Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe
Resource
win10v2004-20240426-en
General
-
Target
8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe
-
Size
448KB
-
MD5
832a45c68255355a4afda0c7634295ed
-
SHA1
3c91743c3f36a1d4295a6a4ca0ffa59181a937c5
-
SHA256
8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c
-
SHA512
14a3d7d6813c26b72e147134d8a1a130d352dcd4847d05d19660e6dfbf609af8cdf61bf025436c9d85fdf6380dee26dd864cfb07786ea689653ea538b6ee01f3
-
SSDEEP
6144:Cc1I07FfYYRv0tjdA5qBdpWiFokEjWbjcSbcY+CaQdaFOY4iGFYtR:F6sZYYRv0tjdTdzFokFbz+xt4vF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation JCE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XVZVE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IGL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BTNUSKM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZGSNJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RTVPZN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation NDY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BEKSUIT.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UHM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CEZSR.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VGBD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VLMEQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AKZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UZRKZOI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation GCSC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XLIVWO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZUEUC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EOF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SUQL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IRESCLQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UVRDLKM.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HCB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OFNG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation JGIN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MRC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VSUXPQJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MXX.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation THB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ATVE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QYZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation GOAMGW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KAPHXHO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KAC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CPITFLK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IKH.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KQWNKCA.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XPYWTU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DPNG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation COCTXSJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DMQAQO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SHPB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation NRVW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SIMPRXI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EREHTVI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation USSBIP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZOPHALU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PPWY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HAIFDC.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CUYUID.