2143cdb9bec52d94021571245e2127695d2b9c255afe0df1c52526c7d75e1fd5

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
Size 208KB
Sample260730-dxttzscj9x
SHA256 2143cdb9bec52d94021571245e2127695d2b9c255afe0df1c52526c7d75e1fd5
MD5 656ef1b5baed35a3cbcb8939aec16ed3
SHA1 2f72436c14e8ed9cb45e2c3f4276c2525a6cf5ad
SHA512 55e9206bba5b88d22a8f9e904d65f5ea72e95acde5d3c039fe7fd0a6466337396d6d3de8b0e086ecb82321d9d23043a3bd424c02a174170b8413e334d4da6de0
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+cOfm4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+cO+kEj1
TLSH
T115247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5768	ZKXYQJX.exe
4576	ZKXYQJX.exe
4712	XIX.exe
3124	LYZGAM.exe
5792	MJHABJ.exe
2816	KZT.exe
952	XIX.exe
4188	MJHABJ.exe
5908	AKSQQLB.exe
3316	KZT.exe
1444	LYZGAM.exe
2312	AKSQQLB.exe
2920	EYAWBQB.exe
2976	XBM.exe
3408	EYAWBQB.exe
5800	OJGFKLF.exe
2076	TRGYSI.exe
1792	XBM.exe
4412	HERB.exe
4780	OJGFKLF.exe
1796	TRGYSI.exe
5808	SUFP.exe
1860	HERB.exe
5080	MIWRRAS.exe
4440	SSZR.exe
3960	SUFP.exe
2908	GYTL.exe
5280	MIWRRAS.exe
120	SSZR.exe
4244	AME.exe
3100	GYTL.exe
6056	EJCQX.exe
5988	AME.exe
5956	FMBELO.exe
4948	QUZV.exe
2420	JNPG.exe
5620	EJCQX.exe
5696	MSUZAIL.exe
5840	QPSG.exe
4776	QUZV.exe
4964	JNPG.exe
2036	FMBELO.exe
5572	QPSG.exe
1072	MSUZAIL.exe
5916	UWDNN.exe
1180	LWKLA.exe
2700	UWDNN.exe
5212	ANT.exe
5480	LWKLA.exe
4744	TQXOM.exe
3968	FYDXI.exe
5972	ANT.exe
4936	XQZPDZ.exe
4672	YBHJEWX.exe
3184	FYDXI.exe
3568	TQXOM.exe
1944	XQZPDZ.exe
1344	YBHJEWX.exe
572	OXPTODQ.exe
1408	FXRPI.exe
1908	NCVWT.exe
1928	BVD.exe
2012	FXRPI.exe
5668	OXPTODQ.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\92296a7c = "C:\\windows\\system\\HERB.exe"	HERB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fc68ff46 = "C:\\windows\\SUFP.exe"	SUFP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\3f558721 = "C:\\windows\\QPSG.exe"	QPSG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cfe0d0bc = "C:\\windows\\SysWOW64\\UWDNN.exe"	UWDNN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2f16015 = "C:\\windows\\SysWOW64\\TQXOM.exe"	TQXOM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\219cc106 = "C:\\windows\\system\\XBM.exe"	XBM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\2fbbf846 = "C:\\windows\\system\\VVG.exe"	VVG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\54b9519a = "C:\\windows\\system\\KZT.exe"	KZT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\5295fde3 = "C:\\windows\\SysWOW64\\MSUZAIL.exe"	MSUZAIL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8788999f = "C:\\windows\\JNPG.exe"	JNPG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e180e957 = "C:\\windows\\SysWOW64\\YBHJEWX.exe"	YBHJEWX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\27c2ac02 = "C:\\windows\\system\\FXRPI.exe"	FXRPI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d551d8bd = "C:\\windows\\system\\SEL.exe"	SEL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\d551d8bd = "C:\\windows\\system\\SEL.exe"	SEL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\82e704cf = "C:\\windows\\OJGFKLF.exe"	OJGFKLF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\147ab17a = "C:\\windows\\system\\MIWRRAS.exe"	MIWRRAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfb9f7e8 = "C:\\windows\\GYTL.exe"	GYTL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4de899a = "C:\\windows\\SysWOW64\\QUZV.exe"	QUZV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a4de899a = "C:\\windows\\SysWOW64\\QUZV.exe"	QUZV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e94da595 = "C:\\windows\\SysWOW64\\LWKLA.exe"	LWKLA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b41e3f44 = "C:\\windows\\FYDXI.exe"	FYDXI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\d551d8bd = "C:\\windows\\system\\SEL.exe"	SEL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\28e715c7 = "C:\\windows\\system\\LYZGAM.exe"	LYZGAM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3409526 = "C:\\windows\\system\\EYAWBQB.exe"	EYAWBQB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\92296a7c = "C:\\windows\\system\\HERB.exe"	HERB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a19d858e = "C:\\windows\\SSZR.exe"	SSZR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a4de899a = "C:\\windows\\SysWOW64\\QUZV.exe"	QUZV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f16015 = "C:\\windows\\SysWOW64\\TQXOM.exe"	TQXOM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\4cd1af50 = "C:\\windows\\system\\XIX.exe"	XIX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\147ab17a = "C:\\windows\\system\\MIWRRAS.exe"	MIWRRAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\147ac922 = "C:\\windows\\system\\FMBELO.exe"	FMBELO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\68ee2090 = "C:\\windows\\NCVWT.exe"	NCVWT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\70fd48d7 = "C:\\windows\\SysWOW64\\INGTWD.exe"	INGTWD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bb621c5e = "C:\\windows\\SysWOW64\\MJHABJ.exe"	MJHABJ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3409526 = "C:\\windows\\system\\EYAWBQB.exe"	EYAWBQB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\219cc106 = "C:\\windows\\system\\XBM.exe"	XBM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dfb9f7e8 = "C:\\windows\\GYTL.exe"	GYTL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\cde5de1a = "C:\\windows\\system\\OXPTODQ.exe"	OXPTODQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e02482cd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe"	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dfb9f7e8 = "C:\\windows\\GYTL.exe"	GYTL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\6cd64e4c = "C:\\windows\\system\\XQZPDZ.exe"	XQZPDZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1826bd00 = "C:\\windows\\HXDBODI.exe"	HXDBODI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\bb621c5e = "C:\\windows\\SysWOW64\\MJHABJ.exe"	MJHABJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\54b9519a = "C:\\windows\\system\\KZT.exe"	KZT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\147ab17a = "C:\\windows\\system\\MIWRRAS.exe"	MIWRRAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\14faad3b = "C:\\windows\\system\\CQBJ.exe"	CQBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e02482cd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe"	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5295fde3 = "C:\\windows\\SysWOW64\\MSUZAIL.exe"	MSUZAIL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f16015 = "C:\\windows\\SysWOW64\\TQXOM.exe"	TQXOM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\14faad3b = "C:\\windows\\system\\CQBJ.exe"	CQBJ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\bdd6052e = "C:\\windows\\system\\TFVE.exe"	TFVE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\1826bd00 = "C:\\windows\\HXDBODI.exe"	HXDBODI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e02482cd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe"	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\bb621c5e = "C:\\windows\\SysWOW64\\MJHABJ.exe"	MJHABJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c88a686e = "C:\\windows\\system\\EJCQX.exe"	EJCQX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e180e957 = "C:\\windows\\SysWOW64\\YBHJEWX.exe"	YBHJEWX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e180e957 = "C:\\windows\\SysWOW64\\YBHJEWX.exe"	YBHJEWX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\68ee2090 = "C:\\windows\\NCVWT.exe"	NCVWT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4cd1af50 = "C:\\windows\\system\\XIX.exe"	XIX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\92296a7c = "C:\\windows\\system\\HERB.exe"	HERB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\147ac922 = "C:\\windows\\system\\FMBELO.exe"	FMBELO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8788999f = "C:\\windows\\JNPG.exe"	JNPG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\c88a686e = "C:\\windows\\system\\EJCQX.exe"	EJCQX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfe0d0bc = "C:\\windows\\SysWOW64\\UWDNN.exe"	UWDNN.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\MJHABJ.exe.bat	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File opened for modification	C:\windows\SysWOW64\MSUZAIL.exe	FMBELO.exe
File opened for modification	C:\windows\SysWOW64\LWKLA.exe	UWDNN.exe
File opened for modification	C:\windows\SysWOW64\ANT.exe	LWKLA.exe
File created	C:\windows\SysWOW64\TQXOM.exe.bat	UWDNN.exe
File opened for modification	C:\windows\SysWOW64\LXS.exe	PQBMIK.exe
File created	C:\windows\SysWOW64\LXS.exe.bat	PQBMIK.exe
File created	C:\windows\SysWOW64\MSUZAIL.exe	FMBELO.exe
File created	C:\windows\SysWOW64\UWDNN.exe	MSUZAIL.exe
File created	C:\windows\SysWOW64\MSUZAIL.exe.bat	FMBELO.exe
File opened for modification	C:\windows\SysWOW64\UWDNN.exe	MSUZAIL.exe
File created	C:\windows\SysWOW64\UWDNN.exe.bat	MSUZAIL.exe
File created	C:\windows\SysWOW64\TQXOM.exe	UWDNN.exe
File opened for modification	C:\windows\SysWOW64\TQXOM.exe	UWDNN.exe
File created	C:\windows\SysWOW64\YBHJEWX.exe	FYDXI.exe
File created	C:\windows\SysWOW64\INGTWD.exe	LXS.exe
File created	C:\windows\SysWOW64\QUZV.exe	EJCQX.exe
File opened for modification	C:\windows\SysWOW64\QUZV.exe	EJCQX.exe
File created	C:\windows\SysWOW64\ANT.exe	LWKLA.exe
File created	C:\windows\SysWOW64\ANT.exe.bat	LWKLA.exe
File created	C:\windows\SysWOW64\LXS.exe	PQBMIK.exe
File created	C:\windows\SysWOW64\LWKLA.exe.bat	UWDNN.exe
File opened for modification	C:\windows\SysWOW64\YBHJEWX.exe	FYDXI.exe
File opened for modification	C:\windows\SysWOW64\INGTWD.exe	LXS.exe
File created	C:\windows\SysWOW64\MJHABJ.exe	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File opened for modification	C:\windows\SysWOW64\MJHABJ.exe	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\QUZV.exe.bat	EJCQX.exe
File created	C:\windows\SysWOW64\LWKLA.exe	UWDNN.exe
File created	C:\windows\SysWOW64\YBHJEWX.exe.bat	FYDXI.exe
File created	C:\windows\SysWOW64\INGTWD.exe.bat	LXS.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\windows\system\FMBELO.exe	GYTL.exe
File opened for modification	C:\windows\ZKXYQJX.exe	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File created	C:\windows\system\LYZGAM.exe	ZKXYQJX.exe
File opened for modification	C:\windows\system\AKSQQLB.exe	XIX.exe
File created	C:\windows\system\XBM.exe	EYAWBQB.exe
File created	C:\windows\SUFP.exe	HERB.exe
File created	C:\windows\system\AME.exe.bat	MIWRRAS.exe
File opened for modification	C:\windows\system\FXRPI.exe	YBHJEWX.exe
File created	C:\windows\system\KZT.exe.bat	XIX.exe
File opened for modification	C:\windows\system\EYAWBQB.exe	AKSQQLB.exe
File opened for modification	C:\windows\system\EJCQX.exe	SSZR.exe
File created	C:\windows\system\FMBELO.exe.bat	GYTL.exe
File created	C:\windows\FYDXI.exe.bat	ANT.exe
File opened for modification	C:\windows\system\OXPTODQ.exe	XQZPDZ.exe
File created	C:\windows\system\SEL.exe.bat	CQBJ.exe
File created	C:\windows\system\TFVE.exe	VVG.exe
File created	C:\windows\JNPG.exe.bat	AME.exe
File created	C:\windows\TRGYSI.exe	EYAWBQB.exe
File created	C:\windows\SSZR.exe	SUFP.exe
File created	C:\windows\SSZR.exe.bat	SUFP.exe
File created	C:\windows\system\FXRPI.exe	YBHJEWX.exe
File created	C:\windows\system\SEL.exe	CQBJ.exe
File opened for modification	C:\windows\system\XIX.exe	ZKXYQJX.exe
File opened for modification	C:\windows\system\MIWRRAS.exe	TRGYSI.exe
File created	C:\windows\GYTL.exe	SUFP.exe
File opened for modification	C:\windows\system\PQBMIK.exe	NCVWT.exe
File created	C:\windows\system\EYAWBQB.exe	AKSQQLB.exe
File created	C:\windows\system\EYAWBQB.exe.bat	AKSQQLB.exe
File opened for modification	C:\windows\GYTL.exe	SUFP.exe
File created	C:\windows\system\EJCQX.exe	SSZR.exe
File created	C:\windows\system\OXPTODQ.exe	XQZPDZ.exe
File created	C:\windows\system\TFVE.exe.bat	VVG.exe
File created	C:\windows\system\XBM.exe.bat	EYAWBQB.exe
File opened for modification	C:\windows\TRGYSI.exe	EYAWBQB.exe
File created	C:\windows\ZKXYQJX.exe.bat	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File opened for modification	C:\windows\system\XBM.exe	EYAWBQB.exe
File opened for modification	C:\windows\JNPG.exe	AME.exe
File opened for modification	C:\windows\system\CQBJ.exe	BVD.exe
File created	C:\windows\HXDBODI.exe.bat	INGTWD.exe
File created	C:\windows\system\LYZGAM.exe.bat	ZKXYQJX.exe
File created	C:\windows\QPSG.exe	QUZV.exe
File created	C:\windows\FYDXI.exe	ANT.exe
File opened for modification	C:\windows\FYDXI.exe	ANT.exe
File opened for modification	C:\windows\system\XQZPDZ.exe	TQXOM.exe
File created	C:\windows\system\EJCQX.exe.bat	SSZR.exe
File created	C:\windows\ZKXYQJX.exe	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
File opened for modification	C:\windows\system\LYZGAM.exe	ZKXYQJX.exe
File created	C:\windows\TRGYSI.exe.bat	EYAWBQB.exe
File created	C:\windows\system\HERB.exe.bat	OJGFKLF.exe
File created	C:\windows\GYTL.exe.bat	SUFP.exe
File created	C:\windows\system\CQBJ.exe	BVD.exe
File created	C:\windows\HXDBODI.exe	INGTWD.exe
File created	C:\windows\system\XIX.exe	ZKXYQJX.exe
File created	C:\windows\system\KZT.exe	XIX.exe
File created	C:\windows\system\XQZPDZ.exe.bat	TQXOM.exe
File created	C:\windows\system\OXPTODQ.exe.bat	XQZPDZ.exe
File created	C:\windows\system\BVD.exe.bat	FXRPI.exe
File created	C:\windows\system\PQBMIK.exe.bat	NCVWT.exe
File created	C:\windows\system\VVG.exe.bat	SEL.exe
File opened for modification	C:\windows\system\TFVE.exe	VVG.exe
File created	C:\windows\system\AKSQQLB.exe.bat	XIX.exe
File opened for modification	C:\windows\SUFP.exe	HERB.exe
File created	C:\windows\SUFP.exe.bat	HERB.exe
File opened for modification	C:\windows\system\AME.exe	MIWRRAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4756	cmd.exe
2488	cmd.exe
5152	cmd.exe
4112	cmd.exe
6784	cmd.exe
4176	cmd.exe
6568	Process not Found
6768	Process not Found
5340	cmd.exe
3004	cmd.exe
2020	cmd.exe
376	cmd.exe
944	cmd.exe
2112	cmd.exe
6420	Process not Found
4528	Process not Found
4980	cmd.exe
4544	cmd.exe
2128	cmd.exe
4692	cmd.exe
2376	cmd.exe
628	cmd.exe
6516	cmd.exe
6504	Process not Found
2032	Process not Found
1016	cmd.exe
4516	cmd.exe
908	cmd.exe
2544	cmd.exe
2588	cmd.exe
6820	cmd.exe
1560	Process not Found
728	cmd.exe
4432	cmd.exe
4796	cmd.exe
1732	cmd.exe
272	cmd.exe
6116	cmd.exe
6224	cmd.exe
4200	Process not Found
3308	cmd.exe
804	cmd.exe
3476	cmd.exe
5924	cmd.exe
6960	cmd.exe
4456	cmd.exe
6316	cmd.exe
2540	Process not Found
3016	cmd.exe
4144	cmd.exe
5588	cmd.exe
2848	cmd.exe
1856	cmd.exe
4700	cmd.exe
4424	cmd.exe
6464	Process not Found
4768	cmd.exe
2188	cmd.exe
560	cmd.exe
4356	cmd.exe
6328	cmd.exe
4448	cmd.exe
4284	cmd.exe
7056	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2600	2484	WerFault.exe	88
1932	5768	WerFault.exe	94
1924	4576	WerFault.exe	102
5560	4436	WerFault.exe	104
5056	4712	WerFault.exe	103
5964	3124	WerFault.exe	117
3844	5792	WerFault.exe	118
1336	2816	WerFault.exe	119
4128	952	WerFault.exe	122
4264	4188	WerFault.exe	135
2720	5908	WerFault.exe	136
5588	3316	WerFault.exe	137
5604	1444	WerFault.exe	138
804	2312	WerFault.exe	148
4372	2920	WerFault.exe	153
3472	2976	WerFault.exe	158
3340	3408	WerFault.exe	160
2032	5800	WerFault.exe	165
2060	2076	WerFault.exe	170
3900	1792	WerFault.exe	175
1492	4412	WerFault.exe	177
5572	4780	WerFault.exe	184
5564	1796	WerFault.exe	188
5836	5808	WerFault.exe	190
1520	1860	WerFault.exe	197
3164	5080	WerFault.exe	202
3064	4440	WerFault.exe	204
1300	3960	WerFault.exe	210
1524	2908	WerFault.exe	217
2528	5280	WerFault.exe	220
2964	120	WerFault.exe	221
5000	4244	WerFault.exe	233
2064	3100	WerFault.exe	234
3032	6056	WerFault.exe	235
4684	5988	WerFault.exe	247
4768	5956	WerFault.exe	248
1440	4948	WerFault.exe	249
1524	2420	WerFault.exe	258
5356	5620	WerFault.exe	263
5872	5696	WerFault.exe	265
5924	5840	WerFault.exe	268
3248	4776	WerFault.exe	278
4148	4964	WerFault.exe	279
732	2036	WerFault.exe	280
4888	5572	WerFault.exe	284
5880	1072	WerFault.exe	288
2372	5916	WerFault.exe	297
2792	1180	WerFault.exe	302
572	2700	WerFault.exe	307
5052	5212	WerFault.exe	309
2808	5480	WerFault.exe	319
5216	4744	WerFault.exe	320
4888	3968	WerFault.exe	321
52	5972	WerFault.exe	325
840	4936	WerFault.exe	334
5864	4672	WerFault.exe	338
924	3184	WerFault.exe	341
5316	3568	WerFault.exe	344
4892	1944	WerFault.exe	350
5124	1344	WerFault.exe	353
2292	572	WerFault.exe	362
6096	1408	WerFault.exe	363
924	1908	WerFault.exe	372
5292	1928	WerFault.exe	373

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LXS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MIWRRAS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FMBELO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VVG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HXDBODI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EYAWBQB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OJGFKLF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QPSG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FYDXI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XBM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSZR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QPSG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PQBMIK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TFVE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XIX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KZT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CQBJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KZT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TRGYSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUZV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BVD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SEL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TFVE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EJCQX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EYAWBQB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUFP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INGTWD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EWN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AME.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AME.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UWDNN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSUZAIL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NCVWT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INGTWD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LYZGAM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MJHABJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TRGYSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JNPG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PQBMIK.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2484	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
2484	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
5768	ZKXYQJX.exe
5768	ZKXYQJX.exe
4576	ZKXYQJX.exe
4576	ZKXYQJX.exe
4712	XIX.exe
4712	XIX.exe
4436	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
4436	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
3124	LYZGAM.exe
3124	LYZGAM.exe
5792	MJHABJ.exe
5792	MJHABJ.exe
2816	KZT.exe
2816	KZT.exe
952	XIX.exe
952	XIX.exe
4188	MJHABJ.exe
4188	MJHABJ.exe
5908	AKSQQLB.exe
5908	AKSQQLB.exe
3316	KZT.exe
3316	KZT.exe
1444	LYZGAM.exe
1444	LYZGAM.exe
2312	AKSQQLB.exe
2312	AKSQQLB.exe
2920	EYAWBQB.exe
2920	EYAWBQB.exe
2976	XBM.exe
2976	XBM.exe
3408	EYAWBQB.exe
3408	EYAWBQB.exe
5800	OJGFKLF.exe
5800	OJGFKLF.exe
2076	TRGYSI.exe
2076	TRGYSI.exe
1792	XBM.exe
1792	XBM.exe
4412	HERB.exe
4412	HERB.exe
4780	OJGFKLF.exe
4780	OJGFKLF.exe
1796	TRGYSI.exe
1796	TRGYSI.exe
5808	SUFP.exe
5808	SUFP.exe
1860	HERB.exe
1860	HERB.exe
5080	MIWRRAS.exe
5080	MIWRRAS.exe
4440	SSZR.exe
4440	SSZR.exe
3960	SUFP.exe
3960	SUFP.exe
2908	GYTL.exe
2908	GYTL.exe
5280	MIWRRAS.exe
5280	MIWRRAS.exe
120	SSZR.exe
120	SSZR.exe
4244	AME.exe
4244	AME.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2484	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
2484	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
5768	ZKXYQJX.exe
5768	ZKXYQJX.exe
4576	ZKXYQJX.exe
4576	ZKXYQJX.exe
4712	XIX.exe
4712	XIX.exe
4436	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
4436	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
3124	LYZGAM.exe
3124	LYZGAM.exe
5792	MJHABJ.exe
5792	MJHABJ.exe
2816	KZT.exe
2816	KZT.exe
952	XIX.exe
952	XIX.exe
4188	MJHABJ.exe
4188	MJHABJ.exe
5908	AKSQQLB.exe
5908	AKSQQLB.exe
3316	KZT.exe
3316	KZT.exe
1444	LYZGAM.exe
1444	LYZGAM.exe
2312	AKSQQLB.exe
2312	AKSQQLB.exe
2920	EYAWBQB.exe
2920	EYAWBQB.exe
2976	XBM.exe
2976	XBM.exe
3408	EYAWBQB.exe
3408	EYAWBQB.exe
5800	OJGFKLF.exe
5800	OJGFKLF.exe
2076	TRGYSI.exe
2076	TRGYSI.exe
1792	XBM.exe
1792	XBM.exe
4412	HERB.exe
4412	HERB.exe
4780	OJGFKLF.exe
4780	OJGFKLF.exe
1796	TRGYSI.exe
1796	TRGYSI.exe
5808	SUFP.exe
5808	SUFP.exe
1860	HERB.exe
1860	HERB.exe
5080	MIWRRAS.exe
5080	MIWRRAS.exe
4440	SSZR.exe
4440	SSZR.exe
3960	SUFP.exe
3960	SUFP.exe
2908	GYTL.exe
2908	GYTL.exe
5280	MIWRRAS.exe
5280	MIWRRAS.exe
120	SSZR.exe
120	SSZR.exe
4244	AME.exe
4244	AME.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1856	2484	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe	90
PID 1856 wrote to memory of 5768	1856	cmd.exe	94
PID 5768 wrote to memory of 5340	5768	ZKXYQJX.exe	96
PID 5340 wrote to memory of 4712	5340	cmd.exe	103
PID 4576 wrote to memory of 4292	4576	ZKXYQJX.exe	105
PID 4436 wrote to memory of 1284	4436	2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe	109
PID 4712 wrote to memory of 3308	4712	XIX.exe	112
PID 4292 wrote to memory of 3124	4292	cmd.exe	117
PID 1284 wrote to memory of 5792	1284	cmd.exe	118
PID 3308 wrote to memory of 2816	3308	cmd.exe	119
PID 952 wrote to memory of 5660	952	XIX.exe	128
PID 5660 wrote to memory of 5908	5660	cmd.exe	136
PID 2312 wrote to memory of 4612	2312	AKSQQLB.exe	149
PID 4612 wrote to memory of 2920	4612	cmd.exe	153
PID 2920 wrote to memory of 728	2920	EYAWBQB.exe	154
PID 728 wrote to memory of 2976	728	cmd.exe	158
PID 2976 wrote to memory of 4432	2976	XBM.exe	161
PID 4432 wrote to memory of 5800	4432	cmd.exe	165
PID 3408 wrote to memory of 3016	3408	EYAWBQB.exe	166
PID 3016 wrote to memory of 2076	3016	cmd.exe	170
PID 5800 wrote to memory of 1888	5800	OJGFKLF.exe	172
PID 1888 wrote to memory of 4412	1888	cmd.exe	177
PID 4412 wrote to memory of 1016	4412	HERB.exe	185
PID 1016 wrote to memory of 5808	1016	cmd.exe	190
PID 1796 wrote to memory of 5844	1796	TRGYSI.exe	194
PID 5808 wrote to memory of 5756	5808	SUFP.exe	199
PID 5844 wrote to memory of 5080	5844	cmd.exe	202
PID 5756 wrote to memory of 4440	5756	cmd.exe	204
PID 3960 wrote to memory of 5096	3960	SUFP.exe	213
PID 5096 wrote to memory of 2908	5096	cmd.exe	217
PID 5280 wrote to memory of 5308	5280	MIWRRAS.exe	224
PID 120 wrote to memory of 4980	120	SSZR.exe	228
PID 5308 wrote to memory of 4244	5308	cmd.exe	233
PID 4980 wrote to memory of 6056	4980	cmd.exe	235
PID 3100 wrote to memory of 5948	3100	GYTL.exe	238
PID 6056 wrote to memory of 804	6056	EJCQX.exe	243
PID 5948 wrote to memory of 5956	5948	cmd.exe	248
PID 804 wrote to memory of 4948	804	cmd.exe	249
PID 5988 wrote to memory of 4756	5988	AME.exe	250
PID 5956 wrote to memory of 4508	5956	FMBELO.exe	255
PID 4756 wrote to memory of 2420	4756	cmd.exe	258
PID 4948 wrote to memory of 1008	4948	QUZV.exe	260
PID 4508 wrote to memory of 5696	4508	cmd.exe	265
PID 1008 wrote to memory of 5840	1008	cmd.exe	268
PID 1072 wrote to memory of 2904	1072	MSUZAIL.exe	293
PID 2904 wrote to memory of 5916	2904	cmd.exe	297
PID 5916 wrote to memory of 3004	5916	UWDNN.exe	298
PID 3004 wrote to memory of 1180	3004	cmd.exe	302
PID 1180 wrote to memory of 5448	1180	LWKLA.exe	304
PID 5448 wrote to memory of 5212	5448	cmd.exe	309
PID 2700 wrote to memory of 1484	2700	UWDNN.exe	310
PID 5212 wrote to memory of 2376	5212	ANT.exe	314
PID 1484 wrote to memory of 4744	1484	cmd.exe	320
PID 2376 wrote to memory of 3968	2376	cmd.exe	321
PID 4744 wrote to memory of 4132	4744	TQXOM.exe	326
PID 3968 wrote to memory of 4544	3968	FYDXI.exe	330
PID 4132 wrote to memory of 4936	4132	cmd.exe	334
PID 4544 wrote to memory of 4672	4544	cmd.exe	338
PID 1944 wrote to memory of 3488	1944	XQZPDZ.exe	354
PID 1344 wrote to memory of 6108	1344	YBHJEWX.exe	357
PID 3488 wrote to memory of 572	3488	cmd.exe	362
PID 6108 wrote to memory of 1408	6108	cmd.exe	363
PID 572 wrote to memory of 2772	572	OXPTODQ.exe	364
PID 1408 wrote to memory of 6016	1408	FXRPI.exe	367

