlX3d+NpvdHIol
TLSH
T153B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rldbupyktp.exe

Path C:\Users\Admin\AppData\Local\Temp\rldbupyktp.exe
Size 10.6MB
SHA256 e00ce9882f2683abc62a55dad39a19f97242424630652cf4e5baa05ec1737090
MD5 ef63a3ffa0782ec24a9e2339a3181bd2
SHA1 65f007b451e5b1dd7cc4015ceb5bd7e3993f42d5
SHA512 2af373e3fffd72f1e11548599a1e8394ca58466c1bca0f5f85a24d30d3e300e587b64b448bbbbb46dc2874d33b436b34f71fd1fd8ce0723a1a2e04e3342a58dd
SSDEEP 196608:PZGmuAsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnAsREJLODBWlX3d+NpvdHIol
TLSH
T109B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqdkcgdjld.exe

Path C:\Users\Admin\AppData\Local\Temp\tqdkcgdjld.exe
Size 10.6MB
SHA256 10214073494227c655d2cb83b010e3f64cbeeb7b6c2f61a89209af08ebfe8ed4
MD5 6f64c7622b592bb26cd8752ea8f8e31d
SHA1 3ef0a82d509d749b9a9cc30978d3ed24b909d3d6
SHA512 bbbcef25f9b571e092b35f2a8d60542580a489d6bec75506e286d0c789aaceaf052d1247988ff91c8b87b8f2c044824b03c5e90a75fd5d93fd2d5b8ca30a9966
SSDEEP 196608:PZGmu/sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn/sREJLODBWlX3d+NpvdHIol
TLSH
T16CB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trskyizkuy.exe