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SZZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QLYGNP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation GXKK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AMALU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BUKCP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation YVXZNTZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ADGVMN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AQZVBEY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ARTL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OZJXIU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PBD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZVKVFWB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QHGKH.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DVT.exe -
Executes dropped EXE 64 IoCs
pid Process 3136 LHZWPSV.exe 1844 QHGKH.exe 456 KQWNKCA.exe 3868 OYCN.exe 492 MWQF.exe 4284 XOTYMI.exe 1048 PKXT.exe 4976 JCE.exe 1700 UVHX.exe 3972 RTVPZN.exe 2968 XVZVE.exe 4004 VGBD.exe 4572 AMUSD.exe 2564 ARMHE.exe 2304 PPZYUI.exe 4832 KDEIEIA.exe 2972 DVT.exe 3168 AWVDSFR.exe 4184 BRZZF.exe 4900 DMQAQO.exe 1184 AMALU.exe 5116 ZXDB.exe 5092 RAHWQO.exe 4828 JBV.exe 2824 PBDH.exe 4880 EREHTVI.exe 2980 PJH.exe 3608 FZUR.exe 3600 UVRDLKM.exe 3988 JYBIE.exe 5064 JDBWFK.exe 1656 MQSYQDF.exe 4536 IGMOCCB.exe 4704 WUYGHZR.exe 3100 QPDQ.exe 4956 YVH.exe 4768 VANUJ.exe 3804 SBXW.exe 3304 WJEEZV.exe 4836 NRKBMMV.exe 2392 XPYWTU.exe 4168 BXEW.exe 4660 HSDEKI.exe 316 FSLSTKQ.exe 2736 RVW.exe 2468 PTU.exe 2316 GEFYXWX.exe 776 THB.exe 3908 DFHRJW.exe 3716 SAY.exe 4084 AQZVBEY.exe 3992 ATDQ.exe 2976 IGI.exe 5060 WJY.exe 3344 HCB.exe 952 JZU.exe 1568 OFNG.exe 1428 ISRPMV.exe 2280 GNJQRY.exe 5108 BYZPFJ.exe 4132 ZZHCODJ.exe 4456 HELJZJ.exe 3348 GPKHYW.exe 4228 BCBJSPP.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\UQB.exe HSBQU.exe File opened for modification C:\windows\SysWOW64\XVZVE.exe RTVPZN.exe File created C:\windows\SysWOW64\RVW.exe.bat FSLSTKQ.exe File created C:\windows\SysWOW64\FREG.exe PBD.exe File opened for modification C:\windows\SysWOW64\CXAFMSR.exe YUCSMZO.exe File opened for modification C:\windows\SysWOW64\NQKNVIE.exe JAENJYQ.exe File created C:\windows\SysWOW64\FEPQND.exe HOQNBR.exe File created C:\windows\SysWOW64\BCC.exe AMURZNL.exe File created C:\windows\SysWOW64\IPR.exe JEHE.exe File created C:\windows\SysWOW64\HKDEPZV.exe.bat DCWED.exe File opened for modification C:\windows\SysWOW64\IGL.exe BNWKOSQ.exe File created C:\windows\SysWOW64\JWPATR.exe MDFXHVI.exe File opened for modification C:\windows\SysWOW64\JBV.exe RAHWQO.exe File created C:\windows\SysWOW64\IWX.exe TGKAD.exe File created C:\windows\SysWOW64\NRVW.exe.bat EOF.exe File opened for modification C:\windows\SysWOW64\HKDEPZV.exe DCWED.exe File created C:\windows\SysWOW64\KAPHXHO.exe KMXTVUT.exe File created C:\windows\SysWOW64\RVW.exe FSLSTKQ.exe File created C:\windows\SysWOW64\ZZHCODJ.exe BYZPFJ.exe File created C:\windows\SysWOW64\HDDORU.exe.bat USSBIP.exe File opened for modification C:\windows\SysWOW64\IPR.exe JEHE.exe File created C:\windows\SysWOW64\HKDEPZV.exe DCWED.exe File opened for modification C:\windows\SysWOW64\PBDH.exe JBV.exe File created C:\windows\SysWOW64\EREHTVI.exe PBDH.exe File opened for modification C:\windows\SysWOW64\YVH.exe QPDQ.exe File created C:\windows\SysWOW64\NFUU.exe VKDRQL.exe File opened for modification C:\windows\SysWOW64\RAHWQO.exe ZXDB.exe File opened for modification C:\windows\SysWOW64\GPKHYW.exe HELJZJ.exe File created C:\windows\SysWOW64\CXAFMSR.exe.bat YUCSMZO.exe File created C:\windows\SysWOW64\NQKNVIE.exe JAENJYQ.exe