C:\Users\Admin\AppData\Local\Temp\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ZKXYQJX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\windows\ZKXYQJX.exe
    C:\windows\ZKXYQJX.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XIX.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\windows\system\XIX.exe
        
        C:\windows\system\XIX.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4712
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\windows\system\KZT.exe
        
        C:\windows\system\KZT.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 784
        8⤵
        Program crash
        
        PID:1336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1356
        6⤵
        Program crash
        
        PID:5056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 1020
      4⤵
      Program crash
      PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1016
  2⤵
  - Program crash
  PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2484 -ip 2484
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5768 -ip 5768
1⤵
PID:4972

C:\windows\ZKXYQJX.exe
C:\windows\ZKXYQJX.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\LYZGAM.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\windows\system\LYZGAM.exe
    C:\windows\system\LYZGAM.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 848
      4⤵
      Program crash
      PID:5964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 944
  2⤵
  - Program crash
  PID:1924

C:\Users\Admin\AppData\Local\Temp\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-30_656ef1b5baed35a3cbcb8939aec16ed3_elex_emotet_stop.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\windows\SysWOW64\MJHABJ.exe
    C:\windows\system32\MJHABJ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 832
      4⤵
      Program crash
      PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1328
  2⤵
  - Program crash
  PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4576 -ip 4576
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4436 -ip 4436
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4712 -ip 4712
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3124 -ip 3124
1⤵
PID:5076

C:\windows\system\XIX.exe
C:\windows\system\XIX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\AKSQQLB.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\windows\system\AKSQQLB.exe
    C:\windows\system\AKSQQLB.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 836
      4⤵
      Program crash
      PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 980
  2⤵
  - Program crash
  PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5792 -ip 5792
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2816 -ip 2816
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 952 -ip 952
1⤵
PID:3840

C:\windows\SysWOW64\MJHABJ.exe
C:\windows\SysWOW64\MJHABJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 840
  2⤵
  - Program crash
  PID:4264

C:\windows\system\KZT.exe
C:\windows\system\KZT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 796
  2⤵
  - Program crash
  PID:5588

C:\windows\system\LYZGAM.exe
C:\windows\system\LYZGAM.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 812
  2⤵
  - Program crash
  PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4188 -ip 4188
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5908 -ip 5908
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3316 -ip 3316
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1444 -ip 1444
1⤵
PID:2528

C:\windows\system\AKSQQLB.exe
C:\windows\system\AKSQQLB.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\windows\system\EYAWBQB.exe
    C:\windows\system\EYAWBQB.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XBM.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:728
    - - C:\windows\system\XBM.exe
        
        C:\windows\system\XBM.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\windows\OJGFKLF.exe
        
        C:\windows\OJGFKLF.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HERB.exe.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\windows\system\HERB.exe
        
        C:\windows\system\HERB.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SUFP.exe.bat" "
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\windows\SUFP.exe
        
        C:\windows\SUFP.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\windows\SSZR.exe
        
        C:\windows\SSZR.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 840
        14⤵
        Program crash
        
        PID:3064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1000
        12⤵
        Program crash
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1364
        10⤵
        Program crash
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 980
        8⤵
        Program crash
        
        PID:2032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 1004
        6⤵
        Program crash
        
        PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1372
      4⤵
      Program crash
      PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 976
  2⤵
  - Program crash
  PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2312 -ip 2312
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2920 -ip 2920
1⤵
PID:5424

C:\windows\system\EYAWBQB.exe
C:\windows\system\EYAWBQB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\windows\TRGYSI.exe
    C:\windows\TRGYSI.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 836
      4⤵
      Program crash
      PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 952
  2⤵
  - Program crash
  PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2976 -ip 2976
1⤵
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3408 -ip 3408
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5800 -ip 5800
1⤵
PID:2096

C:\windows\system\XBM.exe
C:\windows\system\XBM.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 800
  2⤵
  - Program crash
  PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2076 -ip 2076
1⤵
PID:120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1792 -ip 1792
1⤵
PID:5088

C:\windows\OJGFKLF.exe
C:\windows\OJGFKLF.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 784
  2⤵
  - Program crash
  PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4412 -ip 4412
1⤵
PID:924

C:\windows\TRGYSI.exe
C:\windows\TRGYSI.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\MIWRRAS.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\windows\system\MIWRRAS.exe
    C:\windows\system\MIWRRAS.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 848
      4⤵
      Program crash
      PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 944
  2⤵
  - Program crash
  PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4780 -ip 4780
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1796 -ip 1796
1⤵
PID:4308

C:\windows\system\HERB.exe
C:\windows\system\HERB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 812
  2⤵
  - Program crash
  PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5808 -ip 5808
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1860 -ip 1860
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5080 -ip 5080
1⤵
PID:3700

C:\windows\SUFP.exe
C:\windows\SUFP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\windows\GYTL.exe
    C:\windows\GYTL.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 844
      4⤵
      Program crash
      PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 944
  2⤵
  - Program crash
  PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4440 -ip 4440
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3960 -ip 3960
1⤵
PID:3568

C:\windows\system\MIWRRAS.exe
C:\windows\system\MIWRRAS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\AME.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\windows\system\AME.exe
    C:\windows\system\AME.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 852
      4⤵
      Program crash
      PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 1336
  2⤵
  - Program crash
  PID:2528

C:\windows\SSZR.exe
C:\windows\SSZR.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\windows\system\EJCQX.exe
    C:\windows\system\EJCQX.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:804
    - - C:\windows\SysWOW64\QUZV.exe
        
        C:\windows\system32\QUZV.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4948
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QPSG.exe.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\windows\QPSG.exe
        
        C:\windows\QPSG.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 848
        8⤵
        Program crash
        
        PID:5924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1332
        6⤵
        Program crash
        
        PID:1440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 1340
      4⤵
      Program crash
      PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 120 -s 1324
  2⤵
  - Program crash
  PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2908 -ip 2908
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5280 -ip 5280
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 120 -ip 120
1⤵
PID:1264

C:\windows\GYTL.exe
C:\windows\GYTL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\FMBELO.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\windows\system\FMBELO.exe
    C:\windows\system\FMBELO.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\windows\SysWOW64\MSUZAIL.exe
        
        C:\windows\system32\MSUZAIL.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 824
        6⤵
        Program crash
        
        PID:5872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 1004
      4⤵
      Program crash
      PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 952
  2⤵
  - Program crash
  PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4244 -ip 4244
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3100 -ip 3100
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6056 -ip 6056
1⤵
PID:5812

C:\windows\system\AME.exe
C:\windows\system\AME.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\windows\JNPG.exe
    C:\windows\JNPG.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 844
      4⤵
      Program crash
      PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 944
  2⤵
  - Program crash
  PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5988 -ip 5988
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5956 -ip 5956
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4948 -ip 4948
1⤵
PID:6112

C:\windows\system\EJCQX.exe
C:\windows\system\EJCQX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 744
  2⤵
  - Program crash
  PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2420 -ip 2420
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5620 -ip 5620
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5696 -ip 5696
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5840 -ip 5840
1⤵
PID:4648

C:\windows\SysWOW64\QUZV.exe
C:\windows\SysWOW64\QUZV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 840
  2⤵
  - Program crash
  PID:3248

C:\windows\JNPG.exe
C:\windows\JNPG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 808
  2⤵
  - Program crash
  PID:4148

C:\windows\system\FMBELO.exe
C:\windows\system\FMBELO.exe
1⤵
- Executes dropped EXE
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 812
  2⤵
  - Program crash
  PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4776 -ip 4776
1⤵
PID:6096

C:\windows\QPSG.exe
C:\windows\QPSG.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 808
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4964 -ip 4964
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2036 -ip 2036
1⤵
PID:4140

C:\windows\SysWOW64\MSUZAIL.exe
C:\windows\SysWOW64\MSUZAIL.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\windows\SysWOW64\UWDNN.exe
    C:\windows\system32\UWDNN.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKLA.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\windows\SysWOW64\LWKLA.exe
        
        C:\windows\system32\LWKLA.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANT.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\windows\SysWOW64\ANT.exe
        
        C:\windows\system32\ANT.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\windows\FYDXI.exe
        
        C:\windows\FYDXI.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBHJEWX.exe.bat" "
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\windows\SysWOW64\YBHJEWX.exe
        
        C:\windows\system32\YBHJEWX.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 836
        12⤵
        Program crash
        
        PID:5864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 1340
        10⤵
        Program crash
        
        PID:4888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 1012
        8⤵
        Program crash
        
        PID:5052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 980
        6⤵
        Program crash
        
        PID:2792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 1036
      4⤵
      Program crash
      PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 980
  2⤵
  - Program crash
  PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5572 -ip 5572
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1072 -ip 1072
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5916 -ip 5916
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1180 -ip 1180
1⤵
PID:5996

C:\windows\SysWOW64\UWDNN.exe
C:\windows\SysWOW64\UWDNN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQXOM.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\windows\SysWOW64\TQXOM.exe
    C:\windows\system32\TQXOM.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XQZPDZ.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4132
    - - C:\windows\system\XQZPDZ.exe
        
        C:\windows\system\XQZPDZ.exe
        5⤵
        Executes dropped EXE
        
        PID:4936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 840
        6⤵
        Program crash
        
        PID:840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1016
      4⤵
      Program crash
      PID:5216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1360
  2⤵
  - Program crash
  PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2700 -ip 2700
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5212 -ip 5212
1⤵
PID:3488

C:\windows\SysWOW64\LWKLA.exe
C:\windows\SysWOW64\LWKLA.exe
1⤵
- Executes dropped EXE
PID:5480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 828
  2⤵
  - Program crash
  PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5480 -ip 5480
1⤵
PID:5812

C:\windows\SysWOW64\ANT.exe
C:\windows\SysWOW64\ANT.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 824
  2⤵
  - Program crash
  PID:52

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4744 -ip 4744
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3968 -ip 3968
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5972 -ip 5972
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4936 -ip 4936
1⤵
PID:4652

C:\windows\FYDXI.exe
C:\windows\FYDXI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 800
  2⤵
  - Program crash
  PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4672 -ip 4672
1⤵
PID:1300

C:\windows\SysWOW64\TQXOM.exe
C:\windows\SysWOW64\TQXOM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 832
  2⤵
  - Program crash
  PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3184 -ip 3184
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3568 -ip 3568
1⤵
PID:2272

C:\windows\system\XQZPDZ.exe
C:\windows\system\XQZPDZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\windows\system\OXPTODQ.exe
    C:\windows\system\OXPTODQ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\NCVWT.exe.bat" "
      4⤵
      PID:2772
    - - C:\windows\NCVWT.exe
        
        C:\windows\NCVWT.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1908
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4796
        
        C:\windows\system\PQBMIK.exe
        
        C:\windows\system\PQBMIK.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 660
        8⤵
        
        PID:1204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 1340
        6⤵
        Program crash
        
        PID:924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1224
      4⤵
      Program crash
      PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 980
  2⤵
  - Program crash
  PID:4892

C:\windows\SysWOW64\YBHJEWX.exe
C:\windows\SysWOW64\YBHJEWX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\FXRPI.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\windows\system\FXRPI.exe
    C:\windows\system\FXRPI.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\BVD.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:6016
    - - C:\windows\system\BVD.exe
        
        C:\windows\system\BVD.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1928
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CQBJ.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\windows\system\CQBJ.exe
        
        C:\windows\system\CQBJ.exe
        7⤵
        Adds Run key to start application
        
        PID:5904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 744
        8⤵
        
        PID:2392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 1376
        6⤵
        Program crash
        
        PID:5292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 984
      4⤵
      Program crash
      PID:6096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1336
  2⤵
  - Program crash
  PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 1944 -ip 1944
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1344 -ip 1344
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 572 -ip 572
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1408 -ip 1408
1⤵
PID:6020

C:\windows\system\FXRPI.exe
C:\windows\system\FXRPI.exe
1⤵
- Executes dropped EXE
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 804
  2⤵
  PID:4676

C:\windows\system\OXPTODQ.exe
C:\windows\system\OXPTODQ.exe
1⤵
- Executes dropped EXE
PID:5668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 812
  2⤵
  PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 1908 -ip 1908
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1928 -ip 1928
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2012 -ip 2012
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5668 -ip 5668
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5904 -ip 5904
1⤵
PID:1076

C:\windows\NCVWT.exe
C:\windows\NCVWT.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 812
  2⤵
  PID:6136

C:\windows\system\BVD.exe
C:\windows\system\BVD.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 800
  2⤵
  PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5652 -ip 5652
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3484 -ip 3484
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5296 -ip 5296
1⤵
PID:2544

C:\windows\system\CQBJ.exe
C:\windows\system\CQBJ.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5760
- - C:\windows\system\SEL.exe
    C:\windows\system\SEL.exe
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\VVG.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\windows\system\VVG.exe
        
        C:\windows\system\VVG.exe
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TFVE.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\windows\system\TFVE.exe
        
        C:\windows\system\TFVE.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 848
        8⤵
        
        PID:364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 992
        6⤵
        
        PID:4556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 1352
      4⤵
      PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 1328
  2⤵
  PID:5416

C:\windows\system\PQBMIK.exe
C:\windows\system\PQBMIK.exe
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXS.exe.bat" "
  2⤵
  PID:5056
- - C:\windows\SysWOW64\LXS.exe
    C:\windows\system32\LXS.exe
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\INGTWD.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:3476
    - - C:\windows\SysWOW64\INGTWD.exe
        
        C:\windows\system32\INGTWD.exe
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2852
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HXDBODI.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\windows\HXDBODI.exe
        
        C:\windows\HXDBODI.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 848
        8⤵
        
        PID:3572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1340
        6⤵
        
        PID:1056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 1020
      4⤵
      PID:3200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 984
  2⤵
  PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5736 -ip 5736
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2064 -ip 2064
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 372 -ip 372
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 872 -ip 872
1⤵
PID:2264

C:\windows\SysWOW64\LXS.exe
C:\windows\SysWOW64\LXS.exe
1⤵
PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 840
  2⤵
  PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4688 -ip 4688
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2852 -ip 2852
1⤵
PID:4420

C:\windows\system\SEL.exe
C:\windows\system\SEL.exe
1⤵
- Adds Run key to start application
PID:5600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 808
  2⤵
  PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3608 -ip 3608
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5600 -ip 5600
1⤵
PID:5592

C:\windows\system\VVG.exe
C:\windows\system\VVG.exe
1⤵
- Adds Run key to start application
PID:6128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 808
  2⤵
  PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2528 -ip 2528
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5872 -ip 5872
1⤵
PID:5024

C:\windows\SysWOW64\INGTWD.exe
C:\windows\SysWOW64\INGTWD.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 776
  2⤵
  PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6128 -ip 6128
1⤵
PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2600 -ip 2600
1⤵
PID:4828

C:\windows\system\TFVE.exe
C:\windows\system\TFVE.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\YPCY.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4108
- - C:\windows\system\YPCY.exe
    C:\windows\system\YPCY.exe
    3⤵
    PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\ACT.exe.bat" "
      4⤵
      PID:3856
    - - C:\windows\system\ACT.exe
        
        C:\windows\system\ACT.exe
        5⤵
        
        PID:5052
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVJNNTV.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:2128
        
        C:\windows\SysWOW64\KVJNNTV.exe
        
        C:\windows\system32\KVJNNTV.exe
        7⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 844
        8⤵
        
        PID:3516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1020
        6⤵
        
        PID:2900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1372
      4⤵
      PID:944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 980
  2⤵
  PID:1732

C:\windows\HXDBODI.exe
C:\windows\HXDBODI.exe
1⤵
- Adds Run key to start application
PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\EWN.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:376
- - C:\windows\EWN.exe
    C:\windows\EWN.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\JXPMBXM.exe.bat" "
      4⤵
      PID:1772
    - - C:\windows\JXPMBXM.exe
        
        C:\windows\JXPMBXM.exe
        5⤵
        
        PID:2628
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MAOGO.exe.bat" "
        6⤵
        
        PID:3924
        
        C:\windows\SysWOW64\MAOGO.exe
        
        C:\windows\system32\MAOGO.exe
        7⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 832
        8⤵
        
        PID:5704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 980
        6⤵
        
        PID:5804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1340
      4⤵
      PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 904
  2⤵
  PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2060 -ip 2060
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1904 -ip 1904
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4888 -ip 4888
1⤵
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4180 -ip 4180
1⤵
PID:2724

C:\windows\system\YPCY.exe
C:\windows\system\YPCY.exe
1⤵
PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNCE.exe.bat" "
  2⤵
  PID:3064
- - C:\windows\SysWOW64\YNCE.exe
    C:\windows\system32\YNCE.exe
    3⤵
    PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 848
      4⤵
      PID:5864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 988
  2⤵
  PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5004 -ip 5004
1⤵
PID:304

C:\windows\EWN.exe
C:\windows\EWN.exe
1⤵
PID:4664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 800
  2⤵
  PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5052 -ip 5052
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2628 -ip 2628
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4664 -ip 4664
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5076 -ip 5076
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1100 -ip 1100
1⤵
PID:3160

C:\windows\JXPMBXM.exe
C:\windows\JXPMBXM.exe
1⤵
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 796
  2⤵
  PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1192 -ip 1192
1⤵
PID:2544

C:\windows\system\ACT.exe
C:\windows\system\ACT.exe
1⤵
PID:5836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 820
  2⤵
  PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1616 -ip 1616
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5836 -ip 5836
1⤵
PID:3372

C:\windows\SysWOW64\MAOGO.exe
C:\windows\SysWOW64\MAOGO.exe
1⤵
PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ABNYBS.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4516
- - C:\windows\ABNYBS.exe
    C:\windows\ABNYBS.exe
    3⤵
    PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\NXN.exe.bat" "
      4⤵
      PID:1932
    - - C:\windows\NXN.exe
        
        C:\windows\NXN.exe
        5⤵
        
        PID:2412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 836
        6⤵
        
        PID:2724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1008
      4⤵
      PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1324
  2⤵
  PID:5232

C:\windows\SysWOW64\KVJNNTV.exe
C:\windows\SysWOW64\KVJNNTV.exe
1⤵
PID:1336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 844
  2⤵
  PID:3472

C:\windows\SysWOW64\YNCE.exe
C:\windows\SysWOW64\YNCE.exe
1⤵
PID:304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5924
- - C:\windows\system\IWRLY.exe
    C:\windows\system\IWRLY.exe
    3⤵
    PID:4204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\PCXZ.exe.bat" "
      4⤵
      PID:1448
    - - C:\windows\system\PCXZ.exe
        
        C:\windows\system\PCXZ.exe
        5⤵
        
        PID:732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 848
        6⤵
        
        PID:908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 996
      4⤵
      PID:3516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 1340
  2⤵
  PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4072 -ip 4072
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1336 -ip 1336
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 304 -ip 304
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4932 -ip 4932
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4204 -ip 4204
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2412 -ip 2412
1⤵
PID:1776

C:\windows\system\IWRLY.exe
C:\windows\system\IWRLY.exe
1⤵
PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\MNDCEHK.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5588
- - C:\windows\system\MNDCEHK.exe
    C:\windows\system\MNDCEHK.exe
    3⤵
    PID:5112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 844
      4⤵
      PID:3220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 968
  2⤵
  PID:768

C:\windows\ABNYBS.exe
C:\windows\ABNYBS.exe
1⤵
PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYDNCPW.exe.bat" "
  2⤵
  PID:5000
- - C:\windows\SysWOW64\BYDNCPW.exe
    C:\windows\system32\BYDNCPW.exe
    3⤵
    PID:1512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 836
      4⤵
      PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 980
  2⤵
  PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 732 -ip 732
1⤵
PID:2392

C:\windows\system\PCXZ.exe
C:\windows\system\PCXZ.exe
1⤵
PID:2864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 744
  2⤵
  PID:5752

C:\windows\NXN.exe
C:\windows\NXN.exe
1⤵
PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 796
  2⤵
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 948 -ip 948
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2808 -ip 2808
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2864 -ip 2864
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2812 -ip 2812
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5112 -ip 5112
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1512 -ip 1512
1⤵
PID:1396

C:\windows\SysWOW64\BYDNCPW.exe
C:\windows\SysWOW64\BYDNCPW.exe
1⤵
PID:6136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 728
  2⤵
  PID:6024

C:\windows\system\MNDCEHK.exe
C:\windows\system\MNDCEHK.exe
1⤵
PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\TOIVEC.exe.bat" "
  2⤵
  PID:1232
- - C:\windows\system\TOIVEC.exe
    C:\windows\system\TOIVEC.exe
    3⤵
    PID:4080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\WXJRLPA.exe.bat" "
      4⤵
      PID:3580
    - - C:\windows\WXJRLPA.exe
        
        C:\windows\WXJRLPA.exe
        5⤵
        
        PID:3900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ANQRY.exe.bat" "
        6⤵
        
        PID:5640
        
        C:\windows\ANQRY.exe
        
        C:\windows\ANQRY.exe
        7⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 832
        8⤵
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 980
        6⤵
        
        PID:4828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1380
      4⤵
      PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 1304
  2⤵
  PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6136 -ip 6136
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4684 -ip 4684
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4080 -ip 4080
1⤵
PID:1980

C:\windows\system\TOIVEC.exe
C:\windows\system\TOIVEC.exe
1⤵
PID:1168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\BXFMY.exe.bat" "
  2⤵
  PID:4332
- - C:\windows\system\BXFMY.exe
    C:\windows\system\BXFMY.exe
    3⤵
    PID:608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDKTJ.exe.bat" "
      4⤵
      PID:4060
    - - C:\windows\SysWOW64\JDKTJ.exe
        
        C:\windows\system32\JDKTJ.exe
        5⤵
        
        PID:692
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TAYNYTG.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:1732
        
        C:\windows\system\TAYNYTG.exe
        
        C:\windows\system\TAYNYTG.exe
        7⤵
        
        PID:240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 840
        8⤵
        
        PID:5952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 1372
        6⤵
        
        PID:4768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 1324
      4⤵
      PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 944
  2⤵
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3900 -ip 3900
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1168 -ip 1168
1⤵
PID:2148

C:\windows\WXJRLPA.exe
C:\windows\WXJRLPA.exe
1⤵
PID:5304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NICR.exe.bat" "
  2⤵
  PID:6008
- - C:\windows\SysWOW64\NICR.exe
    C:\windows\system32\NICR.exe
    3⤵
    PID:1760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 844
      4⤵
      PID:5332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 988
  2⤵
  PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2164 -ip 2164
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 608 -ip 608
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5304 -ip 5304
1⤵
PID:840

C:\windows\ANQRY.exe
C:\windows\ANQRY.exe
1⤵
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 808
  2⤵
  PID:3152

C:\windows\system\BXFMY.exe
C:\windows\system\BXFMY.exe
1⤵
PID:5880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 812
  2⤵
  PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 692 -ip 692
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2892 -ip 2892
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5880 -ip 5880
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1760 -ip 1760
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 240 -ip 240
1⤵
PID:1508

C:\windows\SysWOW64\JDKTJ.exe
C:\windows\SysWOW64\JDKTJ.exe
1⤵
PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DMQOQA.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2848
- - C:\windows\SysWOW64\DMQOQA.exe
    C:\windows\system32\DMQOQA.exe
    3⤵
    PID:1332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEZ.exe.bat" "
      4⤵
      PID:5324
    - - C:\windows\SysWOW64\NEZ.exe
        