Path C:\Users\Admin\AppData\Local\Temp\trskyizkuy.exe
Size 10.6MB
SHA256 4e17fdbce293cf239a6e405eda12f9a5982aca6c65982c8c28e7bc47fb70c783
MD5 3fbd694fdeb81af692accc82c96aee29
SHA1 b4f2a9ff879c1f35ce36a6ffa775988d1ff843a8
SHA512 405c1d7cda5d9168061e2ebccef131045049a2214f89ff8c80cd13e0acdd57c0ad1e2d84bc7e841909ff1a7e4bcb1da8835a861a325af958f332620d97b92632
SSDEEP 196608:PZGmuAsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnAsREJLODBWlX3d+NpvdHIol
TLSH
T1D9B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 d30cf3f51cf2a0685cb84d4e2e283b584aad6acea87cafdb626a600f2c549ace
MD5 0a48cbad28fc486e3ae9869e966245d8
SHA1 0b34c74faae04ffff208f81ef484c66437d56ee7
SHA512 926ae6915cf0ddb305a3f71d3a3da2e96175c17eb9f4e56700beeb7fa72cd6baf39e02fb7d5e405aa8dddaf753e4cf11acd623195ae3e9e31718f80c203d37d8
SSDEEP 196608:PZGmu3sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn3sREJLODBWlX3d+NpvdHIol
TLSH
T1F6B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 921dd0c6ac9768409b7d381f9388acdeb3bc5fdef825b9fa157df098710c45de
MD5 52ddf34e45592471633d2df8e5e73019
SHA1 2f6f16140cce56749e7cac20a22e0fadd624cf7b
SHA512 ad75a5f9b315d69b3e8c50bc16dfea540c7995107a64e2f4588557ff0de2dcb056dc6e0f5aa11e240285beae65cce54a2f48284b75c32e481411b990de6ace91
SSDEEP 196608:PZGmu5sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn5sREJLODBWlX3d+NpvdHIol
TLSH
T19EB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 8e471945914163870f491b5583a67cc41a76f4d19428216eedaddfd7b41678df
MD5 ef035765d606c328a1ba49b3f98428eb
SHA1 4eec2a16dff783432a73f1d13774d21228a33a5c
SHA512 d804f9d45fc424d14abbe9333ff494d49769dca8002a64b80ef02b29f79f64ac7c7bba9ac20a810be3738c3da7bc934e61c4569f40583e3b69dd12752694405f
SSDEEP 196608:PZGmuGsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnGsREJLODBWlX3d+NpvdHIol
TLSH
T11EB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 19b4fb3374f2a8a9228f7f80049c04d3048b36231fbc94fa38ec5d5d7f4f8708
MD5 14cd4299a4756d088648413234362bc1
SHA1 e44bc9165a02c21a41c6c603270a4217a4befa64
SHA512 687fceaf12bdd4371f978dd38c5909781a8246ae74c668e8cf284a25e28605219a78bd49adee8a45d559bdbc6085840a41109f311ceb60ae15fc7c71f7185b2f
SSDEEP 196608:PZGmugsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGngsREJLODBWlX3d+NpvdHIol
TLSH
T198B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 b835e39363562cd442347e30ff72f99e55ef7ec236626f234cc9939c3d94b7db
MD5 89b0a262815340be11572ab5c7910e60
SHA1 367f6c9761bc4be457ee7640a110aad4579b2cb7
SHA512 e04bd43ef3cee918f1080be63690cb9e5c8aedd20dddfc3f0c58631c58d4e9719c311d0612b9db69934254b4bc7b0069b92cf53d9324d26ddb02d4c19f40dcc0
SSDEEP 196608:PZGmursR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnrsREJLODBWlX3d+NpvdHIol
TLSH
T1BDB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 9339ad5f5b3a29e159d635974f3aa55e6712da2fdc4c09f1a1e14ee0923ea7dc
MD5 416aa2701faf84efb239164660216f33
SHA1 7bfd30a0fbca8e7eed0c4613406a6287539f4515
SHA512 3d3cd0fa64f1925baf7503ffe5e3e3936e7f6205bf9171c1f9e69d089e377ddc95c1dcff0943a3ceece4918a20b721cd8ef1411db494a5e8235a9d82496e8ca3
SSDEEP 196608:PZGmuisR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnisREJLODBWlX3d+NpvdHIol
TLSH
T1C6B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 340e5d2d1182fd99ccd061099c9f8608ff21b12a4adb3741b43db5ecb44271ed
MD5 6d3c8a575cd230753297a5901011a787
SHA1 aa8ffea7fd12e2db6ad650159b844e690f211c50
SHA512 f5d626d32cfd409859eb8054806b58049b977f7657d0f94a5acd1d9f13ad99f6247a327a68d66d88fdcf25aab668ddd7db558e20517b4c21a74c56984730a76d
SSDEEP 196608:PZGmussR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnssREJLODBWlX3d+NpvdHIol
TLSH
T1EDB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 aec6e76985ab4a3641eafc8f932a637429cdcb67f1f89b0ce0a0ce2f32f75890
MD5 29fb1b6d50159810429143b92b8532c3
SHA1 7ff5874296dd66227bd088059dec61948b066c88
SHA512 7df497704416bcd428a878605e241b08d44e5373fdc657cb17d431f97a557e835beab06cc78d8d7c100e76c1dfec1d35aecb49a89b920b141503cf134b9d5b35
SSDEEP 196608:PZGmuxsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnxsREJLODBWlX3d+NpvdHIol
TLSH
T1AAB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 fe43fe931eff6a0799ab654736c3c2805a45b7b9e0d9e4a80201109e2f5b675d
MD5 4be4ab4784a9d06fcfbee47f86a1124c
SHA1 d60d6331ffd1e040308bbfba42084389df42c6b8
SHA512 8d292cda71d9f1ec0fe7bfbe10a4b24465278b5a6ec5aedbfa354c9590d24dd6e037998e52204f0583b76054098baaa315ca281723eee63114a0a73fded549c0
SSDEEP 196608:PZGmuXsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnXsREJLODBWlX3d+NpvdHIol
TLSH
T118B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 10.6MB
SHA256 4bad10ac4a982c357cde9cbd8052aa3da543aa312b2c109acc9dbde76fed6f33
MD5 f5fe28bd012af80fdc3faf9f49d76467
SHA1 0f320b6604c09d929a1d55cb8dc7e90467b16bac
SHA512 25cf4e073e189338c6c584b419ce460eec9ab5430635fba1cdc08d07932ad8b519903102c4d298e580edb5ff05a8aa3d4e25815af19a3126d6d6374f765fb194
SSDEEP 196608:PZGmuZsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnZsREJLODBWlX3d+NpvdHIol
TLSH
T1BDB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vwazgnfwin.exe