File created C:\windows\SysWOW64\UPASYV.exe FHZBSAH.exe File opened for modification C:\windows\SysWOW64\AWVDSFR.exe DVT.exe File created C:\windows\SysWOW64\JBV.exe.bat RAHWQO.exe File opened for modification C:\windows\SysWOW64\JEHE.exe YMM.exe File created C:\windows\SysWOW64\IPR.exe.bat JEHE.exe File created C:\windows\SysWOW64\NFUU.exe.bat VKDRQL.exe File created C:\windows\SysWOW64\AWVDSFR.exe.bat DVT.exe File opened for modification C:\windows\SysWOW64\GEFYXWX.exe PTU.exe File created C:\windows\SysWOW64\QLNI.exe.bat ESFXXS.exe File created C:\windows\SysWOW64\HDPW.exe NQKNVIE.exe File opened for modification C:\windows\SysWOW64\ZGSNJ.exe RTFYY.exe File opened for modification C:\windows\SysWOW64\RMGKJ.exe PWXN.exe File created C:\windows\SysWOW64\ARMHE.exe.bat AMUSD.exe File opened for modification C:\windows\SysWOW64\AMALU.exe DMQAQO.exe File created C:\windows\SysWOW64\JBV.exe RAHWQO.exe File created C:\windows\SysWOW64\OATK.exe QLNI.exe File created C:\windows\SysWOW64\MDFXHVI.exe NFUU.exe File created C:\windows\SysWOW64\BRZZF.exe.bat AWVDSFR.exe File created C:\windows\SysWOW64\RMGKJ.exe PWXN.exe File created C:\windows\SysWOW64\FHZBSAH.exe.bat ZGSNJ.exe File created C:\windows\SysWOW64\SHPB.exe.bat FFLDO.exe File opened for modification C:\windows\SysWOW64\ABUWG.exe CFVW.exe File opened for modification C:\windows\SysWOW64\KAPHXHO.exe KMXTVUT.exe File opened for modification C:\windows\SysWOW64\ZZHCODJ.exe BYZPFJ.exe File created C:\windows\SysWOW64\ZZHCODJ.exe.bat BYZPFJ.exe File created C:\windows\SysWOW64\GPKHYW.exe HELJZJ.exe File created C:\windows\SysWOW64\KLJOW.exe HDDORU.exe File created C:\windows\SysWOW64\QLNI.exe ESFXXS.exe File opened for modification C:\windows\SysWOW64\CEZSR.exe FEPQND.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat IKH.exe File created C:\windows\SysWOW64\MDFXHVI.exe.bat NFUU.exe File created C:\windows\SysWOW64\SUQL.exe.bat UZRKZOI.exe File created C:\windows\SysWOW64\AMALU.exe DMQAQO.exe File created C:\windows\SysWOW64\PBDH.exe.bat JBV.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\HCB.exe.bat WJY.exe File created C:\windows\UZRKZOI.exe.bat OZJXIU.exe File created C:\windows\RTFYY.exe ADGVMN.exe File created C:\windows\BAWT.exe.bat KAC.exe File created C:\windows\FZDB.exe.bat FWZFY.exe File created C:\windows\YUCSMZO.exe.bat ATVE.exe File opened for modification C:\windows\JGIN.exe HKDEPZV.exe File created C:\windows\system\PJH.exe EREHTVI.exe File opened for modification C:\windows\system\BXEW.exe XPYWTU.exe File created C:\windows\KNFO.exe ZVKVFWB.exe File created C:\windows\system\VSUXPQJ.exe GXKK.exe File opened for modification C:\windows\PWXN.exe JWPATR.exe File created C:\windows\system\OYCN.exe.bat KQWNKCA.exe File created C:\windows\MQSYQDF.exe JDBWFK.exe File opened for modification C:\windows\MVW.exe BCBJSPP.exe File created C:\windows\MVW.exe.bat BCBJSPP.exe File created C:\windows\system\AMURZNL.exe VLMEQ.exe File created C:\windows\TGKAD.exe JGIN.exe File opened for modification C:\windows\system\KOI.exe IQUTEE.exe File created C:\windows\DYGDAX.exe VSUXPQJ.exe File created C:\windows\PNNYSIP.exe RMGKJ.exe File created C:\windows\system\BXEW.exe.bat XPYWTU.exe File created C:\windows\BCBJSPP.exe.bat GPKHYW.exe File created C:\windows\SNPHD.exe.bat GCSC.exe File created C:\windows\PBD.exe NDY.exe File created C:\windows\system\YMM.exe QYZ.exe File opened for modification C:\windows\system\BEKSUIT.exe ABUWG.exe File created C:\windows\system\IQUTEE.exe.bat DPNG.exe File opened for modification C:\windows\XLIVWO.exe