        C:\windows\system32\NEZ.exe
        5⤵
        
        PID:3164
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSXESJP.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:908
        
        C:\windows\SysWOW64\PSXESJP.exe
        
        C:\windows\system32\PSXESJP.exe
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 824
        8⤵
        
        PID:1652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1348
        6⤵
        
        PID:5024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1012
      4⤵
      PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1332
  2⤵
  PID:3516

C:\windows\system\TAYNYTG.exe
C:\windows\system\TAYNYTG.exe
1⤵
PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ZRO.exe.bat" "
  2⤵
  PID:6032
- - C:\windows\ZRO.exe
    C:\windows\ZRO.exe
    3⤵
    PID:3192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKKD.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4700
    - - C:\windows\SysWOW64\SKKD.exe
        
        C:\windows\system32\SKKD.exe
        5⤵
        
        PID:5248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 848
        6⤵
        
        PID:1924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1336
      4⤵
      PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 944
  2⤵
  PID:4808

C:\windows\SysWOW64\NICR.exe
C:\windows\SysWOW64\NICR.exe
1⤵
PID:5780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\XZV.exe.bat" "
  2⤵
  PID:2148
- - C:\windows\system\XZV.exe
    C:\windows\system\XZV.exe
    3⤵
    PID:3572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "
      4⤵
      PID:4696
    - - C:\windows\XCF.exe
        
        C:\windows\XCF.exe
        5⤵
        
        PID:3240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028
      4⤵
      PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 988
  2⤵
  PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4616 -ip 4616
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 840 -ip 840
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5780 -ip 5780
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1332 -ip 1332
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3572 -ip 3572
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3192 -ip 3192
1⤵
PID:4308

C:\windows\SysWOW64\DMQOQA.exe
C:\windows\SysWOW64\DMQOQA.exe
1⤵
PID:5996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 828
  2⤵
  PID:4896

C:\windows\system\XZV.exe
C:\windows\system\XZV.exe
1⤵
PID:5460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 808
  2⤵
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3164 -ip 3164
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5996 -ip 5996
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5460 -ip 5460
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5248 -ip 5248
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3240 -ip 3240
1⤵
PID:1204

C:\windows\SysWOW64\NEZ.exe
C:\windows\SysWOW64\NEZ.exe
1⤵
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SDWO.exe.bat" "
  2⤵
  PID:2368
- - C:\windows\system\SDWO.exe
    C:\windows\system\SDWO.exe
    3⤵
    PID:1916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 836
      4⤵
      PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1324
  2⤵
  PID:4320

C:\windows\ZRO.exe
C:\windows\ZRO.exe
1⤵
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVEMOE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:944
- - C:\windows\SysWOW64\FVEMOE.exe
    C:\windows\system32\FVEMOE.exe
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTFBDVD.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4692
    - - C:\windows\SysWOW64\NTFBDVD.exe
        
        C:\windows\system32\NTFBDVD.exe
        5⤵
        
        PID:252
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TPQUJRT.exe.bat" "
        6⤵
        
        PID:5940
        
        C:\windows\system\TPQUJRT.exe
        
        C:\windows\system\TPQUJRT.exe
        7⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCVE.exe.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:4768
        
        C:\windows\SysWOW64\OCVE.exe
        
        C:\windows\system32\OCVE.exe
        9⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PFLAIS.exe.bat" "
        10⤵
        Executes a command shell one-liner
        
        PID:4456
        
        C:\windows\system\PFLAIS.exe
        
        C:\windows\system\PFLAIS.exe
        11⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QDT.exe.bat" "
        12⤵
        
        PID:4068
        
        C:\windows\system\QDT.exe
        
        C:\windows\system\QDT.exe
        13⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GIKPEV.exe.bat" "
        14⤵
        
        PID:5812
        
        C:\windows\system\GIKPEV.exe
        
        C:\windows\system\GIKPEV.exe
        15⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 848
        16⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1004
        14⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1344
        12⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 980
        10⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1372
        8⤵
        
        PID:4288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 252 -s 1380
        6⤵
        
        PID:684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1324
      4⤵
      PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 972
  2⤵
  PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1236 -ip 1236
1⤵
PID:2792

C:\windows\SysWOW64\PSXESJP.exe
C:\windows\SysWOW64\PSXESJP.exe
1⤵
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 836
  2⤵
  PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3616 -ip 3616
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2936 -ip 2936
1⤵
PID:4448

C:\windows\SysWOW64\SKKD.exe
C:\windows\SysWOW64\SKKD.exe
1⤵
PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 840
  2⤵
  PID:2112

C:\windows\XCF.exe
C:\windows\XCF.exe
1⤵
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 808
  2⤵
  PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1776 -ip 1776
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3784 -ip 3784
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 1508 -ip 1508
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1916 -ip 1916
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4092 -ip 4092
1⤵
PID:2584

C:\windows\system\SDWO.exe
C:\windows\system\SDWO.exe
1⤵
PID:5220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 812
  2⤵
  PID:3248

C:\windows\SysWOW64\FVEMOE.exe
C:\windows\SysWOW64\FVEMOE.exe
1⤵
PID:5644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 836
  2⤵
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 252 -ip 252
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5220 -ip 5220
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5644 -ip 5644
1⤵
PID:4496

C:\windows\SysWOW64\NTFBDVD.exe
C:\windows\SysWOW64\NTFBDVD.exe
1⤵
PID:6100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MCQZTAR.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4448
- - C:\windows\SysWOW64\MCQZTAR.exe
    C:\windows\system32\MCQZTAR.exe
    3⤵
    PID:2392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 836
      4⤵
      PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 980
  2⤵
  PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3332 -ip 3332
1⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6100 -ip 6100
1⤵
PID:3244

C:\windows\system\TPQUJRT.exe
C:\windows\system\TPQUJRT.exe
1⤵
PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 796
  2⤵
  PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 4900 -ip 4900
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2392 -ip 2392
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4752 -ip 4752
1⤵
PID:3548

C:\windows\SysWOW64\MCQZTAR.exe
C:\windows\SysWOW64\MCQZTAR.exe
1⤵
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\BWOB.exe.bat" "
  2⤵
  PID:1396
- - C:\windows\system\BWOB.exe
    C:\windows\system\BWOB.exe
    3⤵
    PID:4636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 848
      4⤵
      PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 1368
  2⤵
  PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3336 -ip 3336
1⤵
PID:4376

C:\windows\SysWOW64\OCVE.exe
C:\windows\SysWOW64\OCVE.exe
1⤵
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HLA.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4284
- - C:\windows\HLA.exe
    C:\windows\HLA.exe
    3⤵
    PID:3360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 848
      4⤵
      PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1016
  2⤵
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1716 -ip 1716
1⤵
PID:4444

C:\windows\system\PFLAIS.exe
C:\windows\system\PFLAIS.exe
1⤵
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 804
  2⤵
  PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3372 -ip 3372
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4336 -ip 4336
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2584 -ip 2584
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4636 -ip 4636
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1204 -ip 1204
1⤵
PID:3932

C:\windows\system\QDT.exe
C:\windows\system\QDT.exe
1⤵
PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\YPH.exe.bat" "
  2⤵
  PID:5864
- - C:\windows\YPH.exe
    C:\windows\YPH.exe
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\LKLV.exe.bat" "
      4⤵
      PID:988
    - - C:\windows\LKLV.exe
        
        C:\windows\LKLV.exe
        5⤵
        
        PID:2664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YIL.exe.bat" "
        6⤵
        
        PID:1480
        
        C:\windows\system\YIL.exe
        
        C:\windows\system\YIL.exe
        7⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QQA.exe.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:2188
        
        C:\windows\SysWOW64\QQA.exe
        
        C:\windows\system32\QQA.exe
        9⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 844
        10⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 1020
        8⤵
        
        PID:2684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1012
        6⤵
        
        PID:3512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1320
      4⤵
      PID:5216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 972
  2⤵
  PID:3932

C:\windows\system\BWOB.exe
C:\windows\system\BWOB.exe
1⤵
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\JCJ.exe.bat" "
  2⤵
  PID:4556
- - C:\windows\system\JCJ.exe
    C:\windows\system\JCJ.exe
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 780
      4⤵
      PID:784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 988
  2⤵
  PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3360 -ip 3360
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6112 -ip 6112
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3180 -ip 3180
1⤵
PID:784

C:\windows\HLA.exe
C:\windows\HLA.exe
1⤵
PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 692
  2⤵
  PID:2884

C:\windows\system\GIKPEV.exe
C:\windows\system\GIKPEV.exe
1⤵
PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 808
  2⤵
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 832 -ip 832
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3592 -ip 3592
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1980 -ip 1980
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3012 -ip 3012
1⤵
PID:1340

C:\windows\YPH.exe
C:\windows\YPH.exe
1⤵
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGSKAXA.exe.bat" "
  2⤵
  PID:3000
- - C:\windows\SysWOW64\XGSKAXA.exe
    C:\windows\system32\XGSKAXA.exe
    3⤵
    PID:5604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 848
      4⤵
      PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 944
  2⤵
  PID:6080

C:\windows\system\JCJ.exe
C:\windows\system\JCJ.exe
1⤵
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\MTPGBUO.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:272
- - C:\windows\system\MTPGBUO.exe
    C:\windows\system\MTPGBUO.exe
    3⤵
    PID:1636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 840
      4⤵
      PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 944
  2⤵
  PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2664 -ip 2664
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1720 -ip 1720
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2968 -ip 2968
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1320 -ip 1320
1⤵
PID:4496

C:\windows\LKLV.exe
C:\windows\LKLV.exe
1⤵
PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 812
  2⤵
  PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4172 -ip 4172
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5604 -ip 5604
1⤵
PID:4496

C:\windows\system\YIL.exe
C:\windows\system\YIL.exe
1⤵
PID:5876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITSFABS.exe.bat" "
  2⤵
  PID:2292
- - C:\windows\SysWOW64\ITSFABS.exe
    C:\windows\system32\ITSFABS.exe
    3⤵
    PID:4360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 848
      4⤵
      PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 944
  2⤵
  PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1636 -ip 1636
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2880 -ip 2880
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5876 -ip 5876
1⤵
PID:5856

C:\windows\system\MTPGBUO.exe
C:\windows\system\MTPGBUO.exe
1⤵
PID:5632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\DUIWISJ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6116
- - C:\windows\DUIWISJ.exe
    C:\windows\DUIWISJ.exe
    3⤵
    PID:5592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 848
      4⤵
      PID:3516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 1332
  2⤵
  PID:3928

C:\windows\SysWOW64\XGSKAXA.exe
C:\windows\SysWOW64\XGSKAXA.exe
1⤵
PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\NPKN.exe.bat" "
  2⤵
  PID:5992
- - C:\windows\system\NPKN.exe
    C:\windows\system\NPKN.exe
    3⤵
    PID:6028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TVSPV.exe.bat" "
      4⤵
      PID:3472
    - - C:\windows\SysWOW64\TVSPV.exe
        
        C:\windows\system32\TVSPV.exe
        5⤵
        
        PID:5332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 836
        6⤵
        
        PID:3512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 1340
      4⤵
      PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 988
  2⤵
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4360 -ip 4360
1⤵
PID:6028

C:\windows\SysWOW64\QQA.exe
C:\windows\SysWOW64\QQA.exe
1⤵
PID:1452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXRFOHC.exe.bat" "
  2⤵
  PID:3440
- - C:\windows\SysWOW64\GXRFOHC.exe
    C:\windows\system32\GXRFOHC.exe
    3⤵
    PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LSRM.exe.bat" "
      4⤵
      PID:5920
    - - C:\windows\SysWOW64\LSRM.exe
        
        C:\windows\system32\LSRM.exe
        5⤵
        
        PID:3684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 848
        6⤵
        
        PID:6080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 980
      4⤵
      PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 1360
  2⤵
  PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5632 -ip 5632
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4396 -ip 4396
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1452 -ip 1452
1⤵
PID:2112

C:\windows\SysWOW64\ITSFABS.exe
C:\windows\SysWOW64\ITSFABS.exe
1⤵
PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 832
  2⤵
  PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5116 -ip 5116
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5592 -ip 5592
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3300 -ip 3300
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6028 -ip 6028
1⤵
PID:3512

C:\windows\SysWOW64\GXRFOHC.exe
C:\windows\SysWOW64\GXRFOHC.exe
1⤵
PID:3244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 824
  2⤵
  PID:3240

C:\windows\DUIWISJ.exe
C:\windows\DUIWISJ.exe
1⤵
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ITFXTCX.exe.bat" "
  2⤵
  PID:2840
- - C:\windows\system\ITFXTCX.exe
    C:\windows\system\ITFXTCX.exe
    3⤵
    PID:2752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 840
      4⤵
      PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 864
  2⤵
  PID:5016

C:\windows\system\NPKN.exe
C:\windows\system\NPKN.exe
1⤵
PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOCTMA.exe.bat" "
  2⤵
  PID:1196
- - C:\windows\SysWOW64\XOCTMA.exe
    C:\windows\system32\XOCTMA.exe
    3⤵
    PID:5024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 832
      4⤵
      PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 952
  2⤵
  PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5332 -ip 5332
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3684 -ip 3684
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3244 -ip 3244
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4652 -ip 4652
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3932 -ip 3932
1⤵
PID:5772

C:\windows\SysWOW64\TVSPV.exe
C:\windows\SysWOW64\TVSPV.exe
1⤵
PID:1432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 832
  2⤵
  PID:5316

C:\windows\SysWOW64\LSRM.exe
C:\windows\SysWOW64\LSRM.exe
1⤵
PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 816
  2⤵
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1432 -ip 1432
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5100 -ip 5100
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2752 -ip 2752
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5024 -ip 5024
1⤵
PID:1056

C:\windows\SysWOW64\XOCTMA.exe
C:\windows\SysWOW64\XOCTMA.exe
1⤵
PID:6024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FAYGVT.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4424
- - C:\windows\FAYGVT.exe
    C:\windows\FAYGVT.exe
    3⤵
    PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\BXKK.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:5152
    - - C:\windows\BXKK.exe
        
        C:\windows\BXKK.exe
        5⤵
        
        PID:3200
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DVQ.exe.bat" "
        6⤵
        
        PID:1312
        
        C:\windows\DVQ.exe
        
        C:\windows\DVQ.exe
        7⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 784
        8⤵
        
        PID:1488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 952
        6⤵
        
        PID:4660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1364
      4⤵
      PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 1324
  2⤵
  PID:5824

C:\windows\system\ITFXTCX.exe
C:\windows\system\ITFXTCX.exe
1⤵
PID:3136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 804
  2⤵
  PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3136 -ip 3136
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6024 -ip 6024
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2744 -ip 2744
1⤵
PID:4124

C:\windows\FAYGVT.exe
C:\windows\FAYGVT.exe
1⤵
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ULV.exe.bat" "
  2⤵
  PID:2568
- - C:\windows\ULV.exe
    C:\windows\ULV.exe
    3⤵
    PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XBRPKR.exe.bat" "
      4⤵
      PID:480
    - - C:\windows\system\XBRPKR.exe
        
        C:\windows\system\XBRPKR.exe
        5⤵
        
        PID:1492
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\URLV.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:628
        
        C:\windows\URLV.exe
        
        C:\windows\URLV.exe
        7⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 844
        8⤵
        
        PID:1468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1364
        6⤵
        
        PID:4952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 980
      4⤵
      PID:4512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 972
  2⤵
  PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3200 -ip 3200
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1956 -ip 1956
1⤵
PID:5432

C:\windows\BXKK.exe
C:\windows\BXKK.exe
1⤵
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZLSDHB.exe.bat" "
  2⤵
  PID:2856
- - C:\windows\SysWOW64\ZLSDHB.exe
    C:\windows\system32\ZLSDHB.exe
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\JEB.exe.bat" "
      4⤵
      PID:5016
    - - C:\windows\system\JEB.exe
        
        C:\windows\system\JEB.exe
        5⤵
        
        PID:5432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 832
        6⤵
        
        PID:2264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1276
      4⤵
      PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1328
  2⤵
  PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5856 -ip 5856
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4564 -ip 4564
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5028 -ip 5028
1⤵
PID:1200

C:\windows\DVQ.exe
C:\windows\DVQ.exe
1⤵
PID:236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\XWJZUC.exe.bat" "
  2⤵
  PID:1844
- - C:\windows\XWJZUC.exe
    C:\windows\XWJZUC.exe
    3⤵
    PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 984
  2⤵
  PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3248 -ip 3248
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 236 -ip 236
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1492 -ip 1492
1⤵
PID:4340

C:\windows\SysWOW64\ZLSDHB.exe
C:\windows\SysWOW64\ZLSDHB.exe
1⤵
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 824
  2⤵
  PID:244

C:\windows\ULV.exe
C:\windows\ULV.exe
1⤵
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 812
  2⤵
  PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2108 -ip 2108
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5432 -ip 5432
1⤵
PID:5752

C:\windows\system\XBRPKR.exe
C:\windows\system\XBRPKR.exe
1⤵
PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\NPNN.exe.bat" "
  2⤵
  PID:3420
- - C:\windows\system\NPNN.exe
    C:\windows\system\NPNN.exe
    3⤵
    PID:4648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 844
      4⤵
      PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1336
  2⤵
  PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2644 -ip 2644
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5328 -ip 5328
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2216 -ip 2216
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3428 -ip 3428
1⤵
PID:1340

C:\windows\system\JEB.exe
C:\windows\system\JEB.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 800
  2⤵
  PID:5804

C:\windows\URLV.exe
C:\windows\URLV.exe
1⤵
PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 800
  2⤵
  PID:1268

C:\windows\XWJZUC.exe
C:\windows\XWJZUC.exe
1⤵
PID:5564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 796
  2⤵
  PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4648 -ip 4648
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2580 -ip 2580
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5564 -ip 5564
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4444 -ip 4444
1⤵
PID:5704

C:\windows\system\NPNN.exe
C:\windows\system\NPNN.exe
1⤵
PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\MWP.exe.bat" "
  2⤵
  PID:4352
- - C:\windows\MWP.exe
    C:\windows\MWP.exe
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\HJURT.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4112
    - - C:\windows\system\HJURT.exe
        
        C:\windows\system\HJURT.exe
        5⤵
        
        PID:3152
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRBRFAV.exe.bat" "
        6⤵
        
        PID:684
        
        C:\windows\SysWOW64\LRBRFAV.exe
        
        C:\windows\system32\LRBRFAV.exe
        7⤵
        
        PID:472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 836
        8⤵
        
        PID:2912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1332
        6⤵
        
        PID:444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 980
      4⤵
      PID:5316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 944
  2⤵
  PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4400 -ip 4400
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4952 -ip 4952
1⤵
PID:5964

C:\windows\MWP.exe
C:\windows\MWP.exe
1⤵
PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\LJJ.exe.bat" "
  2⤵
  PID:4480
- - C:\windows\LJJ.exe
    C:\windows\LJJ.exe
    3⤵
    PID:5964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\FXCKU.exe.bat" "
      4⤵
      PID:4376
    - - C:\windows\FXCKU.exe
        
        C:\windows\FXCKU.exe
        5⤵
        
        PID:2732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 780
        6⤵
        
        PID:4320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1000
      4⤵
      PID:5424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 952
  2⤵
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3152 -ip 3152
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5336 -ip 5336
1⤵
PID:2900

C:\windows\system\HJURT.exe
C:\windows\system\HJURT.exe
1⤵
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAYSRGG.exe.bat" "
  2⤵
  PID:1136
- - C:\windows\SysWOW64\AAYSRGG.exe
    C:\windows\system32\AAYSRGG.exe
    3⤵
    PID:4076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 780
      4⤵
      PID:244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1288
  2⤵
  PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 472 -ip 472
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5964 -ip 5964
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2748 -ip 2748
1⤵
PID:4708

C:\windows\SysWOW64\LRBRFAV.exe
C:\windows\SysWOW64\LRBRFAV.exe
1⤵
PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 840
  2⤵
  PID:3364

C:\windows\LJJ.exe
C:\windows\LJJ.exe
1⤵
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 808
  2⤵
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4076 -ip 4076
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2732 -ip 2732
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4548 -ip 4548
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2912 -ip 2912
1⤵
PID:2112

C:\windows\SysWOW64\AAYSRGG.exe
C:\windows\SysWOW64\AAYSRGG.exe
1⤵
PID:5244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNS.exe.bat" "
  2⤵
  PID:1524
- - C:\windows\SysWOW64\YNS.exe
    C:\windows\system32\YNS.exe
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 836
      4⤵
      PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 972
  2⤵
  PID:4272

C:\windows\FXCKU.exe
C:\windows\FXCKU.exe
1⤵
PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CLQJRQ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:560
- - C:\windows\SysWOW64\CLQJRQ.exe
    C:\windows\system32\CLQJRQ.exe
    3⤵
    PID:4660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\TLFPEH.exe.bat" "
      4⤵
      PID:4320
    - - C:\windows\TLFPEH.exe
        
        C:\windows\TLFPEH.exe
        5⤵
        
        PID:4804
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GRTHK.exe.bat" "
        6⤵
        
        PID:5932
        
        C:\windows\system\GRTHK.exe
        
        C:\windows\system\GRTHK.exe
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JXSDEX.exe.bat" "
        8⤵
        
        PID:3948
        
        C:\windows\JXSDEX.exe
        
        C:\windows\JXSDEX.exe
        9⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 836
        10⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1012
        8⤵
        
        PID:1764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1008
        6⤵
        
        PID:2900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 988
      4⤵
      PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 944
  2⤵
  PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5244 -ip 5244
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1308 -ip 1308
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2524 -ip 2524
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4660 -ip 4660
1⤵
PID:6064

C:\windows\SysWOW64\YNS.exe
C:\windows\SysWOW64\YNS.exe
1⤵
PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\CZRVP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2544
- - C:\windows\CZRVP.exe
    C:\windows\CZRVP.exe
    3⤵
    PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 840
      4⤵
      PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1016
  2⤵
  PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3748 -ip 3748
1⤵
PID:5716

C:\windows\SysWOW64\CLQJRQ.exe
C:\windows\SysWOW64\CLQJRQ.exe
1⤵
PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\IFYQUGY.exe.bat" "
  2⤵
  PID:3536
- - C:\windows\system\IFYQUGY.exe
    C:\windows\system\IFYQUGY.exe
    3⤵
    PID:4340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 840
      4⤵
      PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 972
  2⤵
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4804 -ip 4804
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2684 -ip 2684
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 244 -ip 244
1⤵
PID:6012

C:\windows\TLFPEH.exe
C:\windows\TLFPEH.exe
1⤵
PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 796
  2⤵
  PID:4812

C:\windows\CZRVP.exe
C:\windows\CZRVP.exe
1⤵
PID:5184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 796
  2⤵
  PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1488 -ip 1488
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 636 -ip 636
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5184 -ip 5184
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4340 -ip 4340
1⤵
PID:3716

C:\windows\system\GRTHK.exe
C:\windows\system\GRTHK.exe
1⤵
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQB.exe.bat" "
  2⤵
  PID:3116
- - C:\windows\SysWOW64\MQB.exe
    C:\windows\system32\MQB.exe
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\SLNU.exe.bat" "
      4⤵
      PID:6068
    - - C:\windows\system\SLNU.exe
        
        C:\windows\system\SLNU.exe
        5⤵
        
        PID:6172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 780
        6⤵
        
        PID:6320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1004
      4⤵
      PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 956
  2⤵
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2900 -ip 2900
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4416 -ip 4416
1⤵
PID:4560

C:\windows\JXSDEX.exe
C:\windows\JXSDEX.exe
1⤵
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVWFK.exe.bat" "
  2⤵
  PID:1224
- - C:\windows\SysWOW64\HVWFK.exe
    C:\windows\system32\HVWFK.exe
    3⤵
    PID:6208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 840
      4⤵
      PID:6388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 800
  2⤵
  PID:1964

C:\windows\system\IFYQUGY.exe
C:\windows\system\IFYQUGY.exe
1⤵
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\UYSNGOZ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2112
- - C:\windows\UYSNGOZ.exe
    C:\windows\UYSNGOZ.exe
    3⤵
    PID:6200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 844
      4⤵
      PID:6376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1288
  2⤵
  PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4488 -ip 4488
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1468 -ip 1468
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2520 -ip 2520
1⤵
PID:1780

C:\windows\SysWOW64\MQB.exe
C:\windows\SysWOW64\MQB.exe
1⤵
PID:6148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 832
  2⤵
  PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6148 -ip 6148
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6172 -ip 6172
1⤵
PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6200 -ip 6200
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6208 -ip 6208
1⤵
PID:6352

C:\windows\SysWOW64\HVWFK.exe
C:\windows\SysWOW64\HVWFK.exe
1⤵
PID:6632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 728
  2⤵
  PID:6940

C:\windows\system\SLNU.exe
C:\windows\system\SLNU.exe
1⤵
PID:6644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HHDH.exe.bat" "
  2⤵
  PID:6824
- - C:\windows\HHDH.exe
    C:\windows\HHDH.exe
    3⤵
    PID:7024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\EXD.exe.bat" "
      4⤵
      PID:2888
    - - C:\windows\EXD.exe
        
        C:\windows\EXD.exe
        5⤵
        
        PID:1964
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OQVQJRM.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:2588
        
        C:\windows\OQVQJRM.exe
        
        C:\windows\OQVQJRM.exe
        7⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 832
        8⤵
        
        PID:6956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1340
        6⤵
        
        PID:6392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 1360
      4⤵
      PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 1324
  2⤵
  PID:6916