Path C:\Users\Admin\AppData\Local\Temp\vwazgnfwin.exe
Size 10.6MB
SHA256 cd5caf0a652d23f64790245447bb34cfefafac8feda713e16faad8fceca5d80d
MD5 70e4360578153baebc5575678adff9ee
SHA1 6a2b627656a855d5c48c27c7f2449253568dd917
SHA512 b6f0d8e0b070a3321b0c0dc2e7416b394c0ee8b94c5e392b17c8c173046cb2a24c9091faf39c14dbb3ef7ed933da5f5086bfe68f461f9101809b0f3e1aa8907c
SSDEEP 196608:PZGmuPsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGnPsREJLODBWlX3d+NpvdHIol
TLSH
T179B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xbbpvfniia.exe

Path C:\Users\Admin\AppData\Local\Temp\xbbpvfniia.exe
Size 10.6MB
SHA256 209e035431d9c4dc13d50a06c9168165ea1f798c5b8d3648000c88658fbbacb4
MD5 4a2a4aee72bedf3194c68b9eaf2a637d
SHA1 3f0bab2084d5991233a1d16776516de58a7e387d
SHA512 f2586dd489495b6c03e3cec66f671ee299f7b3474310f494080b532beccace12270f946178569bc3c66305c3384ae5475f4d0b3399614bd6f6769bad1426a9af
SSDEEP 196608:PZGmu3sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn3sREJLODBWlX3d+NpvdHIol
TLSH
T1F5B61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zhrxqkrvxf.exe

Path C:\Users\Admin\AppData\Local\Temp\zhrxqkrvxf.exe
Size 10.6MB
SHA256 805f7273a3a2769161bfc0cb135eb9240eb7c9dc3133d9bb7b1d05238b608816
MD5 e12b7cddb716b4033cffb78d93c0654e
SHA1 2b9b38fbab38cd143c1c92aa7fb76bc56fd91484
SHA512 cfb9066fe413274f1045fa495efd41911d5ab43a88bedbfe38ee7b4ce15ae372929729558140f3013adf7c1b3855ecbdb5355cee6bdbf5db07d60579cc4d061f
SSDEEP 196608:PZGmu8sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn8sREJLODBWlX3d+NpvdHIol
TLSH
T19CB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zulamadjbt.exe

Path C:\Users\Admin\AppData\Local\Temp\zulamadjbt.exe
Size 10.6MB
SHA256 0d4561f5702a3a237283dceab06f7aeb747f8ce5417f3e539297fda7a94f19e0
MD5 dece79a3a5edda00715315038b7e58ac
SHA1 2f9457390c5bae0252dcb4baa36046429ac6c927
SHA512 904cac18c0fe2eb2b2e876fb71f5375dcabc770d9540fdd619be80fad98148f8d1c5c0f10ec29c33e53197ece5c7ed33b070148106060701e08551c1f395eecb
SSDEEP 196608:PZGmu6sR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSw:PZGn6sREJLODBWlX3d+NpvdHIol
TLSH
T13BB61233A1908066D289193956736F3879F897595EB0CCB3F7E4ECE22D724E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-118-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/564-119-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/720-8-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/720-7-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/768-150-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/812-101-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1148-46-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1148-45-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/1224-155-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1268-63-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1268-62-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/1304-24-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/1304-25-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1432-171-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1444-73-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/1612-179-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2156-2-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/2156-3-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2368-168-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2376-104-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2392-194-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2448-36-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2556-112-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2748-33-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2748-32-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/2796-43-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2972-165-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/2988-139-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/2988-140-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3292-91-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3360-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/3360-0-0x0000000002D40000-0x0000000002D41000-memory.dmp

Download

memory/4220-192-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4372-127-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4484-11-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4484-10-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4516-81-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4524-94-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4612-28-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4760-15-0x0000000002C00000-0x0000000002C01000-memory.dmp

Download

memory/4760-16-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4852-177-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/4884-187-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5004-56-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5004-55-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/5060-53-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5376-189-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5516-19-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5516-18-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/5540-76-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5560-160-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5640-66-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5680-184-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5700-130-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5736-109-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5816-147-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5828-135-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5828-134-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/5848-122-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/5888-86-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6012-197-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6036-181-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/6036-182-0x0000000000400000-0x0000000000E90000-memory.dmp

Download

memory/6056-173-0x0000000000400000-0x0000000000E90000-memory.dmp

Download