SIMPRXI.exe File opened for modification C:\windows\LHZWPSV.exe 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe File created C:\windows\system\BUKCP.exe.bat BCC.exe File opened for modification C:\windows\system\LCFBUET.exe MRC.exe File created C:\windows\WJEEZV.exe SBXW.exe File created C:\windows\DCT.exe ZUEUC.exe File created C:\windows\system\KOI.exe IQUTEE.exe File created C:\windows\system\GCSC.exe CUYUID.exe File created C:\windows\XLIVWO.exe SIMPRXI.exe File created C:\windows\system\DVT.exe.bat KDEIEIA.exe File created C:\windows\system\AMURZNL.exe.bat VLMEQ.exe File created C:\windows\system\NDY.exe DFSAMQ.exe File created C:\windows\system\ATVE.exe FREG.exe File created C:\windows\KMXTVUT.exe.bat IOKHGMK.exe File opened for modification C:\windows\BYZPFJ.exe GNJQRY.exe File created C:\windows\system\QYZ.exe OATK.exe File created C:\windows\system\UBBXX.exe.bat AFXO.exe File opened for modification C:\windows\system\ADGVMN.exe YVXZNTZ.exe File created C:\windows\HOQNBR.exe KNGDXNW.exe File created C:\windows\system\LCFBUET.exe.bat MRC.exe File opened for modification C:\windows\AKZ.exe ARZ.exe File opened for modification C:\windows\KNFO.exe ZVKVFWB.exe File created C:\windows\system\ARTL.exe.bat ZOPHALU.exe File created C:\windows\system\GOAMGW.exe HDPW.exe File opened for modification C:\windows\FZDB.exe FWZFY.exe File created C:\windows\system\AMUSD.exe.bat VGBD.exe File created C:\windows\PBD.exe.bat NDY.exe File created C:\windows\TGKAD.exe.bat JGIN.exe File created C:\windows\system\PPWY.exe.bat NRVW.exe File created C:\windows\DYGDAX.exe.bat VSUXPQJ.exe File created C:\windows\LHZWPSV.exe 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe File created C:\windows\FZUR.exe PJH.exe File created C:\windows\system\ECLYW.exe BUKCP.exe File opened for modification C:\windows\system\COCTXSJ.exe KOI.exe File created C:\windows\system\FWZFY.exe.bat DYGDAX.exe File created C:\windows\system\OVUORW.exe KNFO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 2280 1736 WerFault.exe 80 2812 3136 WerFault.exe 88 788 1844 WerFault.exe 94 2604 456 WerFault.exe 99 4616 3868 WerFault.exe 104 4852 492 WerFault.exe 111 1860 4284 WerFault.exe 116 4704 1048 WerFault.exe 123 4516 4976 WerFault.exe 128 1676 1700 WerFault.exe 133 1364 3972 WerFault.exe 139 2568 2968 WerFault.exe 144 488 4004 WerFault.exe 149 2980 4572 WerFault.exe 154 544 2564 WerFault.exe 161 924 2304 WerFault.exe 166 4828 4832 WerFault.exe 171 4580 2972 WerFault.exe 176 1744 3168 WerFault.exe 181 4220 4184 WerFault.exe 186 2412 4900 WerFault.exe 191 1276 1184 WerFault.exe 196 388 5116 WerFault.exe 201 2892 5092 WerFault.exe 206 456 4828 WerFault.exe 211 896 2824 WerFault.exe 216 3468 4880 WerFault.exe 221 2916 2980 WerFault.exe 226 544 3608 WerFault.exe 231 4372 3600 WerFault.exe 236 2904 3988 WerFault.exe 241 752 5064 WerFault.exe 246 4828 1656 WerFault.exe 251 4572 4536 WerFault.exe 256 4880 4704 WerFault.exe 261 4364 3100 WerFault.exe 266 3816 4956 WerFault.exe 271 4376 4768 WerFault.exe 277 5096 3804 WerFault.exe 282 3956 3304 WerFault.exe 287 5032 4836 WerFault.exe 292 8 2392 WerFault.exe 297 668 4168 WerFault.exe 302 3992 4660 WerFault.exe 307 3896 316 WerFault.exe 312 5100 2736 WerFault.exe 317 3332 2468 WerFault.exe 322 4004 2316 WerFault.exe 327 3640 776 WerFault.exe 332 2080 3908 WerFault.exe 337 3800 3716 WerFault.exe 342 544 4084 WerFault.exe 347 1640 3992 WerFault.exe 352 2192 2976 WerFault.exe 357 1596 5060 WerFault.exe 362 3340 3344 WerFault.exe 367 4988 952 WerFault.exe 372 2784 1568 WerFault.exe 377 