C:\windows\UYSNGOZ.exe
C:\windows\UYSNGOZ.exe
1⤵
PID:6652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\FPKT.exe.bat" "
  2⤵
  PID:6840
- - C:\windows\system\FPKT.exe
    C:\windows\system\FPKT.exe
    3⤵
    PID:7048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\GDIJYSQ.exe.bat" "
      4⤵
      PID:3512
    - - C:\windows\GDIJYSQ.exe
        
        C:\windows\GDIJYSQ.exe
        5⤵
        
        PID:3788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDYUP.exe.bat" "
        6⤵
        
        PID:3396
        
        C:\windows\SysWOW64\ZDYUP.exe
        
        C:\windows\system32\ZDYUP.exe
        7⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 844
        8⤵
        
        PID:6768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1000
        6⤵
        
        PID:6396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 1364
      4⤵
      PID:6232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 1308
  2⤵
  PID:6972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6632 -ip 6632
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6652 -ip 6652
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6644 -ip 6644
1⤵
PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7024 -ip 7024
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 7048 -ip 7048
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3788 -ip 3788
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1964 -ip 1964
1⤵
PID:6276

C:\windows\HHDH.exe
C:\windows\HHDH.exe
1⤵
PID:6780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 748
  2⤵
  PID:6928

C:\windows\system\FPKT.exe
C:\windows\system\FPKT.exe
1⤵
PID:6884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 804
  2⤵
  PID:6888

C:\windows\GDIJYSQ.exe
C:\windows\GDIJYSQ.exe
1⤵
PID:7004

C:\windows\EXD.exe
C:\windows\EXD.exe
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6780 -ip 6780
1⤵
PID:6940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6800 -ip 6800
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6884 -ip 6884
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 6796 -ip 6796
1⤵
PID:6764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7000 -ip 7000
1⤵
PID:6916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7004 -ip 7004
1⤵
PID:6672

C:\windows\OQVQJRM.exe
C:\windows\OQVQJRM.exe
1⤵
PID:7148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPFZSH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4356
- - C:\windows\SysWOW64\LPFZSH.exe
    C:\windows\system32\LPFZSH.exe
    3⤵
    PID:4272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\MSJUY.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6960
    - - C:\windows\system\MSJUY.exe
        
        C:\windows\system\MSJUY.exe
        5⤵
        
        PID:6744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 744
        6⤵
        
        PID:6988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1316
      4⤵
      PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 944
  2⤵
  PID:7164

C:\windows\SysWOW64\ZDYUP.exe
C:\windows\SysWOW64\ZDYUP.exe
1⤵
PID:7156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ACCUMF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6224
- - C:\windows\ACCUMF.exe
    C:\windows\ACCUMF.exe
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHNKCA.exe.bat" "
      4⤵
      PID:6384
    - - C:\windows\SysWOW64\FHNKCA.exe
        
        C:\windows\system32\FHNKCA.exe
        5⤵
        
        PID:6896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 836
        6⤵
        
        PID:6852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1004
      4⤵
      PID:6980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 972
  2⤵
  PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 7148 -ip 7148
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7156 -ip 7156
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4272 -ip 4272
1⤵
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1708 -ip 1708
1⤵
PID:6496

C:\windows\SysWOW64\LPFZSH.exe
C:\windows\SysWOW64\LPFZSH.exe
1⤵
PID:6704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 836
  2⤵
  PID:7072

C:\windows\ACCUMF.exe
C:\windows\ACCUMF.exe
1⤵
PID:6240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\QSME.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6328
- - C:\windows\QSME.exe
    C:\windows\QSME.exe
    3⤵
    PID:2964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\GTHQFMV.exe.bat" "
      4⤵
      PID:6444
    - - C:\windows\system\GTHQFMV.exe
        
        C:\windows\system\GTHQFMV.exe
        5⤵
        
        PID:6944
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MOSRLB.exe.bat" "
        6⤵
        
        PID:6988
        
        C:\windows\MOSRLB.exe
        
        C:\windows\MOSRLB.exe
        7⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 832
        8⤵
        
        PID:6348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 1316
        6⤵
        
        PID:6236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1272
      4⤵
      PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 796
  2⤵
  PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 6744 -ip 6744
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6896 -ip 6896
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6704 -ip 6704
1⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6240 -ip 6240
1⤵
PID:6372

C:\windows\SysWOW64\FHNKCA.exe
C:\windows\SysWOW64\FHNKCA.exe
1⤵
PID:1668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\JGX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6516
- - C:\windows\JGX.exe
    C:\windows\JGX.exe
    3⤵
    PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XWZAPY.exe.bat" "
      4⤵
      PID:6908
    - - C:\windows\system\XWZAPY.exe
        
        C:\windows\system\XWZAPY.exe
        5⤵
        
        PID:1268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 848
        6⤵
        
        PID:6636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 896
      4⤵
      PID:6616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1356
  2⤵
  PID:2372

C:\windows\system\MSJUY.exe
C:\windows\system\MSJUY.exe
1⤵
PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ADVDTD.exe.bat" "
  2⤵
  PID:7144
- - C:\windows\ADVDTD.exe
    C:\windows\ADVDTD.exe
    3⤵
    PID:6756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XBVNSDQ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6784
    - - C:\windows\system\XBVNSDQ.exe
        
        C:\windows\system\XBVNSDQ.exe
        5⤵
        
        PID:6732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 848
        6⤵
        
        PID:5288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 1388
      4⤵
      PID:5752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 944
  2⤵
  PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2256 -ip 2256
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1668 -ip 1668
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2964 -ip 2964
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 6944 -ip 6944
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6756 -ip 6756
1⤵
PID:6556

C:\windows\QSME.exe
C:\windows\QSME.exe
1⤵
PID:7072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 808
  2⤵
  PID:6232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2400 -ip 2400
1⤵
PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7072 -ip 7072
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6732 -ip 6732
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6628 -ip 6628
1⤵
PID:6416

C:\windows\system\GTHQFMV.exe
C:\windows\system\GTHQFMV.exe
1⤵
PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANBMJ.exe.bat" "
  2⤵
  PID:6344
- - C:\windows\SysWOW64\ANBMJ.exe
    C:\windows\system32\ANBMJ.exe
    3⤵
    PID:6372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 788
      4⤵
      PID:6272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 976
  2⤵
  PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1268 -ip 1268
1⤵
PID:5804

C:\windows\JGX.exe
C:\windows\JGX.exe
1⤵
PID:7140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\CSGF.exe.bat" "
  2⤵
  PID:5752
- - C:\windows\system\CSGF.exe
    C:\windows\system\CSGF.exe
    3⤵
    PID:6916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 836
      4⤵
      PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 976
  2⤵
  PID:6156

C:\windows\ADVDTD.exe
C:\windows\ADVDTD.exe
1⤵
PID:6672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\LVIEN.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:7056
- - C:\windows\LVIEN.exe
    C:\windows\LVIEN.exe
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 840
      4⤵
      PID:6292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 1324
  2⤵
  PID:6416

C:\windows\system\XWZAPY.exe
C:\windows\system\XWZAPY.exe
1⤵
PID:6972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 812
  2⤵
  PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3364 -ip 3364
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7140 -ip 7140
1⤵
PID:6388

C:\windows\system\XBVNSDQ.exe
C:\windows\system\XBVNSDQ.exe
1⤵
PID:6448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6672 -ip 6672
1⤵
PID:6064

C:\windows\MOSRLB.exe
C:\windows\MOSRLB.exe
1⤵
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 808
  2⤵
  PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6972 -ip 6972
1⤵
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6448 -ip 6448
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4560 -ip 4560
1⤵
PID:6700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6916 -ip 6916
1⤵
PID:7128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6372 -ip 6372
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3692 -ip 3692
1⤵
PID:1208

C:\windows\LVIEN.exe
C:\windows\LVIEN.exe
1⤵
PID:6580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\VBSHPB.exe.bat" "
  2⤵
  PID:6888
- - C:\windows\system\VBSHPB.exe
    C:\windows\system\VBSHPB.exe
    3⤵
    PID:6992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\PZTADU.exe.bat" "
      4⤵
      PID:6712
    - - C:\windows\system\PZTADU.exe
        
        C:\windows\system\PZTADU.exe
        5⤵
        
        PID:1364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\PCEKNF.exe.bat" "
        6⤵
        
        PID:6792
        
        C:\windows\PCEKNF.exe
        
        C:\windows\PCEKNF.exe
        7⤵
        
        PID:2532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 980
        6⤵
        
        PID:1780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 980
      4⤵
      PID:3460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 1336
  2⤵
  PID:7052

C:\windows\system\CSGF.exe
C:\windows\system\CSGF.exe
1⤵
PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\GGVMVEQ.exe.bat" "
  2⤵
  PID:1948
- - C:\windows\GGVMVEQ.exe
    C:\windows\GGVMVEQ.exe
    3⤵
    PID:6248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\ERNQAF.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6820
    - - C:\windows\ERNQAF.exe
        
        C:\windows\ERNQAF.exe
        5⤵
        
        PID:6688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QCKWSDI.exe.bat" "
        6⤵
        
        PID:6176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 1340
        6⤵
        
        PID:6844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 1376
      4⤵
      PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 980
  2⤵
  PID:7092

C:\windows\SysWOW64\ANBMJ.exe
C:\windows\SysWOW64\ANBMJ.exe
1⤵
PID:6236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZQ.exe.bat" "
  2⤵
  PID:6572
- - C:\windows\system\ZZQ.exe
    C:\windows\system\ZZQ.exe
    3⤵
    PID:7008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\LCNT.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6316
    - - C:\windows\LCNT.exe
        
        C:\windows\LCNT.exe
        5⤵
        
        PID:2056
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HSPSRIW.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4176
        
        C:\windows\system\HSPSRIW.exe
        
        C:\windows\system\HSPSRIW.exe
        7⤵
        
        PID:6220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1368
        6⤵
        
        PID:1208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 1360
      4⤵
      PID:6760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 1016
  2⤵
  PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 6236 -ip 6236
1⤵
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2784 -ip 2784
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6580 -ip 6580
1⤵
PID:6260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 6248 -ip 6248
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6992 -ip 6992
1⤵
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7008 -ip 7008
1⤵
PID:6272

C:\windows\system\VBSHPB.exe
C:\windows\system\VBSHPB.exe
1⤵
PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 744
  2⤵
  PID:7004

C:\windows\GGVMVEQ.exe
C:\windows\GGVMVEQ.exe
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6688 -ip 6688
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2056 -ip 2056
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 1364 -ip 1364
1⤵
PID:7016

C:\windows\system\ZZQ.exe
C:\windows\system\ZZQ.exe
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5772 -ip 5772
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4124 -ip 4124
1⤵
PID:6428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6996 -ip 6996
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ABNYBS.exe.bat

Path C:\Windows\ABNYBS.exe.bat
Size 58B
SHA256 ac062722ef9834da3c1e78e7dac92beeb28cb1f4710ba0c8923bd8b3ef618f34
MD5 e7fd2a4c85e2ce1947f29cae3040c4cf
SHA1 42d7ba00b03dce87ccf687457239d334c97b3562
SHA512 fa2ed08c91716130047aaf831b93e82fe39ab2a1d2d04298910d734c03556cc7757f66b00c1d7af5c84c4f9e3f9e03deb9125c4100062b2e1bf415f17f962683
MD5 SHA1 SHA512

Submit Download

ACCUMF.exe.bat

Path C:\Windows\ACCUMF.exe.bat
Size 58B
SHA256 9e97717dfdf87a4541b75008a814072806842541fe1a4515de9c8c5e93f0fdc1
MD5 5db8d6fe45e64d7d20b4cb33e1e8562f
SHA1 57c16eeabce7393b3f68af76b380f64a7da1fe36
SHA512 92b2b8bc498d79210d27083e702588ed93426b634babeb995a2912106f94c31aabc4b03da1234efd0fe23e1248e6d071f280b5eb9c7e98cf52896eb485c918a3
MD5 SHA1 SHA512

Submit Download

ADVDTD.exe.bat

Path C:\Windows\ADVDTD.exe.bat
Size 58B
SHA256 f4af42760e92d79ac031408cb55d2fedaa17dda0194f886d12dfdbc399f1dc28
MD5 dc4be2dfde327e14c9f94f63b334014b
SHA1 b3a90bd05dd3ad77f65cd0926aac30ef33e2943b
SHA512 2d672b68824e4269f890faea1b5936b507496cdc39dfd92f8489881c875e2d1922ed6a56f13d57d6e0ddb9618502aadbbe1d16b00740aafcfd6a373eb1110627
MD5 SHA1 SHA512

Submit Download

AFADDC.exe.bat

Path C:\Windows\AFADDC.exe.bat
Size 58B
SHA256 9b92ce90e2c1bb9b366d53bfdc8bf1ab3b45680cad8f63ed1d5c47244f5a81a3
MD5 fa12ff9e8033980c9ee67a4ccd284c39
SHA1 596db245817f54638f277982cb6fc9856f9339f7
SHA512 65a1e53ef6ec3c08e2ef77a0f503a46c675cfbab623e95e36af06c3df236b92af6624b1bfed13f4849395df872e1901b8320a6388dfc7c2bb362a4c6805e8632
MD5 SHA1 SHA512

Submit Download

ANQRY.exe.bat

Path C:\Windows\ANQRY.exe.bat
Size 56B
SHA256 ac2b2fb51ed1565d483fc6f65d380a06316945635b47af84be167e99b09c59d0
MD5 45af72a6c7456320a2fb8c8576dbfbd9
SHA1 7fcb010822426b5e92a3eb3ae8a94417fb0a011e
SHA512 ea481f544ca91aadf5f602647c1343db2d909aae879847043a13be61f396d4ee0508c8815495a5aa6bac834bd4aa7c6d718fdd09128ea2daa9092d2987f77843
MD5 SHA1 SHA512

Submit Download

AVWVHVL.exe.bat

Path C:\Windows\AVWVHVL.exe.bat
Size 60B
SHA256 beebcdae9debf0c4182a83f591fd464f7a9b9a120395f2215846eded6f099fb6
MD5 0328f26344d7cb81c6ba7dab204fdf91
SHA1 f3523e290eabc4a6ebd5c6ab2091fa5e7c225f96
SHA512 f528bf201922a9ac86410666a406129c953080ec55d6c9950bd012333a9dcdcb2ecb28817e31d92014055dd9c3487fbe8b66bf5051faff7aca93e15776659d82
MD5 SHA1 SHA512

Submit Download

BXKK.exe.bat

Path C:\Windows\BXKK.exe.bat
Size 54B
SHA256 5ce7529ec361b8d4d0025958d6312beb5faadce3a8db2ed9234a7c3ac66bf362
MD5 a2da2e2e560f931af0325df67e59d5c8
SHA1 9d40f0cf46669ed8eb8d24752ae82b4c3b402a5a
SHA512 4aaaa0acbde015c26b24c0375770f0a15e09627584b6b0eea2c9a69b9149d569547657037c2da8e0610911f890b92a917003842202ff269017e2bd0c8ad3b371
MD5 SHA1 SHA512

Submit Download

CZRVP.exe.bat

Path C:\Windows\CZRVP.exe.bat
Size 56B
SHA256 a77b25921683d6195e200b96b4610308f866a487f9f76728c7e29adb27a4957e
MD5 a56a273d732ed6be79e85db3dcafdc2c
SHA1 84fc03cb3bd51b3b46c42a1a94c4b580516ffef7
SHA512 ad93b2d883d49159384994af65fef01298cf49080cdb3b9c81dd62f7359c38d79fa2ffc2a796caed35e36b5d5ee1d3b4e50b8d52e0d7b0010b09d6dee6642896
MD5 SHA1 SHA512

Submit Download

DUIWISJ.exe.bat

Path C:\Windows\DUIWISJ.exe.bat
Size 60B
SHA256 fe770799b0f5ae3e2073c79345b38c92816d93205b5e97aa93cad53623ea951d
MD5 51d936cf3b1302cb03a105c5fd33707f
SHA1 0a1e0939e790fb211fea30adc3122460e8dc6eda
SHA512 c412a61c871e0458848e1f058c02e0c73c4d8b28e9f5f42e5eb8212f4abc3dc7a84bfa3c43068476ca865ff0509696c183e22e4b8f39fa019c27abd67e16c7ba
MD5 SHA1 SHA512

Submit Download

DVQ.exe.bat

Path C:\Windows\DVQ.exe.bat
Size 52B
SHA256 c9f6a5b6fbd6bd3ed45bee2c8a676593ae8509dc81e618bb3eadd367773faf5b
MD5 cd108a961ea8e3c59fa5634400e51863
SHA1 7e4567c052f6fbb886db40018d287523ece7bab9
SHA512 a464de1c05a19ff94b825cd9a903eace3a24d123cf9313ffdbbec555fc21b8274590d43fe72d362db337b2c3ee1ac05092ddbebc2259de9bbd6635c26d87e69b
MD5 SHA1 SHA512

Submit Download

ERNQAF.exe.bat

Path C:\Windows\ERNQAF.exe.bat
Size 58B
SHA256 2bca0a2a5ae92ea7799ddef5774a6c69e6635955b159849f67881a2f82c3baa8
MD5 fd6bdce6b33c58821a3f8531fe911eee
SHA1 1d31683b723d818b26800eced1e5bbd22087fe0c
SHA512 d0fefbb4182964146dbf1a8d71376f127aab642933893e1b8db64239d4bc88041105898fd6f43b34c7b9d0b4c995dbc2fa68a14f3b047543a1c4f7f7e9c6e3d3
MD5 SHA1 SHA512

Submit Download

EWN.exe.bat

Path C:\Windows\EWN.exe.bat
Size 52B
SHA256 b225699e29fec3f74cc02afce608bb954711754ef26492c09f917cb29bd51754
MD5 8e428a111c80920f173e8e85909d70e5
SHA1 4a900de3b195838af0cb30893bbe4931de5ed03b
SHA512 17d6f5bd098e7fdca4fc0c60b6b1ddbf4f6c6801a446195ed1288c3e2ffe378e014ec8d59819cc3f7fb6c47da7c5f4f3edc39b03473a9637c8b4d64631efb09a
MD5 SHA1 SHA512

Submit Download

EXD.exe.bat

Path C:\Windows\EXD.exe.bat
Size 52B
SHA256 b359dc48cf1694053b26f00f30a55ec20040a9e6f1931055effc3f0a1beb29db
MD5 c44ec8f843c82fdd556cc529f433b3fc
SHA1 f23da1aaa64fa66045c81606a8440b3d6ef6f7a8
SHA512 cbaf6b15a0e5ba5ed88d8e964527c9e5fefe12c1284668dbc2cdbc8e3f87e065f4a57c5d0a84fc14f3326cec2065dbcdc5401981584d74e10bf86a97a3730f7a
MD5 SHA1 SHA512

Submit Download

FAYGVT.exe.bat

Path C:\Windows\FAYGVT.exe.bat
Size 58B
SHA256 907b57e17ffb96ec98ec4f17ec99411e142a496b8248fdc3ad708dd84ce5adae
MD5 775d79ae772862623329fa770bc28f27
SHA1 19f79460c88adff4b6b67f83cd57bb45802ee6ce
SHA512 8bb9493e7844915f8eb69855e414d11b0ee884fb0e87fb2443bf955f351eadbf3f4fff48f487267ae9c2833be896e6fdcfc62f865db088161f8e75c66e131f53
MD5 SHA1 SHA512

Submit Download

FSPL.exe.bat

Path C:\Windows\FSPL.exe.bat
Size 54B
SHA256 41b89603da96663668ae7ba14a12026fa315c123a8ebbb53ea58bbda596477eb
MD5 cfe4ac76e8f76a9dfd9b7df97d4d1af8
SHA1 7d532b19e73aa8261d4822d60ce642e747d1fa4a
SHA512 0eddae2c0bab869e5a529555566eec086404f98d33dfb4c633aef4c86f88202c6d9177942c3c6b2bb3fcea8244e051da0f4ada9a8a383bd401202fa4622a93b2
MD5 SHA1 SHA512

Submit Download

FXCKU.exe.bat

Path C:\Windows\FXCKU.exe.bat
Size 56B
SHA256 7590e2eda255892934314c4e7246ec011b7090b80af6492be01734aa6da81719
MD5 17e54cd24b2915d58e6bbd69e991ce23
SHA1 d80dfec18543be5251f6dce7426de05299d2f388
SHA512 625c7d4b70b9d3a7e869e1b4f2707bbbeb5def18f90c7641d4877292c08e5d473ce40ca56fcfe2e1ab67f23a4ad9c9fd590e04138d205a9663999a5faefe2394
MD5 SHA1 SHA512

Submit Download

FYDXI.exe.bat

Path C:\Windows\FYDXI.exe.bat
Size 56B
SHA256 31f89378e9caa9f3f960ac24643248bfc2a92ab930d7c8c3350a2bfc9588ef61
MD5 5d0b51d2813f3f1f73a8d98244b51dfb
SHA1 b8d45f539e97f056afd53843e61853b64129b866
SHA512 bfdc1ce2b9dd1c93417f68dc73619e31038c690167e7cf0bd2750e9d659b35c3850c086697c555fbe570b26a631a4c636edd69f15288bafe7f5ff1703b8aeca2
MD5 SHA1 SHA512

Submit Download

GDIJYSQ.exe.bat

Path C:\Windows\GDIJYSQ.exe.bat
Size 60B
SHA256 0d217e383162c4a0005ad8d8699244f032782d379f16a258a8e899cc6258f1f4
MD5 fd45b3437ad53c4bc8bc2214cf084a2e
SHA1 a74440993dd25fefe432e0301cf45979b07cb23b
SHA512 5daf0d88f3bb5d427bd9d0a56d80086a66e1e2f502241c5cdad18ddfff0d0abf644b3f17786112a630ecea5a8a321231e2bca960ead060610afd819b5ee7a258
MD5 SHA1 SHA512

Submit Download

GGVMVEQ.exe.bat

Path C:\Windows\GGVMVEQ.exe.bat
Size 60B
SHA256 5ca19ac5335d98a2415d5851a045f1418b782b76b7c8092b711398d7dbff5a35
MD5 4a42b9356616cdc48d1b18dd906fb121
SHA1 aae6f6c14711205fb001a8a61f869a38ca09a2f6
SHA512 04b39bca97112ac1e65faad8ff20715be93c3a12c8a7865fcf7d4b10a3469db00d321da92bea38760ab942d9ac11d6981ccb78bbe7044b857f671c52984543dc
MD5 SHA1 SHA512

Submit Download

GYTL.exe.bat

Path C:\Windows\GYTL.exe.bat
Size 54B
SHA256 bf63196c39529b27080314414f68c0b12d5e7631a7fbac49c1934894950cbac5
MD5 fcbedc51d85530bd322e791b27b2a554
SHA1 b439f5ee7c48363a4a12a46436dac6f5bb44adb7
SHA512 c304b6b855117cc04f5c89d48379a79cbb50d970e510e83e0a232a346820edf29e89f628ae68d000dd84407f46f9ab75a319bdfc277cdcfc79fa416f078fbf83
TLSH
T1D59002380BC122C88824E8694B4AB720840AF44A021000001215828C700444B8000AB0
MD5 SHA1 SHA512 TLSH

Submit Download

HDPK.exe.bat

Path C:\Windows\HDPK.exe.bat
Size 54B
SHA256 5fd6f7cca4943bbadb80e1b8916ed0bd8e9fe4f24d4daa7a244bfabe50c763ba
MD5 47029d9611faffbb7272a8d90583cd10
SHA1 cdb4c66bf944cc8ec6db94ec00dd4baf78e6b645
SHA512 94a667dc7f93da4d114bbb051186e308ebd6e33cf9dcfae0122330f7ca67d83b429393cc841bcf2658b8282d55f70b5a89b78f8ade085774887d8fd20174ca87
MD5 SHA1 SHA512

Submit Download

HHDH.exe.bat

Path C:\Windows\HHDH.exe.bat
Size 54B
SHA256 9b8c73b4349e22e40b44279fe198f8b7148eb2bb021c219b3e965a2f7be2fe8c
MD5 1ebb299fc9aefe87e7e7ff5a97d0de0c
SHA1 c9d88a971bbec5bc0fedc79f856c880f1c83c97d
SHA512 5b810612c88c647e6da9ef3497793408b8dc678c724295ff5c9b8b743c442a6edbcd9f7d138ce63f933300ac34b31de604e738fdd09edfc6e5b45bdc9a2fff5a
MD5 SHA1 SHA512

Submit Download

HKYJNB.exe.bat

Path C:\Windows\HKYJNB.exe.bat
Size 58B
SHA256 3d5b0c25bdd6ce6aa1b404e251f187b62e64a9414da2dd5f38fed1fd319d3338
MD5 c06eb1fec74341cae61f48823b319825
SHA1 9864b480b1c2dd6d44a744b73a7a086df0fae68a
SHA512 023901eb44c5a3ca0d34495016c54ec4ae260641528d01c49ed7cdda89a24e4b2188c5cb587840555ad51350ebaa46bdefcf97f4236cfafecd8e18b3e6211dbd
MD5 SHA1 SHA512

Submit Download

HLA.exe.bat

Path C:\Windows\HLA.exe.bat
Size 52B
SHA256 301f4749ded0568f9821fdad90959d7e88059f281007152e4e242a9b7881086c
MD5 9e348bd206e1c201446f9d374c6680de
SHA1 2501b1d2a119ddfa01c379dbdcf2bbc37de7a345
SHA512 27bfdee4b945d709641165837c1ee0efd5752c61250f649507192700a50c0e797532da43e3333308ba8c3727e8c951c0f0c14170375abb1dca9ad6c44d70d92b
MD5 SHA1 SHA512