1064 1428 WerFault.exe 382 4864 2280 WerFault.exe 387 820 5108 WerFault.exe 392 4368 4132 WerFault.exe 397 4336 4456 WerFault.exe 402 3056 3348 WerFault.exe 407 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 3136 LHZWPSV.exe 3136 LHZWPSV.exe 1844 QHGKH.exe 1844 QHGKH.exe 456 KQWNKCA.exe 456 KQWNKCA.exe 3868 OYCN.exe 3868 OYCN.exe 492 MWQF.exe 492 MWQF.exe 4284 XOTYMI.exe 4284 XOTYMI.exe 1048 PKXT.exe 1048 PKXT.exe 4976 JCE.exe 4976 JCE.exe 1700 UVHX.exe 1700 UVHX.exe 3972 RTVPZN.exe 3972 RTVPZN.exe 2968 XVZVE.exe 2968 XVZVE.exe 4004 VGBD.exe 4004 VGBD.exe 4572 AMUSD.exe 4572 AMUSD.exe 2564 ARMHE.exe 2564 ARMHE.exe 2304 PPZYUI.exe 2304 PPZYUI.exe 4832 KDEIEIA.exe 4832 KDEIEIA.exe 2972 DVT.exe 2972 DVT.exe 3168 AWVDSFR.exe 3168 AWVDSFR.exe 4184 BRZZF.exe 4184 BRZZF.exe 4900 DMQAQO.exe 4900 DMQAQO.exe 1184 AMALU.exe 1184 AMALU.exe 5116 ZXDB.exe 5116 ZXDB.exe 5092 RAHWQO.exe 5092 RAHWQO.exe 4828 JBV.exe 4828 JBV.exe 2824 PBDH.exe 2824 PBDH.exe 4880 EREHTVI.exe 4880 EREHTVI.exe 2980 PJH.exe 2980 PJH.exe 3608 FZUR.exe 3608 FZUR.exe 3600 UVRDLKM.exe 3600 UVRDLKM.exe 3988 JYBIE.exe 3988 JYBIE.exe 5064 JDBWFK.exe 5064 JDBWFK.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 3136 LHZWPSV.exe 3136 LHZWPSV.exe 1844 QHGKH.exe 1844 QHGKH.exe 456 KQWNKCA.exe 456 KQWNKCA.exe 3868 OYCN.exe 3868 OYCN.exe 492 MWQF.exe 492 MWQF.exe 4284 XOTYMI.exe 4284 XOTYMI.exe 1048 PKXT.exe 1048 PKXT.exe 4976 JCE.exe 4976 JCE.exe 1700 UVHX.exe 1700 UVHX.exe 3972 RTVPZN.exe 3972 RTVPZN.exe 2968 XVZVE.exe 2968 XVZVE.exe 4004 VGBD.exe 4004 VGBD.exe 4572 AMUSD.exe 4572 AMUSD.exe 2564 ARMHE.exe 2564 ARMHE.exe 2304 PPZYUI.exe 2304 PPZYUI.exe 4832 KDEIEIA.exe 4832 KDEIEIA.exe 2972 DVT.exe 2972 DVT.exe 3168 AWVDSFR.exe 3168 AWVDSFR.exe 4184 BRZZF.exe 4184 BRZZF.exe 4900 DMQAQO.exe 4900 DMQAQO.exe 1184 AMALU.exe 1184 AMALU.exe 5116 ZXDB.exe 5116 ZXDB.exe 5092 RAHWQO.exe 5092 RAHWQO.exe 4828 JBV.exe 4828 JBV.exe 2824 PBDH.exe 2824 PBDH.exe 4880 EREHTVI.exe 4880 EREHTVI.exe 2980 PJH.exe 2980 PJH.exe 3608 FZUR.exe 3608 FZUR.exe 3600 UVRDLKM.exe 3600 UVRDLKM.exe 3988 JYBIE.exe 3988 JYBIE.exe 5064 JDBWFK.exe 5064 JDBWFK.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4784 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 84 PID 1736 wrote to memory of 4784 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 84 PID 1736 wrote to memory of 4784 1736 8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe 84 PID 4784 wrote to memory of 3136 4784 cmd.exe 88 PID 4784 wrote to memory of 3136 4784 cmd.exe 88 PID 4784 wrote to memory of 3136 4784 cmd.exe 88 PID 3136 wrote to memory of 2108 3136 LHZWPSV.exe 90 PID 3136 wrote to memory of 2108 3136 LHZWPSV.exe 90 PID 3136 wrote to memory of 2108 3136 LHZWPSV.exe 90 PID 2108 wrote to memory of 1844 2108 cmd.exe 94 PID 2108 wrote to memory of 1844 2108 cmd.exe 94 PID 2108 wrote to memory of 1844 2108 cmd.exe 94 PID 1844 wrote to memory of 4904 1844 QHGKH.exe 95 PID 1844 wrote to memory of 4904 1844 QHGKH.exe 95 PID 1844 wrote to memory of 4904 1844 QHGKH.exe 95 PID 4904 wrote to memory of 456 4904 cmd.exe 99 PID 4904 wrote to memory of 456 4904 cmd.exe 99 PID 4904 wrote to memory of 456 4904 cmd.exe 99 PID 456 wrote to memory of 3400 456 KQWNKCA.exe 100 PID 456 wrote to memory of 3400 456 KQWNKCA.exe 100 PID 456 wrote to memory of 3400 456 KQWNKCA.exe 100 PID 3400 wrote to memory of 3868 3400 cmd.exe 104 PID 3400 wrote to memory of 3868 3400 cmd.exe 104 PID 3400 wrote to memory of 3868 3400 cmd.exe 104 PID 3868 wrote to memory of 4584 3868 OYCN.exe 107 PID 3868 wrote to memory of 4584 3868 OYCN.exe 107 PID 3868 wrote to memory of 4584 3868 OYCN.exe 107 PID 4584 wrote to memory of 492 4584 cmd.exe 111 PID 4584 wrote to memory of 492 4584 cmd.exe 111 PID 4584 wrote to memory of 492 4584 cmd.exe 111 PID 492 wrote to memory of 4576 492 MWQF.exe 112 PID 492 wrote to memory of 4576 492 MWQF.exe 112 PID 492 wrote to memory of 4576 492 MWQF.exe 112 PID 4576 wrote to memory of 4284 4576 cmd.exe 116 PID 4576 wrote to memory of 4284 4576 cmd.exe 116 PID 4576 wrote to memory of 4284 4576 cmd.exe 116 PID 4284 wrote to memory of 1644 4284 XOTYMI.exe 119 PID 4284 wrote to memory of 1644 4284 XOTYMI.exe 119 PID 4284 wrote to memory of 1644 4284 XOTYMI.exe 119 PID 1644 wrote to memory of 1048 1644 cmd.exe 123 PID 1644 wrote to memory of 1048 1644 cmd.exe 123 PID 1644 wrote to memory of 1048 1644 cmd.exe 123 PID 1048 wrote to memory of 2124 1048 PKXT.exe 124 PID 1048 wrote to memory of 2124 1048 PKXT.exe 124 PID 1048 wrote to memory of 2124 1048 PKXT.exe 124 PID 2124 wrote to memory of 4976 2124 cmd.exe 128 PID 2124 wrote to memory of 4976 2124 cmd.exe 128 PID 2124 wrote to memory of 4976 2124 cmd.exe 128 PID 4976 wrote to memory of 3360 4976 JCE.exe 129 PID 4976 wrote to memory of 3360 4976 JCE.exe 129 PID 4976 wrote to memory of 3360 4976 JCE.exe 129 PID 3360 wrote to memory of 1700 3360 cmd.exe 133 PID 3360 wrote to memory of 1700 3360 cmd.exe 133 PID 3360 wrote to memory of 1700 3360 cmd.exe 133 PID 1700 wrote to memory of 3648 1700 UVHX.exe 134 PID 1700 wrote to memory of 3648 1700 UVHX.exe 134 PID 1700 wrote to memory of 3648 1700 UVHX.exe 134 PID 3648 wrote to memory of 3972 3648 cmd.exe 139 PID 3648 wrote to memory of 3972 3648 cmd.exe 139 PID 3648 wrote to memory of 3972 3648 cmd.exe 139 PID 3972 wrote to memory of 3988 3972 RTVPZN.exe 140 PID 3972 wrote to memory of 3988 3972 RTVPZN.exe 140 PID 3972 wrote to memory of 3988 3972 RTVPZN.exe 140 PID 3988 wrote to memory of 2968 3988 cmd.exe 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe"C:\Users\Admin\AppData\Local\Temp\8261e9f4b828aff9ac6e8671686e62582d2a6ac736c24ae8c5dc0d126510594c.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHZWPSV.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\LHZWPSV.exeC:\windows\LHZWPSV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHGKH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\system\QHGKH.exeC:\windows\system\QHGKH.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KQWNKCA.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\KQWNKCA.exeC:\windows\KQWNKCA.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYCN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\system\OYCN.exeC:\windows\system\OYCN.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWQF.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\system\MWQF.exeC:\windows\system\MWQF.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOTYMI.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\system\XOTYMI.exeC:\windows\system\XOTYMI.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PKXT.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\system\PKXT.exeC:\windows\system\PKXT.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JCE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\SysWOW64\JCE.exeC:\windows\system32\JCE.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVHX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\UVHX.exeC:\windows\UVHX.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTVPZN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\SysWOW64\RTVPZN.exeC:\windows\system32\RTVPZN.exe21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVZVE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\SysWOW64\XVZVE.exeC:\windows\system32\XVZVE.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGBD.exe.bat" "24⤵PID:3620