Submit Download

HXDBODI.exe.bat

Path C:\Windows\HXDBODI.exe.bat
Size 60B
SHA256 a15404ad2b0f3abe2f87bdd6a4fc4ecb785aee94f429ad4887d8ab4d6a1f1c7c
MD5 944be6cf65b37f7f650e8d1d02e8941a
SHA1 b8612c1ff257c7485313b4745d16eb6bfd89c922
SHA512 4486c896acec96d33828bbb4b26e62a59139ddd2be33b368f2b5ad30f970656319d28e6469c52ad5234e231e45513c991f2a34f449a0a9545f40bb68669f3d2b
TLSH
T14FA0023008E32AC0882460494B6A3702048AF642021000003A15028272044CB808CEB3
MD5 SHA1 SHA512 TLSH

Submit Download

JGX.exe.bat

Path C:\Windows\JGX.exe.bat
Size 52B
SHA256 01ef6779781b4a35f606809f21079fd844d2a0541418835aeffdfc6024d745b8
MD5 130407e3a8c9e189c7abfaa571ac08b9
SHA1 3509573133ab2cc474619ed0858bb15320c1e9e2
SHA512 6d2325bd85c5e190a3aa0642f4e0db9b1fdf10856da85970eed7fa937106733b38e470ec6764a1cb8149b81f80931597674783f5b82d5f238944d3153293f8ac
MD5 SHA1 SHA512

Submit Download

JNPG.exe.bat

Path C:\Windows\JNPG.exe.bat
Size 54B
SHA256 30e6d86495024c94a4f858c84224099b06a9f1a1b9cbaca48dbb9d7f21df5226
MD5 f13d137d2fb7f2cf8782c952ec1dbe23
SHA1 ec59696967e4ce7c5bf907cf5f805537662c466a
SHA512 11d45a66e606d77a5427aaba8568a0c2cf928c8883ab1463c4034c1f22c42607bd9e890be6da71e2a39eb333aebb5b8c45cce7127b7002cde4dfc682aab3c7a1
MD5 SHA1 SHA512

Submit Download

JXPMBXM.exe.bat

Path C:\Windows\JXPMBXM.exe.bat
Size 60B
SHA256 e59edb928e0594c19a3a24c731e3b323b25df0e5cd8992435730bffb7db3653b
MD5 6e8df68afd16c12c5355027f2404e690
SHA1 ede5802fbdc63dbc37f03c4738e9e0139a2097cb
SHA512 273a1d4a1b54a109c434a34b456ad021132824491b780edd28c0593a1507e763e817b09f93a594e5a421fa16de051a18ef162a2997afb56eeb99f65497d704a5
TLSH
T104A002B008C12CC088BC404D434A37A004AEF4600210800092D5C280728E44BC0038BA
MD5 SHA1 SHA512 TLSH

Submit Download

JXSDEX.exe.bat

Path C:\Windows\JXSDEX.exe.bat
Size 58B
SHA256 c746a305c82231319b18ea6426fcb6be35c11730ee391b2f0fbbe6cc6a3f33b8
MD5 f785e71836610ad796564dbb8cf64de8
SHA1 913a8273d668ca4b2b422feb4386be2b5883d267
SHA512 30401fc9d6b959d2c469ee5a9a9af8933e3eb6ddf57896ccb2a8cdec3f6532fba7786b9de5ace8c77b4980374a15cbf0672f6b8e843c17b89cc0af8f0e0f7cb1
MD5 SHA1 SHA512

Submit Download

LCNT.exe.bat

Path C:\Windows\LCNT.exe.bat
Size 54B
SHA256 0380fcf1cc5c3bba2cc4e98b343817b98a7ccefc2e5a7896ba44db1ae6048884
MD5 263b8fcd7ee5bb1c41bfaa2972b8457f
SHA1 3f19d0b7875c0273a340d190928ed4c286d0458e
SHA512 5bea273dd3ed8a8f547b63d2f7f8a7c0a7aa0d1479dad7740a99380655d448844a401207ecd71151ca0923f389447aee1fdd6895d7a9b754a34ee6ab49f028eb
MD5 SHA1 SHA512

Submit Download

LJJ.exe.bat

Path C:\Windows\LJJ.exe.bat
Size 52B
SHA256 901a6e8acf63d3ee3a72339dddd0176fe2cf4113446159094ba210032f196fc0
MD5 52dcc5af93f3f58b6b9b9b2c1a870980
SHA1 e5d7fbc9c8d33da05c9a4966c56c651645bd3e41
SHA512 44c53d808b7cbb79b3f13232345ac76c31e85f6c2f57e29f1033d13bb063ce81603b15f31c8d789c1e2bc9d731b0a31ea8f68bb37f7b9b6c1c07631f3ba195a7
MD5 SHA1 SHA512

Submit Download

LKLV.exe.bat

Path C:\Windows\LKLV.exe.bat
Size 54B
SHA256 97f7a7edfc861897f15a899fd2e697522091950cb1753a97b63e79e64c885004
MD5 a09c23cfd995e3a4b38bc788f21d0796
SHA1 683637520aab7fef064a4b0a27dcdfe443ade96b
SHA512 0c01c72a3d24d98ec412dfa39616527ae4be8b74e91ec31533b39e8ad77489b68b825db96c4cec7320e4e38665ff2628c9cad151d245f40a32f638aa9f7bdbdf
MD5 SHA1 SHA512

Submit Download

LVIEN.exe.bat

Path C:\Windows\LVIEN.exe.bat
Size 56B
SHA256 7f6ecd7fb09f81246112659d4581ad4af1bc04decb4a7620fd0c515263afb833
MD5 956f2136cb93da432bcb6cfe2f4d2fcb
SHA1 d0de4e14178a6deb649bedd8b91b5fd03546cf25
SHA512 8d2b971373655486d8035e8ea095a1d8604374c2b43247bde539a7c2a1fe18e75ac77f3982f468cd52bac2213979ef9e1063b10185dfe897527132aae1c125ae
MD5 SHA1 SHA512

Submit Download

MOSRLB.exe.bat

Path C:\Windows\MOSRLB.exe.bat
Size 58B
SHA256 1fbcb04efac146d5b740a80c93a6eb8ca24d304716bb515598fbcbd4853ed076
MD5 3dcb8cb63fe1284ab70871f0ff3ef359
SHA1 ed3162c817ddc98c00205bda3e5e3088b5bd970f
SHA512 818803b67949988f0c017f629a8bd67039e780d25844be89da8dc6b03c952261d8a473f47cc6f12bef559cae9e074139aad319d00c9ed6e7dc2730b3c72f1265
MD5 SHA1 SHA512

Submit Download

MWP.exe.bat

Path C:\Windows\MWP.exe.bat
Size 52B
SHA256 763479202afff0808a420d80c6c15e3cc938fcda40d040625c910dc748ecbfb9
MD5 c316984c0475a1ba33ffefb407e1eafd
SHA1 2aa343889002e5c6c2ce589752eec1fad0dfbf9b
SHA512 87840040042937fbc722039cb9f5873af335ce54b03c312ef15a81d6db9d0c72e82bdb50d67a0a7cac250197df7d27d79cc2e383172674192ed356d6f4306ef2
MD5 SHA1 SHA512

Submit Download

NCVWT.exe.bat

Path C:\Windows\NCVWT.exe.bat
Size 56B
SHA256 f8a5609827e440bef092070f33c691715b23e6f4fff736c3336e217e26e5c298
MD5 da1c5e3f022455c2645acdcc9a93ea6d
SHA1 d66ef931146913b96cfe55a9445221b7712184c2
SHA512 55f30ba75ce762c7668f9465ae4f9b01e4789b6f8cc490eb75d9c882a61783f107651863c4a2ad3e27a591446ff52f408926dd332ee30a420bdf2f4799c8d728
MD5 SHA1 SHA512

Submit Download

NTL.exe.bat

Path C:\Windows\NTL.exe.bat
Size 52B
SHA256 9e9462fb765b32033a459bb622b88067edeb198c5053898a2543534df6aa5551
MD5 3d78f44c22afcee6a71c59fd7c17f210
SHA1 a0c2a409e1c28fbf5acfba3fb46312d43276f96b
SHA512 8936f482fdf5ee05bd09ae3291de22169b6277dab844d6b63a549534ce45cdd9a5da93c60e4bdf063e4ac2d8fd70ecd06867fdcdbfdaca76b7d5e06f330a45f6
MD5 SHA1 SHA512

Submit Download

NXN.exe.bat

Path C:\Windows\NXN.exe.bat
Size 52B
SHA256 f892897e272f3c0ff58778a82e4e718f6ddf80413abb40025c7cdc12b7da00ae
MD5 334f34d5bb6d6880ebabb5b4ad73eb53
SHA1 80f79e88aef1a64aa42b87fe615651f24e1c180e
SHA512 a5d4121f14c6d81fa71de858ad9a4ceeaa579788a96a1e7c278fb32c26f821f6ef3c7d013d67990d310761227f2e50b10e712b48bb04d3b4457a91125645232f
MD5 SHA1 SHA512

Submit Download

OJGFKLF.exe.bat

Path C:\Windows\OJGFKLF.exe.bat
Size 60B
SHA256 2ac25ff5526b580ecd0ebe513e5f67e50062f72504bd84c2fbf4c3adf8cad167
MD5 dc7f5bccccbe295de74fce37bcd128c9
SHA1 abf9c7c2bdbc9eb9a2ba3a7602f2a517734793a6
SHA512 cf46f6a78f0008e2ab1cd4d02d45c8c7b65b788ca5d2def318c6609cb7d471fbebca8081eb2db1ba457630644e47adc38142bfe315aa0fa5b367922e70424581
MD5 SHA1 SHA512

Submit Download

OQVQJRM.exe.bat

Path C:\Windows\OQVQJRM.exe.bat
Size 60B
SHA256 b7ae5bac7a3baaeb66615923ebfad7c2ce31b7ee1c04826cba8fa58c29d9a0cf
MD5 a5bfc9d0858e1bad53e3bb176bb435a5
SHA1 8a82cdad8e3aed1c0ee0b42642b6754db8b00aca
SHA512 4738df7962ca3b4c1e1bb92f6c3b58f2de55ac0c5d048e8c1554c986093f1d171fdaa1b588c642496ce3748f39e91ebb9047ebb3c4ce6d38972519fa97cdbb2d
TLSH
T1D0A002380CE1A0C08B3C48C9436A3F0804ABFC402230020892150CA0E22464F88000B0
MD5 SHA1 SHA512 TLSH

Submit Download

PCEKNF.exe.bat

Path C:\Windows\PCEKNF.exe.bat
Size 58B
SHA256 fa0ec770d42dab68b74cdfdbbd73b72379918e5cd47236aba76974ca78eaf4c6
MD5 0d93abc5282f7d1548df2f2e6bcfdb86
SHA1 e66929d61965041eddeb7248d35a6f2805b19767
SHA512 9f48cc004074ceeff5c174a0ebe1ca630f246e291ec37220abcee3fc870b5bd86f9fe65217ae2ba0a2cf142b8c30bb5fdaf9b88595945817641d6b386e317698
MD5 SHA1 SHA512

Submit Download

QPSG.exe.bat

Path C:\Windows\QPSG.exe.bat
Size 54B
SHA256 a4c63a53ad59e7a6f635a75a95630beb9cb77609908cbaa603b367059cc1991c
MD5 09758d4180fd9a31c5a90bb915a9610d
SHA1 07192623df94c1664a3e60c71ddb8af333906e40
SHA512 3ea4ce2e6bdbc3facf1d41616debd694710354bfcd8d4fe69c5dd574f23ca844106f251e14e88e36e6bd45cb65515ceaba487efbf691f2605e9c25e53030ebdc
MD5 SHA1 SHA512

Submit Download

QSME.exe.bat

Path C:\Windows\QSME.exe.bat
Size 54B
SHA256 32962d9770230d9ececca8473f9bdd915554e81878ec8b3dd287544122b7a972
MD5 428e8390e8e9eac1c117833a082e09f0
SHA1 94d0648a21ea4ed1caa2b76845c6dbb7a04ef2b4
SHA512 5dfb32b7414c3903351620ef6788da40d5aef557099151dfd135ab2190c5d0bb694df6ade284a8d3e530d65d78f2ffb25d01b31ddd0359c0c714c08fad71ac4c
MD5 SHA1 SHA512

Submit Download

RKBYAAJ.exe.bat

Path C:\Windows\RKBYAAJ.exe.bat
Size 60B
SHA256 155d6eb5a07d958bdc09e715beb0369d0b7c8d653583189488fe0230a4cfea86
MD5 0c5980e71fb2858e1dc7e1205bc4ebbc
SHA1 6b3ded201ca7cb36dde38ca2ebef21de10ad8a06
SHA512 3035c531d9553a24d5899821d6a7c713c4a3faf6fd0cbb16c4774130da8eba74e55c9f200244d152253cfe2b449d67b29dc009421bc9e46ab958edcfffe623e7
MD5 SHA1 SHA512

Submit Download

SSZR.exe.bat

Path C:\Windows\SSZR.exe.bat
Size 54B
SHA256 f5fa3e21cb44232723a0660830f791bd6dac1e8c440c92c684b35a067adb2b14
MD5 45110648291a4fcbcef9a84a1f4dd926
SHA1 8caa8ce951229da396227e7ef8f8bba7a0e65a4b
SHA512 c26ec743978630c4c3963f6af03f4bd65fcd332060b0feabcfe0179ccf9c314b9c63a0c402caf01e66abdb2ebd1580ed2b7d40f135ed3eb450fe302fd98de320
MD5 SHA1 SHA512

Submit Download

SUFP.exe.bat

Path C:\Windows\SUFP.exe.bat
Size 54B
SHA256 efe484a2b882196c1e5fc46bcf3b405f8d66bc3ecd01dfce49503192a869e861
MD5 181d6d6bc6a91648054c5166fffa34c1
SHA1 853747d78915ceff085e0fc99c353656bb681b10
SHA512 ff84f88ed1d4a491965c1b268743b1993b240153aec820c2e1016be4c060ee46a3df7d05151b12f8b8bd41fd160ef6b0823271852486fb2956cf860f31ad3726
MD5 SHA1 SHA512

Submit Download

AAYSRGG.exe.bat

Path C:\Windows\SysWOW64\AAYSRGG.exe.bat
Size 78B
SHA256 27ecbc8edd64b7ce175d8ba51dda976edaa86c67321a689c13633fe6b57ab55d
MD5 d65249c9fa68943e8566299366794e0c
SHA1 cfaa1c177ef7c3c3dbaca85e19c274c005a7ad04
SHA512 89601d46a3f20b61a9b51f87cd8dbd3c834220577fbf2bb73a521ec2bc5eaadd7aef0b39bec8c8bcd52864325678e8cfd27b5bd6667c4beba97fcc6363cfc483
TLSH
T10FA002380AC9A0F08F34406DC34A37220EABF44A03900020129722E3E00446B8F2ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

ANBMJ.exe.bat

Path C:\Windows\SysWOW64\ANBMJ.exe.bat
Size 74B
SHA256 4dd848ed0d1b1aef4d36c878748fef85b374d2360a25ede5f5128fdd3704f6f0
MD5 c68ae928f0f7fb80772a5aab8fab5e9a
SHA1 b3e0fed71b1cb29d1834aeca66f3670091d3ca6d
SHA512 5170537a37fc1e6623d63e3a805e5a69b097a0570eb796de8f2ceca3152301a6a60df8f9d24695704972e0b38860f22b014abe14bf8e9765f100b65d64841967
TLSH
T15DA002320AE130F088244CEDE34A3F2804ABFC4E0398003012B528C2F80447B8E22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ANT.exe.bat

Path C:\Windows\SysWOW64\ANT.exe.bat
Size 70B
SHA256 868578d69d41d9717264ffa150ec127e511f72d5827928d762d51562df2d8181
MD5 e90f8fdd145b9d887df873a16ab27fb6
SHA1 7533c2e89ac7ba68e6829f96423dd0676bcd5b36
SHA512 66a145858c8a0ea863d14265abb0b5f300087142217b46d7e38b3a61316e892c9ee5fdb090dcbb6f5b3f5433c610eec0db25a95b611ed5df7d6ff248af1f1500
TLSH
T1A3A002300AC328F0882C406DC34A37A0042AF44A03900220129720E2E08C46B8EA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

AZE.exe.bat

Path C:\Windows\SysWOW64\AZE.exe.bat
Size 70B
SHA256 491f5c61ba501f3e300a32e41f25596f737ffe4d0dd7c16af17f5b7a549a7a96
MD5 9743887e07ec5bb8cd2e9ae6741dc8fa
SHA1 6f75c7f5d0c9c91615f84ac24bfa99a622fed019
SHA512 c43521427cd541349c1b2d4293ba7ee379990d7d3c91d9da6772e2ae15d6aa3ba9e1bfb69be7fb16f92b27e99d504356e41e09da4518a65f77ed8fd9720254c4
TLSH
T1BBA002308AC328F08824686DE34A37202C3AFC4A03128020139720C2E80446B8E22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BCICCS.exe.bat

Path C:\Windows\SysWOW64\BCICCS.exe.bat
Size 76B
SHA256 78a412e1994d4e4b2ab557c14385064aa5795b4ec399aee5ef4e93f53271a9f9
MD5 8a00b5ca3f2b660d374c2fe097544a88
SHA1 9aa1497f1a11a2308c3b872327225b034a3fc18f
SHA512 22aeea06cae9344b374f6a3e9757f4c44984927246a2359d45f5a6b9e1856e8268223c37d11d0c7c24108441e8de33c68a23a2427198f443304230346149f19a
TLSH
T1CDA002380AE128E88A244A6DE34B3730042AF44A033800A0129DA0C2E00E4CB8B30CBC
MD5 SHA1 SHA512 TLSH

Submit Download

BYDNCPW.exe.bat

Path C:\Windows\SysWOW64\BYDNCPW.exe.bat
Size 78B
SHA256 53934a00d016ed52e223c0a1841318e6d0822a2daf2476b670e3907ad7b51a1a
MD5 1e151fdfff57cf78798fbcb32a549171
SHA1 d371b72101d0f31fa1faded26bc531fc60682c18
SHA512 ea03a41bb406c2dca86ecdb354898c97b2ee6cc607800c784c25fad5d7a193a2386fbbbd912110e73132ee01473e5d7178c58bda8b3162e0147238b0edc6c989
TLSH
T1F2A002300EC928E2CC26406DC34E3720042AFC4AC3B8082012F520E3EA2446B8A38CF8
MD5 SHA1 SHA512 TLSH

Submit Download

CLQJRQ.exe.bat

Path C:\Windows\SysWOW64\CLQJRQ.exe.bat
Size 76B
SHA256 04ead4435211c1d131b7c20df6dff905c9122ebe4301732af079c1a21a8e7b53
MD5 c82ad126803436a571d1780e6412a39e
SHA1 c6004b42795a131d26118d1b768a700768e97d34
SHA512 741232528be960d51251c38126b2cc242649cf760a1fe71f1555ff422b82a954d2fc303cb158b0b914a76f3db0a02ff5b7b2cde7deb6b3afe5db3cd697c30ee3
TLSH
T1F8A002380EE1B0E08834406DC34A3F2006BEFC4A233002201BD5B8CAF0044CB8A20CBE
MD5 SHA1 SHA512 TLSH

Submit Download

CMERFHD.exe.bat

Path C:\Windows\SysWOW64\CMERFHD.exe.bat
Size 78B
SHA256 3714d55eb98faf71b3365ce3d63ed2ac23b7969987fae08ad4ed01e3528b6d0e
MD5 e14729faef993b43acdc72f938beed65
SHA1 5ecfa4b3919b773dfadbc8e2d1a29eeb36ca37dd
SHA512 605ee87017cb5294b4d7db918538d3b22dfbe7b6747fffb765caab6fec0285a92a6b75109ed08f8b68a3a189ae359cca333656c31a442476590e8f703ae79892
TLSH
T1AAA002B00AE1B8E3B824436DC34A3720242AFC4A839000321A95A0C2E8044CBCB20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DHA.exe.bat

Path C:\Windows\SysWOW64\DHA.exe.bat
Size 70B
SHA256 05e5e23b7a2d7487f07b5c229676aaa2051a20a98f9d1e00c50d592d35435004
MD5 1f97311b1b821187fea8d95348cb60e2
SHA1 b5047e4597a64744137da04a7e22da52e6556b4b
SHA512 bae188015a2328faef96bf300ff097a4f45e3282715a3299965342fb2d2a51274890988631d497d3f77ee927b06ac4cc51951db52e1ac61168e9a0349d2ce182
TLSH
T19BA002308AC120E08A24406FC34A37A08C2EF44A83900A20129F20C2E004CEB8A28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DMQOQA.exe.bat

Path C:\Windows\SysWOW64\DMQOQA.exe.bat
Size 76B
SHA256 0614872f267b9dd579d7af2875bc4a635cf6b5110c668e38df62393497e4cb15
MD5 15b917ed7bd9ec85aef686674f365fd4
SHA1 550a7e071f5334a19815d0f7b24b48b1a7909150
SHA512 91c6bca90d34655bed428b89d0a320324395df78fc32f67c13518a1bce03532803c12fbbe2d34cf73091950611020862f103a0df7bb7d85865243d9b0bd6425a
TLSH
T11BA0043005D314F4441C405FC7453F151C1DF44543300310155F10D5D0044575515C74
MD5 SHA1 SHA512 TLSH

Submit Download

EULMT.exe.bat

Path C:\Windows\SysWOW64\EULMT.exe.bat
Size 74B
SHA256 03686e4ca5de1ed4be53a9f047db63421c0bb2e56a8cbccd364b14ec543061ff
MD5 d3ad6a49a07d054dd6fe95ba6e7dc0d8
SHA1 bda2106fb9c57db0d6a474144ef9aac8611f0370
SHA512 a235068eb00d9ee19a1fb7468a92cc8b609bba76b262fea9b02327e22d16e204fac03a7537c04a7d845ca9ca045c51b813b9dc720c2a7a41604df150c33124e2
TLSH
T1FDA0043C05C110F4D415C05FC3CD3F500455F44D03740114315710C1D0044475555C74
MD5 SHA1 SHA512 TLSH

Submit Download

FHNKCA.exe.bat

Path C:\Windows\SysWOW64\FHNKCA.exe.bat
Size 76B
SHA256 bf6e53ec295ef212dba0abf16b87911984f1621c72e47d533b644523654ddb2a
MD5 10923ba095b12f8cb550a853cc81ca05
SHA1 2771824e64085ca761d2c0d861df5643c8bcb00c
SHA512 b7563674424ddc2707a3ee9b2e3e9f4089ac44763ee0ee7ffcb9340b216e618ca51024e9658e57313d89c78ca846af7355014f55b964b8d37ca555d4dfd37b3a
TLSH
T105A0043105C354F04C1C405FD34737D54D15F54503141150115D10C1D0054474710D75
MD5 SHA1 SHA512 TLSH

Submit Download

FVEMOE.exe.bat

Path C:\Windows\SysWOW64\FVEMOE.exe.bat
Size 76B
SHA256 4ae79ded5c25437b320b8b5743a194367bbb8262a516f3a3630aebb6b0704607
MD5 50daa15594bc73d7ddcc4d9428df08e3
SHA1 08d92b909ab91b61a7bcf86af706d641475be088
SHA512 b211a435cb6f47878c10bbe6b996e6a8223649349f6dc27cdf8a438729b414243ffadd5ef2d873506b4c22a13ad9b079bd5943bb16057d360a5b9079dd820f12
TLSH
T149A0043005C314F04414C15DD35537140415FD45031150D0115710C1D4154474551C75
MD5 SHA1 SHA512 TLSH

Submit Download

GXRFOHC.exe.bat

Path C:\Windows\SysWOW64\GXRFOHC.exe.bat
Size 78B
SHA256 b92f8aa7d5f8a43d4136120718d0162e23117c2c75b49fd4dd744d62ff30ce76
MD5 4f9d6268d490bca55039a76d27e8078d
SHA1 369649ae31ef94128bc3ea52ec4d964d25739901
SHA512 ddbb63904981bd1d687b8bb3be396368f3d3adb7c2abadf97349be37efca392418053a377708ec801a9050e2563138dced889de79c1eb970bed7adee6ff914d0
TLSH
T18BA004301FC310D04414505FC34537500475F4C507501050117D50C3D5C445F4551C74
MD5 SHA1 SHA512 TLSH

Submit Download

HVWFK.exe.bat

Path C:\Windows\SysWOW64\HVWFK.exe.bat
Size 74B
SHA256 2d0237b9b55a7bf59636b105e4aa35b93a73a3c793dc9721db12f371317cbc6b
MD5 fca8220116aed6194112d31b6a5fcd71
SHA1 a5801d9961bdae42f0341ce4383e654a42947d3c
SHA512 7daba28beae0c8e92a26757a6979becd5df59590d1f4d5e5b919c46c8831d9d30263a0edb383cd681def2804d093a36a1dbf4e2710e1c3ae5957994f81dfc80b
TLSH
T13FA002300AC120E888BEC06DC34E37B00E2FFC4A83188020129520C2E80644B8A22CFC
MD5 SHA1 SHA512 TLSH