-
C:\windows\system\VGBD.exeC:\windows\system\VGBD.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMUSD.exe.bat" "26⤵PID:3840
-
C:\windows\system\AMUSD.exeC:\windows\system\AMUSD.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARMHE.exe.bat" "28⤵PID:4308
-
C:\windows\SysWOW64\ARMHE.exeC:\windows\system32\ARMHE.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PPZYUI.exe.bat" "30⤵PID:1096
-
C:\windows\PPZYUI.exeC:\windows\PPZYUI.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDEIEIA.exe.bat" "32⤵PID:4504
-
C:\windows\system\KDEIEIA.exeC:\windows\system\KDEIEIA.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DVT.exe.bat" "34⤵PID:3284
-
C:\windows\system\DVT.exeC:\windows\system\DVT.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWVDSFR.exe.bat" "36⤵PID:4964
-
C:\windows\SysWOW64\AWVDSFR.exeC:\windows\system32\AWVDSFR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRZZF.exe.bat" "38⤵PID:4336
-
C:\windows\SysWOW64\BRZZF.exeC:\windows\system32\BRZZF.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMQAQO.exe.bat" "40⤵PID:1888
-
C:\windows\system\DMQAQO.exeC:\windows\system\DMQAQO.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMALU.exe.bat" "42⤵PID:2916
-
C:\windows\SysWOW64\AMALU.exeC:\windows\system32\AMALU.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXDB.exe.bat" "44⤵PID:4976
-
C:\windows\system\ZXDB.exeC:\windows\system\ZXDB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RAHWQO.exe.bat" "46⤵PID:3132
-
C:\windows\SysWOW64\RAHWQO.exeC:\windows\system32\RAHWQO.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBV.exe.bat" "48⤵PID:1836
-
C:\windows\SysWOW64\JBV.exeC:\windows\system32\JBV.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PBDH.exe.bat" "50⤵PID:4608
-
C:\windows\SysWOW64\PBDH.exeC:\windows\system32\PBDH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EREHTVI.exe.bat" "52⤵PID:1796
-
C:\windows\SysWOW64\EREHTVI.exeC:\windows\system32\EREHTVI.exe53⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJH.exe.bat" "54⤵PID:4988
-
C:\windows\system\PJH.exeC:\windows\system\PJH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZUR.exe.bat" "56⤵PID:4328
-
C:\windows\FZUR.exeC:\windows\FZUR.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVRDLKM.exe.bat" "58⤵PID:2564
-
C:\windows\UVRDLKM.exeC:\windows\UVRDLKM.exe59⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYBIE.exe.bat" "60⤵PID:5084
-
C:\windows\JYBIE.exeC:\windows\JYBIE.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDBWFK.exe.bat" "62⤵PID:2352
-
C:\windows\SysWOW64\JDBWFK.exeC:\windows\system32\JDBWFK.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MQSYQDF.exe.bat" "64⤵PID:5096
-
C:\windows\MQSYQDF.exeC:\windows\MQSYQDF.exe65⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IGMOCCB.exe.bat" "66⤵PID:456
-
C:\windows\IGMOCCB.exeC:\windows\IGMOCCB.exe67⤵
- Executes dropped EXE
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUYGHZR.exe.bat" "68⤵PID:2964
-
C:\windows\WUYGHZR.exeC:\windows\WUYGHZR.exe69⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPDQ.exe.bat" "70⤵PID:1912
-
C:\windows\system\QPDQ.exeC:\windows\system\QPDQ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVH.exe.bat" "72⤵PID:2080
-
C:\windows\SysWOW64\YVH.exeC:\windows\system32\YVH.exe73⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VANUJ.exe.bat" "74⤵PID:4420
-
C:\windows\VANUJ.exeC:\windows\VANUJ.exe75⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBXW.exe.bat" "76⤵PID:4000
-
C:\windows\SBXW.exeC:\windows\SBXW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJEEZV.exe.bat" "78⤵PID:3988
-
C:\windows\WJEEZV.exeC:\windows\WJEEZV.exe79⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRKBMMV.exe.bat" "80⤵PID:4236
-
C:\windows\NRKBMMV.exeC:\windows\NRKBMMV.exe81⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPYWTU.exe.bat" "82⤵PID:4544
-
C:\windows\system\XPYWTU.exeC:\windows\system\XPYWTU.exe83⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BXEW.exe.bat" "84⤵PID:5080
-
C:\windows\system\BXEW.exeC:\windows\system\BXEW.exe85⤵
- Executes dropped EXE
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSDEKI.exe.bat" "86⤵PID:1092
-
C:\windows\SysWOW64\HSDEKI.exeC:\windows\system32\HSDEKI.exe87⤵
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSLSTKQ.exe.bat" "88⤵PID:3172
-
C:\windows\SysWOW64\FSLSTKQ.exeC:\windows\system32\FSLSTKQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVW.exe.bat" "90⤵PID:3672
-
C:\windows\SysWOW64\RVW.exeC:\windows\system32\RVW.exe91⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTU.exe.bat" "92⤵PID:3088
-
C:\windows\system\PTU.exeC:\windows\system\PTU.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GEFYXWX.exe.bat" "94⤵PID:1364
-
C:\windows\SysWOW64\GEFYXWX.exeC:\windows\system32\GEFYXWX.exe95⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THB.exe.bat" "96⤵PID:4456
-
C:\windows\THB.exeC:\windows\THB.exe97⤵
- Checks computer location settings
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFHRJW.exe.bat" "98⤵PID:1472
-
C:\windows\DFHRJW.exeC:\windows\DFHRJW.exe99⤵
- Executes dropped EXE
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAY.exe.bat" "100⤵PID:1568
-
C:\windows\SAY.exeC:\windows\SAY.exe101⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AQZVBEY.exe.bat" "102⤵PID:5020
-
C:\windows\SysWOW64\AQZVBEY.exeC:\windows\system32\AQZVBEY.exe103⤵
- Checks computer location settings
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATDQ.exe.bat" "104⤵PID:4784
-
C:\windows\ATDQ.exeC:\windows\ATDQ.exe105⤵
- Executes dropped EXE
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGI.exe.bat" "106⤵PID:4584
-
C:\windows\SysWOW64\IGI.exeC:\windows\system32\IGI.exe107⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJY.exe.bat" "108⤵PID:388
-
C:\windows\WJY.exeC:\windows\WJY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCB.exe.bat" "110⤵PID:2064
-
C:\windows\system\HCB.exeC:\windows\system\HCB.exe111⤵
- Checks computer location settings
- Executes dropped EXE
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZU.exe.bat" "112⤵PID:4280
-
C:\windows\SysWOW64\JZU.exeC:\windows\system32\JZU.exe113⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFNG.exe.bat" "114⤵PID:4424
-
C:\windows\system\OFNG.exeC:\windows\system\OFNG.exe115⤵
- Checks computer location settings
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ISRPMV.exe.bat" "116⤵PID:864
-
C:\windows\ISRPMV.exeC:\windows\ISRPMV.exe117⤵
- Executes dropped EXE
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNJQRY.exe.bat" "118⤵PID:5020
-
C:\windows\SysWOW64\GNJQRY.exeC:\windows\system32\GNJQRY.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYZPFJ.exe.bat" "120⤵PID:4080
-
C:\windows\BYZPFJ.exeC:\windows\BYZPFJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZHCODJ.exe.bat" "122⤵PID:940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-