Submit Download

INGTWD.exe.bat

Path C:\Windows\SysWOW64\INGTWD.exe.bat
Size 76B
SHA256 46f8238036250a04a47fea084c5f57a35bbfcca60be781897864c35030a8c226
MD5 c5333d6fbcad5895f45128b3751cf29e
SHA1 e1638fbcef909954d55519c30404c4f8c3a63e3f
SHA512 6e13740cc88d09b4d3fcf0ffa03b2a2e61bda4b9d0f5714d4b28ccc107701060ab67e874d84cca99c423926d9d5ce5d02dc2869ff7d12f7f1eeec328bd89520b
TLSH
T1D4A002B00BC1A0E08824406DC34A3730042AFC4E2B300032129D28C2F08444B8F22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IRNQLO.exe.bat

Path C:\Windows\SysWOW64\IRNQLO.exe.bat
Size 76B
SHA256 9755be37821c5287051465c888c8137db957c369f1d436122d10b65db49da42a
MD5 8d4c07e7181619d0810e1b5bd5c571a3
SHA1 782d52910bd8333bcec3dd81651177277adcffdb
SHA512 95e6f0222485804de238ad511d5a1463291bcb81046107266d98a83d205b44de19187098fa6737ee7f8c5b3a4f2efecdc61e2e4435abe6c2a8d87a3fa14955cd
TLSH
T1AFA002380AC122E0B82CC07FE3CAB723842AFC6A831000A0929538C2E00464F8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ITSFABS.exe.bat

Path C:\Windows\SysWOW64\ITSFABS.exe.bat
Size 78B
SHA256 ed46ffbe420910187e94777fa34a36ea17f6b54be9ff26e8a2db12e26e781caf
MD5 eb839155afcf9b760c26b3049b925ae6
SHA1 36eef612e91d146fd849144c08a8b0b1f8932b0c
SHA512 713d2a3d2cee8eb20ae1ae9ad1c8dcdcbdd2ff059229de510edf51f9a430d8f34d8c3b0cb7ca9fd7eb2816ea3adab1136a3f25b10103313221c4b92b461326e8
TLSH
T10DA0043305C150D04C14507FD3C73F140555F45503354050115554C3D04C4474F11C74
MD5 SHA1 SHA512 TLSH

Submit Download

JDKTJ.exe.bat

Path C:\Windows\SysWOW64\JDKTJ.exe.bat
Size 74B
SHA256 ec963d1fd78b58987b23b44a93575ff8b08388fe8d46c668cb68d82f03080fe8
MD5 2fb6848a06db24cb4e82250e916efb64
SHA1 4485fba71a87e41238fea6a1805d07264c808e7e
SHA512 73d4ffd085e48916953b61e0cd31a3823927fdd581a706864a93791594ad220014bd8c25d141e0286a5045b75dcb1cc16ef94c0591a898ea65516f3244879a60
TLSH
T12BA002300BC122E0CAE640EDE34A3720AC2BF64E03900022129520C2E08444B8B32CBC
MD5 SHA1 SHA512 TLSH

Submit Download

JTQWBZU.exe.bat

Path C:\Windows\SysWOW64\JTQWBZU.exe.bat
Size 78B
SHA256 2761055c9896e11168aa3c07fd1b09b082c400450b16bdbd5e4d0bcb9bc1a8d4
MD5 aec63d41956cdf828c44561d2fafab8d
SHA1 6b566baaf14b2eb35e050d8988295309a40be605
SHA512 6d4f5f77c28162511ff77974682da6083279b9cbbd4e8361079c34267ce998eeb02555f70f9d657eec1bffe9b32ecdc0f2ef4df221f4626b731d3c2ee52092c9
TLSH
T109A002338BC920F0CC2440EDC34A3FA8842EF44B03102020129728C2E824CCB8A20CFC
MD5 SHA1 SHA512 TLSH

Submit Download

KSJONSB.exe.bat

Path C:\Windows\SysWOW64\KSJONSB.exe.bat
Size 78B
SHA256 580d07f370f37e8ab2052441851c86ac0455277a1c7a2e94b8119e3697d140ea
MD5 f9c6ba6def09643c58540d2173dccaa5
SHA1 bccc66a74cc08edcf55dc867cc1126bc2f2d31ae
SHA512 de7f28218ea432bb30b6220db0077b7343404a12d63fff2890101fd23807b874b8cdbf6cd14199d50a53dacc2e4ba6a1015d928be8cf479a9ea72419e8ec3b3d
TLSH
T1BBA002300AEB2CFE8C27436DE34B3720243AF64A03180030329528C2E00C44B8E20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

KVJNNTV.exe.bat

Path C:\Windows\SysWOW64\KVJNNTV.exe.bat
Size 78B
SHA256 7983ed292f719901e8167af730ef34ace21a5758d4fe70bc0dc1f8908c9ffad8
MD5 71a882eb3f9e21749309f78150d721ca
SHA1 bd943f16459c77ec4ea81c76ef50bc9fa2676cbd
SHA512 8eb26919f87831980fc9f542f84df48088cf948c1d8c99bacfecd05c40ceecf72f47376bd3e42a178d473c26d1d23490abce5afd92b351690fce0cf935e038f1
TLSH
T1F8A002380BE122E088A4406DEB6ABF20063EF4CE03100B30129DB8C2E0AC44B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LPFZSH.exe.bat

Path C:\Windows\SysWOW64\LPFZSH.exe.bat
Size 76B
SHA256 1a83ef419cf5e7fc872e966780eec553b0ca096923a375326e4ca04de94453b4
MD5 4e2609c417bd55fc14f7e9f5f78fe67c
SHA1 ca717041ecc59e8976c122615be6e80217e1bb1d
SHA512 e0eb537d9f35d3706055f28af022532a9aae1b37849bdae5c1d7feb1521831f09fa742b9536b2c5cf52dff8a263f9dfcae6338270efba5f2c69b2c3e0104c54a
TLSH
T161A0043C45C310DC441C435DC35777700415F45507340110135515D5D0444574531C75
MD5 SHA1 SHA512 TLSH

Submit Download

LRBRFAV.exe.bat

Path C:\Windows\SysWOW64\LRBRFAV.exe.bat
Size 78B
SHA256 ce383affdf3369651b630a52e02bb2c49ce211ed5af9e82bd19b1cc5473e3127
MD5 8024978733bef083bd542a667049423b
SHA1 da4b331d10f169c8eb664caa927865ea6a49037b
SHA512 69900ad3ed3985a809696c31047e8620e8ca025968987b237e4ec00f5b891adda430ff89c2805d1f134d3be8e611ba2e6ccd34b15cdbd1cd31a7fa262c5e5978
TLSH
T135A0043407C153D0751C415DD7C537511555F44503500010135555FDF114447C534C74
MD5 SHA1 SHA512 TLSH

Submit Download

LSRM.exe.bat

Path C:\Windows\SysWOW64\LSRM.exe.bat
Size 72B
SHA256 504b6b5b89aeb2dd618d5afcda7b1541943d15fd5e6c9e08deae678f706418c2
MD5 1c6251782be2ff4a90bff46de7561da0
SHA1 0e64737e6510c019f956e532eef5f86c0bdebdbe
SHA512 088ff0a35f548884f0c018f0d86f97656b850afc0e24d0913b34adbdebf39c64d47cae5cb42b543604abf6aec215aa1285eadbed756d01a4c3355cd55d5977b5
TLSH
T17BA002300AC120E0C824437DC34A3F2226ABF44A0B1002A0129DAEEAE82C44F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LWKLA.exe.bat

Path C:\Windows\SysWOW64\LWKLA.exe.bat
Size 74B
SHA256 37dbb94b9ab458da83f00d80bfbde95006431a21d637c71f6b3d1b57eb136158
MD5 a4b598f0cea8f3a0504feecba0f428f5
SHA1 a665eb245a3ccbd8bb98b89043bdbfb571cdc3ba
SHA512 6a0f5ebfafa9c8d1447999ca1f39a280dea7de49fe99df859fcaa8e1a798d90d8495668d7d7d3f312e97ab02711233972065a1377f69d7a6b7c6cb8937eabbbf
TLSH
T123A002300EC120E08C3442EFE36A37200CAAF64A03180020129D2AEEE0846CB8E28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LXS.exe.bat

Path C:\Windows\SysWOW64\LXS.exe.bat
Size 70B
SHA256 3113fc6347794f285b0cab8c48401727f0a32943cda4e07fb3f3d63992f39d8b
MD5 1c57683126570f67990a245547e216a9
SHA1 6edfeb0ec5310ca9517fda1a0d57a8d2f1f684ab
SHA512 25c4da830776841b8763e2d7486a1eda132f3a8037b4bf6608ed0dcb2f422398e8de1a17d55fb5d4d7a225922cd814467bee302c5beb47f446ec67605fbaedd9
TLSH
T194A002300AC9B0E08824426DC36A3720042AF44A0310002012B5AAEAF20C44B8BA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MAOGO.exe.bat

Path C:\Windows\SysWOW64\MAOGO.exe.bat
Size 74B
SHA256 fe7baa1bea5a08db266aaa6b340b97399accfca996b59692abd348012bde4f4c
MD5 0a6b0e5f295823a0079fa188a707abcc
SHA1 1a2951e4141722944702f4870517d5c2d5476b0b
SHA512 1d52b279ec53dae0152db836f629c2c907a2c96af2407bad3153746e667d92a92002f6273a0e1553a53e7680e947579404d4c4474b6ab10b53206950776e95e2
TLSH
T1DAA002380AC3B2E0882C406DC3CEB73004ABF44A83108028129520C3E80644B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MCQZTAR.exe.bat

Path C:\Windows\SysWOW64\MCQZTAR.exe.bat
Size 78B
SHA256 4bbcb6a515bd9fcf1388e77ee6c26cbbc6abc8466843b8e7453aac8a2717a2c5
MD5 6d0d4ac5e1019ff45a8a28abc84d3bab
SHA1 39f93f68793d0a85dc1e7ea04c760ed0be15eaeb
SHA512 c8609ff29e1e9a616be4007e2279d0366f81e1b2bdf2d3adf30db387864d20c16e4d0bce06918f692a8b15a018e1ecb15dc8e15982b3791b579b1759c3e45c3c
TLSH
T1DBA002302BF132E08824486DC3CA3730862AF44B03108820129D20C2E80646F8ABACB8
MD5 SHA1 SHA512 TLSH

Submit Download

MJHABJ.exe.bat

Path C:\Windows\SysWOW64\MJHABJ.exe.bat
Size 76B
SHA256 78f29cc8ceb35e1aeb52d9283a74c0835951d303d646cf490309f705972d3b8a
MD5 ecf98d727b3b90fdf0e704d650074a1c
SHA1 56dd549ea3aba9ab02f750cbd20972b90caa963d
SHA512 33ed552ec9eeeb53d6c12a46f13dfcb1184cacc6adf576ef802d39d4c5cb978268f6937b55a1d489fe2c1e81ba2ffff6dae1064bb97191fab0ee1d1544054a05
TLSH
T17DA002300BC1E2E0882C40EDF3CA37200C2BFC6A031280201295A0C2E80E46BCA38CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MQB.exe.bat

Path C:\Windows\SysWOW64\MQB.exe.bat
Size 70B
SHA256 c42baf0f8e048889e9ced2388d9e6fcecde00ca017e74132ff85c71164613f32
MD5 9dcfa99394803ec4095556205acc1067
SHA1 e5ca84413a97c4ef8b04f0947b9fb6a31af0426f
SHA512 40d1d2b93f08fa2202cf64a77a86fa72a29c59e8b85a14a1259b645be640889ea159d4875c34724e2536bcc387aa750e56e5acb9a0d4d2aea2f082af996ba782
TLSH
T1BCA002300AC128E0882C406FC3CA3720042AF44A031080201295A0E3FE0644B8E20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

MSUZAIL.exe.bat

Path C:\Windows\SysWOW64\MSUZAIL.exe.bat
Size 78B
SHA256 d6b3ff9a1b81eab4c701f6a9b7b386127c65f1e1f521ac7d9e51fdb0a4929f41
MD5 6a4cee798d0d72f37526cfbba3b1b226
SHA1 67703061a663aa19bcb43d026d64eece784d8c81
SHA512 7f0302e440f5d20313bea7ab66548b6026b85b3c97b4eb9674a9ce9abefc86a53b7cf8759fd2a4c0c2fc40f1a89820a528f669eda9c0223b8cea37e6dbd87f4e
TLSH
T11BA002308AC920E88824C26DCF4A3720042AF4CE83908220139520F3E886C4B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NEYAH.exe.bat

Path C:\Windows\SysWOW64\NEYAH.exe.bat
Size 74B
SHA256 4def4c891a72d9cb424df18e21087c0494216408363c62033fb5cac262ea958e
MD5 76b8e82c82e19797634b8b734b32c63b
SHA1 e0f54a819c79bc2f8844882728485b218d888b7b
SHA512 f319d1c21a8a311388d4cb4f48db58c7279127665c8d7ed29514516bab326a3cb8d636dc2ad004b49fbc4f65b463f8936f12ec62f44a1d370ec32b2387cf2007
TLSH
T164A001A00B8122B8882440AD824A2A30083AF48A031000201B9530C2E0884BBCEA8CFC
MD5 SHA1 SHA512 TLSH

Submit Download

NEZ.exe.bat

Path C:\Windows\SysWOW64\NEZ.exe.bat
Size 70B
SHA256 734f8fe200d4e384c6906c73efabc1049c868cf33842364cb778fba1fe3684cd
MD5 efd2a651f8fb8cf46672801f4f454b29
SHA1 0059675ece94fe09b256a44b9f876cfdcc2d575a
SHA512 af7162fd6f1ce4b9872cf71d526b6cbf399875aa8358ded03a39dcb17edc77ca805c3780e3eaf4043788ec46557478320503dde1287bc64b234b8642af6655e4
TLSH
T162A002320BC320E0C824406DC34A37200C3AF44E03108230129722C2E08644BCAA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download

NICR.exe.bat

Path C:\Windows\SysWOW64\NICR.exe.bat
Size 72B
SHA256 5525d43bb169ff528900f4aa7a69870166a990646a6ca1fd23922b64c5ce3680
MD5 482646dfc7f37134313eba3017e2a7d9
SHA1 9e41cd419eacefae7726092e5cc0c6c2df121f0e
SHA512 ad536cff661bb4302736087a17aa440ac50d48fb19b5d83b16848ee521e2b8ae287454dae3e277c998d4d0fa407940be107288a5fcfedb53fb6e1bce8b180d97
TLSH
T127A002300AC120E0A824406DCB4E3728043EF46A031000A0129520C2E80444FCAB2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NQG.exe.bat

Path C:\Windows\SysWOW64\NQG.exe.bat
Size 70B
SHA256 4e5d13ae84422d5662f69645b81f3dc6d6948f5de0ed1facd00e483fb3ac09db
MD5 2d9b1718e089a8f753b1565607fc0bd3
SHA1 a0a251ee9f44d684a8e131d95065c241ae2f74ca
SHA512 46997270c887cd6fad7225711b923633da2286ea727c9e85794ec5654f14ff9d0be83963583a26708426498c1bf3086abfd0039cf8fba931eb2ca250590c426a
TLSH
T190A002300AC928E28C2C406DC3CAB730043EF44A03900030939520E3E20444BCEA8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NTFBDVD.exe.bat

Path C:\Windows\SysWOW64\NTFBDVD.exe.bat
Size 78B
SHA256 91a04040ab6eefa3f1316441671edb583321ad7ae3ad30185e72bf95a2f44429
MD5 e1499b94690d2aed9ffa254402fe7e9c
SHA1 e49a1a1a0e79414401ca035354907039fd6c91c5
SHA512 cf99a71f584ce0afd5045dbb3c25077f28a1d4d14c60e58b38f1dbac78cc3e779b8756e3b4574ce9f3aff05e78c1781755545d6f2dbaa250378196312fe9d96c
TLSH
T1EFA002302AC1A0E88834426DC34B3F20043FFC6E031028BC129528C3E00444BCBE0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

OCVE.exe.bat

Path C:\Windows\SysWOW64\OCVE.exe.bat
Size 72B
SHA256 703a3b24ac638b793f8cbee12ad8684b82d2e0a60a421da9b00aae458a495e75
MD5 ca2f8deb21825b37e87c431ec5d34909
SHA1 f2ad839f33ab6c14b23a44191237de3b9a17e72e
SHA512 21985fa108a45acfb9d1a6a99e2f6bcd3b16b002a191a2ca8dc5c9fa51ebe0045ad0dc23fc2dfdd14082deb385c51218b5f6b68dfbbfdfed17796f89ca9d61d1
TLSH
T16DA002380AE330E088A6406DC34A37288C2AFC4E0312C0E0D295A0C2E00444F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

PBOT.exe.bat

Path C:\Windows\SysWOW64\PBOT.exe.bat
Size 72B
SHA256 ea789bf84923ae5faf324907cda28b99fcad05daaacbe9528e4f09393a3be394
MD5 bd5f06bde136ec4651a6534fdf1602b6
SHA1 117620c5a94306e5f12bed3ec7d22e2b57cc6757
SHA512 4c4d7ddbaa72d5ff5d2b063ff4e6851992dd76fb94536af8f14d055e5def717450b0b461d987a6257d839f0561f6290c94b65fe868461ef6399c8410f263ec1c
TLSH
T128A002300AC120E0882C406FC34E37A0042AF44A8B1002301AB720CBE00444BCEE0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

PSXESJP.exe.bat

Path C:\Windows\SysWOW64\PSXESJP.exe.bat
Size 78B
SHA256 ceafd4afdd31a09ca42ef787b67e67f22afa3deea1b0125dbfe632e930c14fb6
MD5 5266ed01f558382cbcb150d89e8382a8
SHA1 26e4764c7491cf851249314f64dcef1dc2a51c66
SHA512 2ec93bd1f2135438535e5ea4fb926d422b13878e6f4323e5c9981a136b1c9e649d1c30b112bfcbb7aab3c5f63bf32c33f39cce34b19e4cf22fd1efbd72635169
TLSH
T15BA002380AC130E28824427DC34BB73804AAFC6E8F3208A21A9530C2E8044CBCEA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

QCKWSDI.exe.bat

Path C:\Windows\SysWOW64\QCKWSDI.exe.bat
Size 78B
SHA256 dc69b7aa939f63af6841a70987d42897b44684c58e1a813011ae7eebcd5ba69b
MD5 4e1bef7f8c40a8084115b92d233ea074
SHA1 064274c8059aaa21d090b94a72c3198618a45166
SHA512 a4cf063a952b6378fe73aa7362fed58e6fb23aefafc2ff517f9f0b9777de6faffe58db6c0f9969c69e88964172ee290c2cc9e06e311f139ff65f2cf8327a7f7a
TLSH
T1AFA0023A0AC128E08834426DCB4A373084EEF46B83908820329530C2E0044CBAB20CFA
MD5 SHA1 SHA512 TLSH

Submit Download

QQA.exe.bat

Path C:\Windows\SysWOW64\QQA.exe.bat
Size 70B
SHA256 a2a474b4773da3c232081a75075bacf6de9b3c76d38d561d7394b8409a146686
MD5 41ae94c859136976d17dd46b528da69f
SHA1 1e1b1c951c9dd8173220766bbf45d17468e12aae
SHA512 eed00393f7c252746c986c40fdf9dae89d31a60dc9095860210994ae826ef0691b12132b56b4080fcceac87505399b73ebb2c3f52401cd659ce5640f340545ae
TLSH
T1C9A002300AC128E0882C406FE3EA37200C3AF44A8310022012DD20E2F00444B8A20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QUZV.exe.bat

Path C:\Windows\SysWOW64\QUZV.exe.bat
Size 72B
SHA256 87aec7ffcb29ecae2f93aa9676a8ead9559bd80bbcc2146914c56c09a1f6e6f2
MD5 f1d7f0ef6724b34f1f79d32f5686f9ca
SHA1 03f0dd02d27c160679113fdc139206ea39d49342
SHA512 5261c908a5e0ff89f3a0ded9886c31a87154672dceda3206f6ce31a12c9e688e8ae05523fdae9eda5a1ede39d6f01b4e9fbc9d8f9a8e45b612437539fd1d6926
TLSH
T139A002308AE120F0C824406FCB4AB7A0042AF46A0B300020129720E2E00444B8A28CF8
MD5 SHA1 SHA512 TLSH

Submit Download

RID.exe.bat

Path C:\Windows\SysWOW64\RID.exe.bat
Size 70B
SHA256 c6e3fe22f07a56a8355ecfd6b12d530be840857df2b7a3a0aaec68d9d43fb8bf
MD5 a1c73c3650a0111ec1eea48c756968e3
SHA1 7ed855d829ab365c6f2e1569268402c3dc5d806e
SHA512 d89417d2a5bf7acb83463575a5fda2ec51274eec361021ae37fda0b906c5f3d4e5b232fe14d2cbd10ad4e94f931ea0f162eb38086f2a9d7c444fdb68da44c7a2
TLSH
T179A002300EC1A8E08C26406DC34A37B0042EFC4A831A00301295A0CBE204C4B8F30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

SKKD.exe.bat

Path C:\Windows\SysWOW64\SKKD.exe.bat
Size 72B
SHA256 d2cacf73acf7c664acc6965f57a065ac2bb04a6d6dcf73e7d27aebe40a44be02
MD5 6c9fe69def8f55b849aea72d0452d0f2
SHA1 cc929df05450f024158c5196fc44b7a5ffcba65a
SHA512 306a0be82ae54aa6d94b51aaefe1e1665ecb5ae44f31bf1f15c6c1e7ef013b2d7274df96306c770c9a2b9064e0416b5db501295406d0ff50108ce94f4f80e136
TLSH
T16FA002300BC1B8E08826486DCB4E37202C2BFCCA0330803092D5A0C2E00C44BBB20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

TQXOM.exe.bat

Path C:\Windows\SysWOW64\TQXOM.exe.bat
Size 74B
SHA256 69e08607c197dc5961c8f110ccfcbc802d7575bd919a94fa03d9b8f6c284f92d
MD5 b21a316a0f0baa3eecc97589233e0fb6
SHA1 acb343429f1ce354c7dcfb825fa04aea22716f43
SHA512 8f3acfafb5985fc5aba5c3e855243bbd4e3c313ebd8834aea08113fc990d9d660eee98793d933064417c4a511d8b669a9d36c078c9d02c4a5b6669ea57220835
TLSH
T106A002B80ACB20E0883C40EDC3CA3720043AF44A03100023129720CAE00644F8A20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

TVSPV.exe.bat

Path C:\Windows\SysWOW64\TVSPV.exe.bat
Size 74B
SHA256 805f26854c0af9ffb09abb685d5cbeebb555544d322532453fcd511474468662
MD5 7f5fd8f4d88cae6e9d7f7e2ba530f7a4
SHA1 1968a46db4669008f96ae55132ee4cc4d804d5d2
SHA512 29d31144b01858f34bede08f1c7cb327c31c79f90ed3db48d405dccf63f334ab39a2e983c546c9f0777477bef97807702556b92186d31a5f09ba3dcb586fa7d0
TLSH
T1E2A002302FC920E08834406DCBCA3720043AF44A03108820339520CEE20664BABA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

UDT.exe.bat

Path C:\Windows\SysWOW64\UDT.exe.bat
Size 70B
SHA256 6b9c2f9385a711ba1a8689506c34d3eb383a78cca9898cbff9507f2ebb13f728
MD5 745926cfd5a3728f7fbe1530627cd9a0
SHA1 52011467f34974aad6d3c887a29e32fea3d10990
SHA512 8136ec173030940df932c4f9cb45eac590f85789ca207d7ab330de2d4874dc854c748ec21810457212c9d61d4c48dd1105f1b73bc90a4b3074c3f6e000cb5c72
TLSH
T1F2A002308AC128E08824406DC34E37B0042AF6CA0310222012B730CAE00444B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

UWDNN.exe.bat

Path C:\Windows\SysWOW64\UWDNN.exe.bat
Size 74B
SHA256 98512696368336c853889bd4566b5c1b200920f5b7fd6ba8131857f9ec57cfb6
MD5 de2bb9f521628a997f905694360f2564
SHA1 1a97e939be7fd171a32b8ea7ce6c1f4acb4c4dfe
SHA512 06c23cd4d4bbb1d8c68a8bcf79316b30ae1cecbc17378a37d0177c8ad82a763dece68913ceb19dd507abde25b5ff9e70fcc3f3f01c2cf681d87f66b951fda4db
TLSH
T1D0A002382EC12AE08C24406DC36A373806AEF4CA83F0322092D528C2E08444B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

VRXPB.exe.bat

Path C:\Windows\SysWOW64\VRXPB.exe.bat
Size 74B
SHA256 06e5ad98668083b285fee100f989a53638985a406fdc17f04107c0890ea4b310
MD5 b9815e00636281b390e711f9816335ad
SHA1 5ea82d77cc4115810cbad034f67a206731c84e1a
SHA512 4a519d9469b3f346de6a18887e8a8178d4c9e07f13e0d4d8f36395b2e357fc8dc2280c43322fadcd04e3cf018e2e0fe83db53bb9d92767191cf399157ce377f2
TLSH
T184A002388AC120E08C24406FC34ABF32042AF44A0332002013B522C2E00E44F8E20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

XGSKAXA.exe.bat

Path C:\Windows\SysWOW64\XGSKAXA.exe.bat
Size 78B
SHA256 e0f2393d4b0c88a68c9cad1718f72aff28eaf35958ca4755fe9f37c7f853f35e
MD5 97c626ecbd6ae3db06905873f67af6e0
SHA1 11b944aaa6138be81bc39760f031536f30797347
SHA512 a53e2abe621776d306dbfb7ff6244e6073a61b7db045af76e483f620c8864d8e35119ec8145d106db415713007aa708f8c67d52f99c643f50319ca0d17591c7d
TLSH
T166A002380AEB20E8A824406FC34E37A08C2AF44A031A00281A9D28C2E0844EF8B20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XOCTMA.exe.bat

Path C:\Windows\SysWOW64\XOCTMA.exe.bat
Size 76B
SHA256 703a7613d8a2ef367ab09b1b7cc1a4044d11f3ad1e0753cedb8c2fbd6e884a89
MD5 ec18211ad5da240c4c475c48e5a99fc3
SHA1 4e8d86ce618f54ca401e1626468831e841d5ade2
SHA512 1a59dbc5a14adf99f2c6c10268c2ac87fcb4ff6f04a5b3fbe9820adb2ca6e4b49f8142d8701aa4e809d8ccfdedcafaa01872cfc7efa6959e556b77b43752e794
TLSH
T16FA002300AC32AE2C8A4486FC34E37A00CAAF46A0B182020129D20C3E0044CB8A32CFC
MD5 SHA1 SHA512 TLSH

Submit Download

YBHJEWX.exe.bat

Path C:\Windows\SysWOW64\YBHJEWX.exe.bat
Size 78B
SHA256 0f2f06e3d45b607f1da7894e7bd67490909d80f6a8ca7921b3e122f763b603db
MD5 11871cfbe3e6963a363fbb5b85a3c083
SHA1 951d263c0828928510e9977eb71e89b4bbebfbec
SHA512 93a5f4f5d132600437542d9fe2f30268c3e02440182c207bf024c332ae28e1fd78be40ba444bf1a2a2178b79b8502b013a1d85076b8c778a8b5cab181f4f14fc
TLSH
T108A002308AC122FA8C24406DC34E3720842AF4CE031080A0129520CAF00446FEA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YNCE.exe.bat

Path C:\Windows\SysWOW64\YNCE.exe.bat
Size 72B
SHA256 a768289fd91d00643fe663838c833677477413b9fd27fc0afb61b417e236e919
MD5 42f2bf42af03ed99524b630f8375f303
SHA1 7b74461cc77fa97283b98ad4857b2748199c5e1c
SHA512 c40dd532f13249a88dbccf219f2a58ff895009ab0519f91ad6fd0bcc8ff44357fdd811c60797ea0f64c3033da60cbff4b277309a1246f8ea88e489273caceafc
TLSH
T14BA002B20AE320E28824486DC34B3720842AF4CA031280B0129720C2E00444F8AE0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

YNS.exe.bat

Path C:\Windows\SysWOW64\YNS.exe.bat
Size 70B
SHA256 2971fb0eb5d871dc24885c63d7d5c15ffbeaff74aa51793db3ccbd2208ab3978
MD5 e6224364990230c4e8f1df0d6728d640
SHA1 3a87a5ff078c4b208334fc6420bd7359a455ea5d
SHA512 3461e7638b34e5192e98e4ed11002c1721b14b5b63bbb717e6b32cba588b8b5379150a5577fc8d5d96cd79f2cc5ef2a7b33526a30c9898275a85dbb6bd884ca5
TLSH
T167A002300AC1A0E08824407DC34A3720042AF44A03100020129DA0C2F08C44F8BA8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZDYUP.exe.bat

Path C:\Windows\SysWOW64\ZDYUP.exe.bat
Size 74B
SHA256 9293c00fe6f958e62df89f8388927286e0a71781c5df610ca289f6ed3e76f6a7
MD5 218834a060463531a13aa4c830a2553e
SHA1 eb6de4215cfb9276e8714e8a204b118428bc4704
SHA512 2ea995971398bf5342a117d30e059ea7598d9086f148163b3382342f55d026e737f0a81f85cf6bfd6580eeb44e03a214827c551139d1ac104af3cefe7d91551f
TLSH
T17EA0023AAAC12BE3882C407DC34AB720042BF44E03300020D295A0C2E30444BCA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZLSDHB.exe.bat

Path C:\Windows\SysWOW64\ZLSDHB.exe.bat
Size 76B
SHA256 611ffc4b595aa95dff55bd804db7940b0ace5fcf8bb1380b5d596a7df7f2ce3b
MD5 b772d605273314637e70ec0f4636525c
SHA1 bb30940c165e55ef4219c6465e4016e3a43e8883
SHA512 eca6532ec3c0d681f0f21ff60ac71fd2985af572745ba8250d024a2a117ba27eac335ba1153d58ffa5bf80ae2062577dc5d595c365eac79fc8418dcc502f4e5c
TLSH
T17AA0023E0BC120E08A24406DC34E3728043EF64A23D000A03B9520C2EA2474BAF28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZRBEGM.exe.bat

Path C:\Windows\SysWOW64\ZRBEGM.exe.bat
Size 76B
SHA256 de8268e3626e5440ed3acaea4b1921ce195b405fb59904b08f96e41a707e966a
MD5 2d97d078ecf893226ba6b1d0eee411ee
SHA1 7cc009828ce193a51a2df585b589e6ce9d74e3e7
SHA512 88e87e356ce353d7a17b799c3dd55ff5f9a5efca6c641f8de2f80882ef4c38cd03d008bff28acfc2371f18ae51fd0de0008f52dd7b93cfb185cc1fa5da4bbd72
TLSH
T11BA002330AC920E0ABA4407DE34A372204AAF4CA831000201B9520C2F20444F8AA0EB8
MD5 SHA1 SHA512 TLSH

Submit Download

ACT.exe.bat

Path C:\Windows\System\ACT.exe.bat
Size 66B
SHA256 95a8e0546e097c726cee21acf6b461941f0b85ec21657f2ffa46ecdfbfac0dee
MD5 c1e41688d71586895d07f4210043dbe2
SHA1 85d7fa7d8510939c303181e9ef9211c5d8a3f968
SHA512 05f233be4cb9926c2e46c0becfa2692e97999adab904f74dd5fab17258154e5d83a769985b5dfe5830dfe0ed1f72bac19f208abc468d98fc58b40829a5d0217e
TLSH
T16BA002380ECB28E2882C406D434A3780242AFC42031002A8129F0082E004463CB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

AKSQQLB.exe.bat

Path C:\Windows\System\AKSQQLB.exe.bat
Size 74B
SHA256 5efd15a46658bd5e9047385771a57e7b5d9468b93d212033af782b96f35e41b6
MD5 d602b4d03d1bd69b67463c5001f5fcd0
SHA1 f9ab162c88c880224940e831839a4cc38d3caa45
SHA512 dcf82cce8e1819244cb1f8f9374ca6e423433760f22f0c9fdee97a2b9d16b1ef7e3116b674ec9fdbe893d013b763113ec065d82313baf58cd1e83153ab3c5a8d
TLSH
T1CAA002B02EC320F28CACE27FEBCA3700042AFCC28B1000A812952082E0046638F20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

AME.exe.bat

Path C:\Windows\System\AME.exe.bat
Size 66B
SHA256 decfd8555f79352b0f0994ae92dc4845aa253ccdd8a5cf55250745bd27d08c5f
MD5 1b7ac263824c9c508cae9a78a8bdb55c
SHA1 e140c76b3efa873134738224a90238316aa3362b
SHA512 2c5575bc3f0f9988c4f0e62b1957756418a4ae55b511ff7cccc7190aab47a46be32892ffb153bd8407ab0ef5da722e8342ccf7b15e0df106fe91afd97d51162b
TLSH
T134A002300FC328E2C826486D434A3700042AFC420B1A802812950082E8844638B20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

BVD.exe.bat

Path C:\Windows\System\BVD.exe.bat
Size 66B
SHA256 6a83ca96e89cd607bf51d99184630e9c46751a850a626d9d557fc0ba734c9b39
MD5 88bb5421b9305f60d9e590ff9a8441c4
SHA1 325a279981731bc0f021d7eb9a82b859e8da52d9
SHA512 ba0ceec42abe6f3dd994de6c54db07670ee20d234a0d586b8f0308af121108aa66d4b3e980ebc27a23ec3acddefc6d70e8bad7c9ae2b284f71dbfd2c12d6d2e2
TLSH
T147A002308EC1A0E28824406D434A3700042EFC4A039000B012950882F0046638B22EB8
MD5 SHA1 SHA512 TLSH

Submit Download

BWOB.exe.bat

Path C:\Windows\System\BWOB.exe.bat
Size 68B
SHA256 943f6be36e89248806c52d3484f75d61978832bd14ac3919795c19621af1e466
MD5 eeb3c466a47ad70fd03bc6246169e6ee
SHA1 00b21646469d32748ea49c78d386683eeaecc7f1
SHA512 feeaa1819cb71e31039a51494054330ed5ee2777c27fbac46b4580c99e4533e176db015dc7cef0818b0b4c7d1b0217540e3f2de428866e01109adaed4dd6f967
TLSH
T1F7A002300EC1A0E28834406D434A3700042AF44203100A3012970082E0044638EA0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

BXFMY.exe.bat

Path C:\Windows\System\BXFMY.exe.bat
Size 70B
SHA256 40cd2c6c69425ef2fb56bd77cd64e1bd1b06e25969056d51cfb36ff73a3d579f
MD5 0578f0af523600e479d86344b7b3a3f7
SHA1 d35dc82a639250f2eb4adc957520b34f509c136f
SHA512 212c5221530c7801087f2cd468e10b169c8e35dc63a3cdffd63ca84f61e936417150accda335fdea3bc5b7d289fcb4cddb5cce796a8b3bb65c9fa34507882e28
TLSH
T196A002F00EC128E28C34426D434A37080C2AF4422318002012952082E00C46B8FA0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

CIZ.exe.bat

Path C:\Windows\System\CIZ.exe.bat
Size 66B
SHA256 5efd323362f3ea2b266ff1c8a391039e78b221e70ef6e0bf43215660968657f4
MD5 f4366a04a930019c399f8870e7d7adaf
SHA1 1ffe5426dff92e1a93331b62a94d5d3a19b12ef9
SHA512 0ea84037009cbfa5edf646e7e98ff76eb7d8367e8563ac1fc7299b7802397ec2674dfa8e2a33017a61c511ef355778b61bdc41dd4b692887d8a409a268a9b0a9
TLSH
T111A002320FC320EA8C24E06D434A3F00242AF4428310002A929D0083E0074638B308B8
MD5 SHA1 SHA512 TLSH

Submit Download

CQBJ.exe.bat

Path C:\Windows\System\CQBJ.exe.bat
Size 68B
SHA256 78414688ac894d06881e8aa96efcbad667e6852f8e5fa7c30a29d2c2aff728fc
MD5 055a45e848738dc76f489060295f3f75
SHA1 0645a584c1f1ec31ba4e054a7f13902b363b1ce0
SHA512 e11c66eb16175af819e75396c1b6c899c12c40e1b2494895f92a13180109441c8b3b3e7dfb4a5d15202ff768133b9d6b34526c97d642f4d0fa7dcf0d243c9198
TLSH
T192A002300EC1A0E28A2460FD634A3F00043BFCE2831000281A950082E0046638A20ABB
MD5 SHA1 SHA512 TLSH

Submit Download

CSGF.exe.bat

Path C:\Windows\System\CSGF.exe.bat
Size 68B
SHA256 1ee14472f69ac70aaa6935846be32f405ff4e18f77dd062b52da15e1946fbd63
MD5 fbecd9a562715874b91d64b09c60849d
SHA1 c5799176854e1a26a5f706c6b65e7f8318d15113
SHA512 f32b8807fdab202549b72af69802b973d5b250c778152cb59adb4634fb04c36845e22a3fb2183d4b07750220ae2df3fb03f7a50af0d2e63aac31409849d1bffd
TLSH
T102A002302EC930E388A4606D434B3F0204AAF4422310002812950283E0044638AA08BA
MD5 SHA1 SHA512 TLSH

Submit Download

EDFTQCE.exe.bat

Path C:\Windows\System\EDFTQCE.exe.bat
Size 74B
SHA256 d41905ea35323488aa687e1e0c497a2da660be88dcf39632ba1600d06e94d30b
MD5 375ccbebf631f30c58ad9854162f2140
SHA1 861fe16f534aba8166a5ff21b4ba6ee9d0978df2
SHA512 7575a6e867d87f4c981858f910f6772c51ffc2785054177a5703748fc1161f12e1a5ef69c84caa5c676bef205a33d2e3d9951e4b0118f7414626cd1476cb0a78
TLSH
T14DA00232CEC320E2C834E06DC3CA3F00362EFC42031280A012D7828AE0066EBCA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

EJCQX.exe.bat

Path C:\Windows\System\EJCQX.exe.bat
Size 70B
SHA256 472b118c5b7da81137d13fdfd13e61f5a5198932d0bd29c14197b0363f5ab014
MD5 288babd3d4bd9dc4fc8f103965f8c0da
SHA1 467eca0f189fc6e27f1ee1ff095f6ba3cbd642dc
SHA512 25d890ff6706efd2fb06e8cce31acd5b1deba874a2c6ca7f2ab3cbbba0918b3098ca29bc818cd63f11099f99ad1a1c5b5ea90298a3ec2e96d8d40b81ae81c732
TLSH
T1B7A002B00EC12AE28CA4607F434A3F008C2AF4C2031800A892D700EAE0044E38A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

EYAWBQB.exe.bat

Path C:\Windows\System\EYAWBQB.exe.bat
Size 74B
SHA256 371433df2889b3ead7304fc31e1b7a279ed55a9c8c4a7b52e535caaddef47704
MD5 975da1182a7d13c01bc6e33a3416fb0e
SHA1 231c086e38b0f065f5349394ad8ee2a2539e42fd
SHA512 063152a4204d4fd7b854a0f72c031ee7112a9113f6f2eb04c7267485f005b7b12a99ad8de88abf847369f7c31f3e3a7b56a165a1299545aff9215ac547868e8e
TLSH
T1A6A004300DF13CD1451440FDD3CD3F440517F4451310041011DD0455D144CD34D3077C
MD5 SHA1 SHA512 TLSH

Submit Download

FMBELO.exe.bat

Path C:\Windows\System\FMBELO.exe.bat
Size 72B
SHA256 c5aaa884bdff565891194b872bfb698d8a517292952cea5417818b00135e9bd5
MD5 d5cb6b93d3c6b52ec3813a83e10026e7
SHA1 2012630e17d0580afa6fb1a450da02fa34c92d81
SHA512 b454c7d412df0c6d2dde16f3a0e656268fae15de00195e6e7580383b9cac62c65463126c6054a008f29e279f7917acb76e26297de278977d49563fd225019dbd
TLSH
T150A002B82EC122E2A824C06D636AB700042AF44AA31008B092950282E004463AAA0EBC
MD5 SHA1 SHA512 TLSH

Submit Download

FPKT.exe.bat

Path C:\Windows\System\FPKT.exe.bat
Size 68B
SHA256 1d685a77a13a7c76bb924c5fe671e0c842fa92165fd25297ffe08756eb1d1997
MD5 ab79108aaa256094842bb11cd30efa1b
SHA1 c947116cfb391550e79d603fce83758dd003fc5d
SHA512 01737e782deeb2231ee4e4654d6db09016cf95614f7a06e1b62493ede3603a4386d86616f0810349065dc7e9a53b31d6b06c93f1132b767b96bd49374a72dade
TLSH
T169A002302EC120E288A4C06D436A3FC0063AF44A03308A2012970082E0044E3AA288BA
MD5 SHA1 SHA512 TLSH

Submit Download

FRBK.exe.bat

Path C:\Windows\System\FRBK.exe.bat
Size 68B
SHA256 fe018059c829fed553e6c37cfd4dcecf9b681651b5cdccfc1e3084e013f5ca2c
MD5 713809c451be09994353ad699d802f2c
SHA1 2b33000076ba15e2877ed8f4a6aee82e0499a409
SHA512 ed2df4eac3873f803ebb47eeb8c98db88bd0e4b2de132a0df9950b81139f0044b68c12261c72d5a2506ab29ffbc87fe1fa4dfdb41411583af87e45c50ca14971
TLSH
T149A002320EC1A0E28C24407DE36BB7A0042EF44A03180820129500C2E0044738AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

FVM.exe.bat

Path C:\Windows\System\FVM.exe.bat
Size 66B
SHA256 e64fcf8305381856feb0afc1b9698f9237199a45820caaf9e401a20c5268990e
MD5 b197e3c0d9d87fe20ecd946913298e7a
SHA1 add298065b35cff826382082b2624a9d98e64e48
SHA512 7c77632591cc9cf650400a177e0e36ba3d4ec87be154d92cd006244af41ca8d978f92cdeead63904f80240b0506c16ae23f5a92408e92a9e977d93e17c6ed660
TLSH
T13EA002300EC120E28834426D437A3700243EF44E831008A0129D0082F00C47B8A308F8
MD5 SHA1 SHA512 TLSH

Submit Download

FXRPI.exe.bat

Path C:\Windows\System\FXRPI.exe.bat
Size 70B
SHA256 75d20be9b9dc6d7bd2187686e5a034ca2ae103beafb22b2f22f01313ab1f3acd
MD5 fa0ebfc6ad5b6a6b68df679eb8def72e
SHA1 6699e8854995d40edc99a226b399719b97f31346
SHA512 072724d2037127fe1c39c1b5d661b6da8a294bb8c9ba07e065d0fa83261c2a160a51668cbc227bbde164b070fefdc84c10cf4e101c1c59683e72f0f8bcd5b7c6
TLSH
T154A002380EC120E28C24406D4B6A378804BAF4CA2310082012950082E0044E3BA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GIKPEV.exe.bat

Path C:\Windows\System\GIKPEV.exe.bat
Size 72B
SHA256 7fe03deb8e4cee4f5472d0712b4c91b2fb62216ea3b39dfa312f4c45e4141b33
MD5 cdad266a7a6db0f0cc3c0242e159d94b
SHA1 b8f12adf2f8add7c5f0c572965da5021aca16ec5
SHA512 737b92bd00561385257f39d4835284491a52c0cf88a0471bca5f76b9c129ad7482a478032dd547f173cc4c6f0646948ad4a88ff3a4e8468257be977eb9a7053d
TLSH
T162A002328FC120EA8824C86D6BCA3F20242BF4620390082212970082E2044638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

GRTHK.exe.bat

Path C:\Windows\System\GRTHK.exe.bat
Size 70B
SHA256 54d341616f9390f883b9a5d54e1131d19b6ab71eca7597dbf250516d63997217
MD5 124b7f83748766c254bd3d6469640477
SHA1 99b99725a42f472314f4cd377b4eebd3b0a9a5b4
SHA512 0d4bf41c8072ce982f756098a2d21a2fbe4a56262e7c8e05dab7a011490b06a1e1a676bc64f9e373c26b3b793939b6724fbd9df18a09cf191a30700bd001daab
TLSH
T134A002300EC120E2A82660EDE34A37A0043BF4420398082012BD80AAE0044E38A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

GTHQFMV.exe.bat

Path C:\Windows\System\GTHQFMV.exe.bat
Size 74B
SHA256 7c141a829eefc8ea49b89401b6e92aff09c843f8d5d654088430aa74af2a0e1a
MD5 92c8dd6641364bc2822acc4f2735306c
SHA1 f54e8b6c1ff5a607e98aa376a9d1ce91c796b376
SHA512 7b5608a5d881921b39d21a310f856b8df90d0d661c216830db4b64c9ce0a354fdf8f43f2cc2d9ec3afad2c2d07c1038f08ed6cd87d0d8381afd02d57d5fdf6e7
TLSH
T135A002300FC928E28AA4406F6B4A3700042FF442031A00381295A0C2E0044F38A38AB8
MD5 SHA1 SHA512 TLSH

Submit Download

HERB.exe.bat

Path C:\Windows\System\HERB.exe.bat
Size 68B
SHA256 0d02933e9b4b3dc81517fe4abed47ee97e3bc12a7ad6a7023602af6df764508f
MD5 f47d06dabb20446950e15edb1dbaf396
SHA1 e5581333236f3b730012bab463948b857b492586
SHA512 1ccbf66df589e6e6680d12f32cb26f157f7beefd7a8fbe09f93b49b7c0c59817244b33b4e38a37d6d1645d38cc4e427a977f2c5b7ee075693cda5f53e81b23bf
TLSH
T167A002300EC122E2A82440ED4B4E372004EEF44223100A20129F00AAE0044638E22EB8
MD5 SHA1 SHA512 TLSH

Submit Download

HHDPO.exe.bat

Path C:\Windows\System\HHDPO.exe.bat
Size 70B
SHA256 8746fad1ee7b638f9d07eb4c98192895aa1ea214fdfe383b2432a95c377cd3d4
MD5 69c48a70147e764d82c483a5dd9acf89
SHA1 312e155421720b8af0dc5760bcafb18eb10cca6b
SHA512 645afbdcb05e27723f20bbf8057e43bb4f4069d2b9158afd5a472e21a17fb770b3c106a28c09b9ca19e698a26a575e61d3aa1e484d668776aa2449bf4bf0f174
TLSH
T10DA002F80EC323EA88244AED434EBF02042EF4428F100C20129F0082E20446BCAA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

HJURT.exe.bat

Path C:\Windows\System\HJURT.exe.bat
Size 70B
SHA256 c3abf5fa926e0fed18af30adafd4b05101b26f73da720483072168990ab5c0d5
MD5 66ffff8cad18e1ba1771c9159119182b
SHA1 3468d8ff3cd0882aeff3a93df41319279bd90257
SHA512 4fa8aea4cf394975da5812054d41d5d91c809db48344a7237ac40ed2ccd0889e483e33b3f3530917b002557c268ae56adefb25e23a42fe71ec7ab887d0a331b8
TLSH
T1CBA00230AEC920E3882440EF434EB7808CBAF66303900B28139F0082E2044E38A228B8
MD5 SHA1 SHA512 TLSH

Submit Download

HSPSRIW.exe.bat

Path C:\Windows\System\HSPSRIW.exe.bat
Size 74B
SHA256 b2d30ec31378f510a4b699938621ca1cbad6ca27d3ed0b1011bc25c4b417bcad
MD5 0992bc18bdde890623b98aa4dd300681
SHA1 7e8a019a28af2fe2d270d977c92b5064d7323c8e
SHA512 b89933ccd021274b37d6f35f5287777842b11c24969d8d4101edd69174270af72aee614552b7af8a1b78248b38e367ace19df769eaa32095a03c4caf30f26540
TLSH
T197A004300DC114D14C1444DDC7CD3F144515F4414330041051FF0153D00D5734D30474
MD5 SHA1 SHA512 TLSH

Submit Download

IFYQUGY.exe.bat

Path C:\Windows\System\IFYQUGY.exe.bat
Size 74B
SHA256 95528783e28ff778fe82f26bccda2b490aaa2c7fef3ea67cfd657cdc71c17ee8
MD5 62bfa14a5b5ba0cd4942a4788c629f66
SHA1 4bc09b970e935dedfbcb5d828a73ffff0cd7a7fc
SHA512 7ec9dc18e4556dcb3a47ef7cee347a91abb9f37c1d1f4e7d1f6b5eaf1a6020c860c0e6f56e1bf106c84c743e3e95f048633aa84ea516abcf22b24a11f559b06f
TLSH
T1B5A002308FC1A0E2AC24C86D434B3F0027ABF44203B8002012F7A0A3E00C4E3CAA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

ITFXTCX.exe.bat

Path C:\Windows\System\ITFXTCX.exe.bat
Size 74B
SHA256 47e90fb29fd6ec00022b9d17c0bed961c1c4ebc710675d32e6db56d0d7e765db
MD5 69796bdf9598bee231341e03879b05eb
SHA1 7521a232c6de03dc76d2163940932268956ac5a8
SHA512 60a4e2d6bc7720420bd96e6c70a9c11147f51f9b189f213ced1b24e41ece250d7702ad67036c3515dd8e8d76da4c198c27e77af616d6a3254db8732439e8d52a
TLSH
T130A002300EC3A0E28CB440ED434A3720A42EF4E2031000F01ADD208BE004473CA288B8
MD5 SHA1 SHA512 TLSH

Submit Download

IWRLY.exe.bat

Path C:\Windows\System\IWRLY.exe.bat
Size 70B
SHA256 97f821279a43c5638cf0b3a32d3be9e3fd6887ba6212cce72a4593c08baa1cc8
MD5 72fa068d657a1635528e148ab421dc16
SHA1 0577d94c45925db4b7af0e2ac1e0d774ffeb9658
SHA512 67cc419eff155a28d6121607d931a3015d87968dbcb4a71ad4d5033a440593b79ad30fa8b38d543c4674e061b0f1057ffc07202757d775c55ccc00d89414aef0
TLSH
T19AA00238CEC1B0E2CC3440ED634A370024ABF4420330002012D52082E004E638EA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

JCJ.exe.bat

Path C:\Windows\System\JCJ.exe.bat
Size 66B
SHA256 07ed9f64ef9a1e15756ff0d9323a76d898830f3c89b1c61b8ed48ae978a072cb
MD5 9e00faccd4e5c4787e21a3bbcca2c1b9
SHA1 5724cf248911554214fcd5c5ec9050a46de12201
SHA512 a620fcb6ae5a9bdbef6cd26a3f24038c3f6010e507e4bf5e1c04b7d835dbf6bc0365facc0f1925d2b962e10274d58376059d3ac44580250e742f31be5d79fcd4
TLSH
T13FA002300EE1B0E28A2440ED63CA3728042FF44A833080B012B50082E0044638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

JEB.exe.bat

Path C:\Windows\System\JEB.exe.bat
Size 66B
SHA256 ae99fe3fa5d8acda403c24a33347712c3f3e36b746041e1a638f6dd7b66aa1c5
MD5 65fdafc6b9c2522af1b3fac509ae26bf
SHA1 31e5fe1ffb5f9f8b62ad5cf590906eeef509c08f
SHA512 293c1557c46b14fe7f78643999c2d242886802d0cd93cee21c6fc5fcaa45c6fc34bb81a50220966731f9b459100e976c07cb78018ae6dcf8f89a12bf3980b039
TLSH
T18BA002300EE120EAB824406F434A370B042EF4420330022212B50082E0044638E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

JQAAMP.exe.bat

Path C:\Windows\System\JQAAMP.exe.bat
Size 72B
SHA256 6f98f38cb933c5602b910b1cdac4adf2f72e54ef0e0c6177e1560c23b06abdfe
MD5 ae7d07b354ea168968283bf520c95ddb
SHA1 d98aaee9f648b9333e490c1c28363190383dd126
SHA512 b097c60e29e75271949ef8966c68ab329d380cce599914070308f98989d843365c0abd7fabc0a5fe7a8e5db5ee3bda14ca6c00b64fb6ba056fabc98b62aeeb4e
TLSH
T1A2A002380EC320EBCA244A6FC34A37080C2EF46A03380C2092B502A2F004473EA20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

JQAKO.exe.bat

Path C:\Windows\System\JQAKO.exe.bat
Size 70B
SHA256 6723fa5a3d154a8024d528f627c0a12c692bc0a12a625efe4114c14a83902c4e
MD5 b33c8bc7429fade5735882402b061b4e
SHA1 34fd213ecb28a125346e7e3ddd8bf05911a4eccf
SHA512 16b3d57974539fa3b1916cf820b6bfe152998f10b53aa75318a80fe7d7473cc9fd9381e1ca7e690ea16114ed77eaf47b1e89fe9b8bac4109f35c9fc5916b4dec
TLSH
T166A0023B0EC322E28A34426D434AB72E042EF442833088201AB50282F0044738A30CBA
MD5 SHA1 SHA512 TLSH

Submit Download

KZT.exe.bat

Path C:\Windows\System\KZT.exe.bat
Size 66B
SHA256 95a6b678681778e2ad88f60ec13bbbb0d37c0f7df9068c0a34c8674f9333fdff
MD5 cfc908313a41f5e1ece8f1b78b9b944e
SHA1 dc150e71e445b6f23a8890800adb0fd09a878992
SHA512 95a4112392282bf1d16ace911b22e3ae0bf8bb8633f0c5646048a2ff84ad712d9f66f2ed4371e65c711213e6d403d485d3d06185ead3c02358f60c06e198f8bd
TLSH
T19BA002B00EC122E28834406D63CA37800C2AF46203102A22129F8082F0044638A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

LYZGAM.exe.bat

Path C:\Windows\System\LYZGAM.exe.bat
Size 72B
SHA256 426f779084d47e711b722d4c59a3a1f0c38446ae8ec43fde1e3e2ef3f38b9922
MD5 49ef79bd233c3d14075431dc50be2708
SHA1 4238dbf3e1bb3db5b24db2755609a73baa3ec46c
SHA512 2e9f4753fd1a79fbe742e0d1eed2e890a66c69c7670502e9d1dbb296d76532db4fe2f71958dcd1f0f281d1ee1ad9834c3c460f85aa3cc99aec4abb0cd4275dec
TLSH
T1B1A002302FC13AE2882440ED434A3700042AF44A83D0002A129502E2E3246EB8E28EF8
MD5 SHA1 SHA512 TLSH

Submit Download

MIWRRAS.exe.bat

Path C:\Windows\System\MIWRRAS.exe.bat
Size 74B
SHA256 14c2239491d6c5b6bf580d6a02d7bef2ab2ce776eed82b804190fb16ad78e8be
MD5 9893ce0029e95235920e864816889844
SHA1 2eb889c84a03bdd79db304d3a25f1fca808fb718
SHA512 0e5809cde0202f9d81f52122497edbd10d935af9e82c0842449bd3500bf1fd31a88a34c6078bf57d4c9ab66163a8c64b72d461acdbe377be6296c8a4e5b0eae2
TLSH
T148A00230CFE1B2EA8C2C48ED434A37000EAAFCC2031A002212D5E082E08C4638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

MNDCEHK.exe.bat

Path C:\Windows\System\MNDCEHK.exe.bat
Size 74B
SHA256 e172cd1b385b73f0986a791c594c34f6283a2b8251c20f2a72dd3c6bb2fa3fd2
MD5 c6f890acac82293b2d8fd0301c29842d
SHA1 97cc476b91673289b612bb70c9ba2a20a4af4579
SHA512 5aa93cb7f9753669a7d16a1d66ad77bb8751029fac74c780c115e92738a5fe8ec0c267b981b74341dd1fcbc7856d31d78efa5256729a63b173f4882ba36bd526
TLSH
T189A002B08EC1A0EE8A26406D434A3780242AF442239808201AD50082F8044638AA0AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MSJUY.exe.bat

Path C:\Windows\System\MSJUY.exe.bat
Size 70B
SHA256 b391fd8a7452b156a09f1d1fde15a22f4b4d1cc045e52d80af9ce5af7aff459c
MD5 ad834ce5b0fa06b906cb08a0aa5050de
SHA1 afd7620894d405e38d1a108b1a537fbc5aaaa703
SHA512 794dcbd523810bb36f7b093b77297bad0cf20f2621034c864a94e2c05a25cda2d5d7678d97ce1345e5ebfc7b3d5de4a6bc24fd0f0de846ee58f04bc04108fbe7
TLSH
T198A002308EE320FAC824406D434B3708042AF44303D0002092978282E004463EAA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

MTPGBUO.exe.bat

Path C:\Windows\System\MTPGBUO.exe.bat
Size 74B
SHA256 db65d11a092d68d573260ee6c2df762efa0f476f84ad8069db100df16c2609c4
MD5 2b87eac3efd557bb3a144561b0bebf43
SHA1 568b42ea5c58e1af9ff7bd9df192cd1c49ea34eb
SHA512 118026765c3822b9ebbceb254ecde73ab9fa23fe58fd6ba0df5be47d60e74204d04746f81d4457573631db5a6e445c300f0d06a4efa74044de55ac3548f3a955
TLSH
T1EFA0023CEEC122EA8C24C06FC3CAB7028C2EF4C3C310003092978083E0046638A2A8B8
MD5 SHA1 SHA512 TLSH

Submit Download

NNVRB.exe.bat

Path C:\Windows\System\NNVRB.exe.bat
Size 70B
SHA256 d7f0a92ee5dffa21a72c0ccec85f61218778bc039a91cd9bda95f648de4a2a40
MD5 4c72b8ebf4a646e79a107109fe0fcadd
SHA1 f1a245238cf41d09f0edd9fb76b48f890b1b0475
SHA512 63015275c1c292b405676036938667dcba156ed0297504220fdd6be8d4112b61dcc2d25edc4ca4ca66a6c5314e86145cbbd7f4d49642c34cee977ccb5280425c
TLSH
T1E7A002328EC122E28826406D436A3F0026AAF4C3231002221295008AE0044638E208B8
MD5 SHA1 SHA512 TLSH

Submit Download

NPKN.exe.bat

Path C:\Windows\System\NPKN.exe.bat
Size 68B
SHA256 932860915a2e0640cb1d9781df5a9a78d4b4e66cae4814878a389f896e3a2356
MD5 bf733b139d426030e9178f9dede54c59
SHA1 684432ef2ee8c10717a927a22373aa32389e4535
SHA512 edd5ce5babc78fe458ae11a44415951e3a79ade61a7222547449dd3e1c53302b17f2c9e43b63cb34e71c96c1d4b50acc8740201d5a029d12fc63e92244632f6c
TLSH
T1A3A00238CEC120E28824406D436A3F00042EF44203B0803092B50882E0044E38A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

NPNN.exe.bat

Path C:\Windows\System\NPNN.exe.bat
Size 68B
SHA256 9ebb439b0a37f3022e53ae88c7c5a8765582a2d7128b9d6eeff17c4955597082
MD5 30fa80e8f62c3d9d8ad6c119fd721567
SHA1 0971db8b49dfea3853d98be19c70ba0ae3bbd823
SHA512 9dc996fe670230d366e0f04cc550019affb5130310bc023d5c188c77cce4c80c907bcab5e2392c033f8d72bee51d27ed157047d763c79fa38aa1b0d16385d2c1
TLSH
T1D1A00230CEC120E28A24426D436A3720042EFC4203B8003092B50883E0844638A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

OXPTODQ.exe.bat

Path C:\Windows\System\OXPTODQ.exe.bat
Size 74B
SHA256 7f612488c66e68056d8c03629705bdf35173606ca158b615c0413dfef6944c57
MD5 234129bdf12a3301ba55e2cdc96dd3b7
SHA1 f8ead866317b52e350b12e6c3493b25331f3aada
SHA512 ac37ead8f2126baccc7a8e407ba3ee16f075d29bc537adce4621b0646390972a634f7138e5b702ac659786cf27187a4c463d5d2f0cbe630c17f3df4202b50b0b
TLSH
T114A002300FC328E3C826407DC34A370A043EF442039000201AD5208AF2044638B288B8
MD5 SHA1 SHA512 TLSH

Submit Download

PCXZ.exe.bat

Path C:\Windows\System\PCXZ.exe.bat
Size 68B
SHA256 0f5ea56470d43fb9afcad08eeab1f9e6946213d57c8a042d175c887736564d7d
MD5 995f51d814d7a73b8d36d0f32102dccf
SHA1 fd5f34d98ff2a9c7ff9b7876436b3e647db400e9
SHA512 77375e86695d9fbecf501798decd72168a1f878ea6c67f30fc731ede9cb72a912a3d1a51eff80b49bc26afb7322cacfd8a021cb2dc705fc7f4ee752f993b4c5f
TLSH
T101A002322FC320FA8824406D434B3700042BF442031002E012950082E00466B8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

PFLAIS.exe.bat

Path C:\Windows\System\PFLAIS.exe.bat
Size 72B
SHA256 ad05f03b2c7cd4266197dce08b6059c4ce9484c06e549461199f5e22b574b647
MD5 b8548eb0615c2e36c544e410f0781614
SHA1 7bc2dc4b3be3645d8a66b2d3ab11026d5ac195c0
SHA512 5795aa2affaed44396663f91d5ec4a44a2eb0dd1f43927b04425708d5cf4f2efa234ad16ce57dcc87bea4904901b58b6041c811b6ea6bae618573108a2c65a36
TLSH
T1C8A002300FC1A2E38A34406D434B3700042AF442833000E212958083E20C463CA308F8
MD5 SHA1 SHA512 TLSH

Submit Download

POEV.exe.bat

Path C:\Windows\System\POEV.exe.bat
Size 68B
SHA256 03d1798f0cd9456807522ca4b6f81686aefd748818956185b53f3042b05d1207
MD5 f893896a8b27d1327133495baaa8ddd2
SHA1 894789aa5b4a473eb844a768c2f892872aaf26b2
SHA512 43432c9c79552a7f97b8fcdc6bae843faae70c7cb3d86c6bba8ba37c8673df2391adb67c06eda4fc54a39343534ebe798a9c7a420720fa3144e91e6ebd45f419
TLSH
T1B8A002308EC320E2A8B6606D4B4A3F20042AF442231000E012F50082F0044638A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

PQBMIK.exe.bat

Path C:\Windows\System\PQBMIK.exe.bat
Size 72B
SHA256 d867247c52936d5a27340540bc9e091dc281ec2e996af9975e0cbbd83fbbcbe8
MD5 d6530c1b3fd8048a350dce71ce831985
SHA1 2b4fb3b1ee88b5fd50c1353c1e8536175e6bb717
SHA512 8d3ab45ea02cf4f3a47850efee7e42437da12da54a6072ca44f9fb34cf0896dbaaf9439548162765bc045abc12805da8d41c49628ca532fa55d8eb1882578ac4
TLSH
T1E8A002300EC1A0E28A24606D43CA3F8004BAF643839800E812950083E0044638A30ABA
MD5 SHA1 SHA512 TLSH

Submit Download

PZTADU.exe.bat

Path C:\Windows\System\PZTADU.exe.bat
Size 72B
SHA256 dd221882353819759e4c0be6063c8ee15341af42551bbee2b776ccd6e7a2f05e
MD5 3f2bcfc8e81d08acbd5fd7be6acf0244
SHA1 999996d271ffa67b17e9e2d94f1079387a97e883
SHA512 7fb2c7c0b333721156c6b604a3e151c7f5600ac9c15d6945e4807f4b961dd227aac797d7e9c5d8111226e0756710ce35c60629bcdb8bbdbbaf31371bae382917
TLSH
T1FEA002300FC138E28C2640ED434B3700042BF442031028E813950082F00CC6B8E208B8
MD5 SHA1 SHA512 TLSH

Submit Download

QDT.exe.bat

Path C:\Windows\System\QDT.exe.bat
Size 66B
SHA256 234375aafe755595b14af2d698fcc3a292bfe6fe2b07bc531df93cd6f2bc25bc
MD5 43af8fbcaa5b2a56626ed8bf6d330a83
SHA1 15670bdbe14deff4141cb684cb5f7e01e25abe1f
SHA512 a7167d9305055fe53448f5683765a461099f3df8b698a4bac2650cc6f86d35053ac9f5d6e815fe6f84d2ad380e0ebe4acfbb7072e4b38aebadd1eddfc95aad1a
TLSH
T120A002300EC128E38824C0ED434E37A0043AFC42231C02A012B70282E0064E38A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

QMTPQP.exe.bat

Path C:\Windows\System\QMTPQP.exe.bat
Size 72B
SHA256 002741c601094f7e17ae1fdc38c6fcf14f68cd60d72c2930021cd4f87f70296b
MD5 afb38a450652b3c3d6cd2dae6a375fd0
SHA1 fe8e447e83d547895c174ad65931db9540ea46bf
SHA512 969b5d2d3486f8a21d642006f2a21989563042ad1f5d1205bca78fc8aee5109c586c33867089d95d60dec215e6dedcafd25aa98ca0e81e265d3b601873fb8e7a
TLSH
T14FA002380EC1B8F38824606DC34E3700042AF64A23380820129702E2E004463CA20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

SDWO.exe.bat

Path C:\Windows\System\SDWO.exe.bat
Size 68B
SHA256 e30e202146e00c35538a5d041102eef652623c16916ae12a4a8d1bfefe8dc280
MD5 097e487e15d8e55e0331d88215abd41a
SHA1 fa359a3f05aeb3547bd6f55f5c5870457ddaec2b
SHA512 8e254dfe39101a985cff58dbd83d3ef5f824261f875414036ae663dc6c5ddd45a871cf4f6fbca84615e542315dff1e9cf46d9bab9cdee463574346b504543c15
TLSH
T184A002380EC122E2C824606D434AB7080E2EFC6283100C2012B5808AF0064EF8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

SEL.exe.bat

Path C:\Windows\System\SEL.exe.bat
Size 66B
SHA256 bdd6b314359b978cf356416b69528d82a52de6f437ddc8957f4253fc77c9a1e2
MD5 0bc8b8ef83ccde7cc3ce32d967159343
SHA1 6783b5e644cd54efce967da4e381a5f3abefd351
SHA512 2e08d4f91863d6a3f44515eb6fd645884cbb0f4c32a7b8f928ddd02ca798b1835d00af95ae4dffc38142843938eeae15b908e03f4d6f130e9d663d22b7394417
TLSH
T1E3A002B00EC920E2A824C06D434A37020C2BF4420390082013B50082E0044638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SLNU.exe.bat

Path C:\Windows\System\SLNU.exe.bat
Size 68B
SHA256 ed2ac7bac3ae222c2f6ec5593903a49155bf225148f8faee632bc6b5f3580eea
MD5 4b60da0d18c1d6d1118d57f6fef39f32
SHA1 b6e2e2cec2f7f8df31af3f52437df7479a669e5f
SHA512 d4d9d1a44870284a71f11203723757ffae2bfe5955a57214bbda5ed4bfb3f49fe68943352df66f508a45474e914d664d2515f84f3541da9a0d66c2de3cb23e07
TLSH
T1FCA002308FC1A2EA882CC0ED43CA37000C2AF443031008E01AB50382E084C63CAA0AB8
MD5 SHA1 SHA512 TLSH

Submit Download

STUABL.exe.bat

Path C:\Windows\System\STUABL.exe.bat
Size 72B
SHA256 38927907bec4a0a7e25f80dbfc2e366a7676cc7f6a7857455d3e0217fe00496c
MD5 7117644b3316da8898bfd770d969df33
SHA1 15d43dc6bea60a925c12acf42dba5283bd37f3d9
SHA512 46b04372d3f724ef28e6a1830dc78947a2b6ffe7112e1c44c7adab8d44b6f95340bc7e226fe0e475f1ad91a8807d2daf05e57b262663c8c0977e274bbd20aff8
TLSH
T1E8A002B00ECDA8E28824C06F63EA37000C2EF4620392083093B50082E00CC638AB0ABA
MD5 SHA1 SHA512 TLSH

Submit Download

TAYNYTG.exe.bat

Path C:\Windows\System\TAYNYTG.exe.bat
Size 74B
SHA256 673c9c1026e61f96fb2fe38d6b0fa72d01b186c29401d01a2283f6d10e7ad3a0
MD5 a4e8a0879913310ea5949aa7bebc6e0a
SHA1 b8988d5da41937adf3af5735ac7d5cbaae123ad6
SHA512 fb6ec2c69c0deb81ec0cd45ff1a14feae8aeb284473957cd8f01fbae5d61be7989b93d39fee58eb08589cc93b447c5720a4d3a48632425e87b3d51857c197f5c
TLSH
T156A002B00FC9B3E28C24406D434AB708242BF4420312223012950283F88CE638EA8AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TFVE.exe.bat

Path C:\Windows\System\TFVE.exe.bat
Size 68B
SHA256 fe209f7c838eefcd7fcf454bf097a5c4b0dbac5fe5a0d72f0da4e0ed8ba91fd6
MD5 2067f631e8a80b10253d69d02186a499
SHA1 4d43f086b92b8121a99f74d0f5b8b05e999dd6e9
SHA512 4cc98b8fc418ed92f688d993e3fa0e68ef18a6a78e9b84f39fa509b67e4f52d1ef35019bbeea242be792339fe0faef97ac068b92349d1bd26932af3726c79268
TLSH
T1C3A002300FC320E28824426D434A3700042AF44A031380B2929582C2E804463CF20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TOIVEC.exe.bat

Path C:\Windows\System\TOIVEC.exe.bat
Size 72B
SHA256 7966ee42929d16e4330beb6e96fb81b31f2e9aefddd2c88c7eef68374abfdf6e
MD5 ab446e76f76ac3c31aff911fead8db5b
SHA1 9e35bb66a73d9c6e141f51ece6897710927a5dd7
SHA512 045a1a8efd1c2e379442fb3aca5d7e23f43bbf940b041ddd480c822eb5af7ef75e79841cf1eec00df62cadb130acfecbb310a4a2d65d39b9f0e2a497a82bd130
TLSH
T17AA002B02EC120E2A834686D436A37080C2AF4C303100020939500A2EACC4638E20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TPQUJRT.exe.bat

Path C:\Windows\System\TPQUJRT.exe.bat
Size 74B
SHA256 7525ce8628b0a03f3a7af9610c6b50f17b41bae2572f97ad69f938d4419316b5
MD5 52a1ee544816b8d91130425da88b87fa
SHA1 a9917e4f660ee170e6cf65eecc49987287d6189b
SHA512 80118193ef4dc8386a7904e23df9bae7ac574492bd9c801f3d9904f9b9e65207eb12bd05a45d27161a3438e2df426586ece131bc75bc37ec11667f0cac2bb95c
TLSH
T181A002382EF1F0E28824406D434A378004BEF44303308B2812B780C2EE864E3CE22AF8
MD5 SHA1 SHA512 TLSH

Submit Download

VBSHPB.exe.bat

Path C:\Windows\System\VBSHPB.exe.bat
Size 72B
SHA256 cb98a0dcb48cadfaef11a70eb6569f4b0e9ef644d32f23fea8459b7366b396ae
MD5 a9d3d090d36c1082050d0f5c6e9ea1d8
SHA1 84ea9b7ca6a00915a4ff34246bd648d3ebeefe08
SHA512 bdcea96a71717e17ec539d1185b95143d2ebac6e9a9f27aaf3ca0d9b49a1d8c10ae35d56badb80f28154b8b0856dbd5329afa69fabfd3aa95b9ca1831e8dfc5e
TLSH
T1C0A002300EC322F38824486F434EB720043AF443031002201A9D0082E00C4638EA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

VVG.exe.bat

Path C:\Windows\System\VVG.exe.bat
Size 66B
SHA256 6ac0a43c0c592519aba3c057ccf54cb5bb3077c1b5f341a06b150b25981751e2
MD5 faecb4f7e4cfb9d8001705202d6e7620
SHA1 8c88799535ceabe8f054a2d553371141f950b78d
SHA512 de7295cc4b996000a7373b8a1c4c459cc08f145b16b27481025aa94d083908d963ad1fb129850c46ddd78d40e65673d10135102e79e40e99fe650378dd4cfd5a
TLSH
T1B3A002308EC920E28C24406D43CAB700042EF44A03100AA812D5008BF0044638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

XBM.exe.bat

Path C:\Windows\System\XBM.exe.bat
Size 66B
SHA256 b1af64fb291e1e23d1a3154932682b09331a33da59b92898b6d04f505a278b75
MD5 59a7a430fa46d0969ed3cb5961ec4aa2
SHA1 6bc519e5790e33d4b615428169afa6c8f8fc91a1
SHA512 3364ac7fa17a563f4b48a9485293d3be132a4ceb9feee7877cab80fb1afc3692350269ef0a9624c85d9ff85a6dfc49802dba47b790269ae7f3d7ebe8c322835c
TLSH
T131A002300EC1A0E2882440ED4B4A3700243AF66AA31000301295A082E22467F8AA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

XBRPKR.exe.bat

Path C:\Windows\System\XBRPKR.exe.bat
Size 72B
SHA256 9f418582e0401966c6192cc422ff8f1b379b41fc2d063d6a98e0465e0547ebc1
MD5 59107fe7bf845ec7a82309ba1dd8eca6
SHA1 d4cb6ddaeaa205221532df9846d952ab82d92bea
SHA512 2587c05275a03de5221ebcb86247104496656349f997876cb12383078af8f49fece31c304563dae97eb451884bfc01c2e6769acb9b3ccafcc15755faa51a1c9f
TLSH
T175A002300EC122EA8A26406D436A3F002C2BF4CB8332803012950083E22C66B8AB08B8
MD5 SHA1 SHA512 TLSH

Submit Download

XBVNSDQ.exe.bat

Path C:\Windows\System\XBVNSDQ.exe.bat
Size 74B
SHA256 a2977f8d866ecba66624b1d942d3a07e95bfd68f91d9d717a3fbee08cc7ae4ae
MD5 276e084c4075cb114b3194954a7c3ff5
SHA1 d55cfe59510c44b76c0adafe29cbfc33086d5938
SHA512 6b376948671b117fab23fb9368e0862cbdae7719750a6ac862078228a5b921d03f9898e66fdc9c7c01e27e28890f2a7f79707b0e1f05e5b70497f68fd28f2fc9
TLSH
T164A002320EC12CE38CB4C06DC36B3700243EFF4A031800301A97208AF3246738BA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

XIX.exe

Path C:\Windows\System\XIX.exe
Size 208KB
SHA256 259de7005f27aabf04619122a4dcd6f440ff132d1a8b4f93c0b081357a2803ea
MD5 866cf6e85cf168940a981853a18ae7a3
SHA1 c65d6e643bb1e9a75cb862537038a9a2f10b54af
SHA512 3498b0fd1ce4fa6b12d1e0547200380968f05137b3edaca498a584214ee49acdf79a9d818d51be120bacb45c6a6ec91b80290a64f1a9bfb98108556d07adf7d6
SSDEEP 3072:BZ0izZaaiHSKd5ise4YF7gnQHf64ggdXEzz4pLthEjQT6j:BZyHSKHBeystdUPkEj1
TLSH
T1B724AE0275EC9429D4730B77E8D149A026E43C319F7B923B7E2473AFB4B17998453BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XIX.exe.bat

Path C:\Windows\System\XIX.exe.bat
Size 66B
SHA256 7e9fe7bbefe337548e0b7786606946ae2c0ffaeb72c99f74e1d9ba22eb392256
MD5 381075bda0694916ea25b374206aa45c
SHA1 da2e11ebeebe53a7989b659be30de9ddcd00b230
SHA512 ead1c68908bebda84a8b7635fcfcf84718676d7a289353720bd77eaea35d1465dbceb3d99b0d6c00db9aa3bad4ede4222563a259745c18a21f19bd0264971a0f
TLSH
T19CA002300EC120E28C24406F4B6A3700AC2AF4C28B1002F212970083E22466B8A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

XQZPDZ.exe.bat

Path C:\Windows\System\XQZPDZ.exe.bat
Size 72B
SHA256 9779b4db4ef01891b62784b41edd9663065eafc33c22b1824d140a4c1db4d3df
MD5 170389d8da79d72065dad2681371855e
SHA1 8edb9be31a61f1f4f0d80de45621a6fffcfc6c65
SHA512 9659742c272c03f84d2a9fd60935c911335a2a1c31a94a291133e74153d189a43ecd0b08117e91ca70a9dc2d154fc81770b5c0be5ad3b709479d7933b9c35d9b
TLSH
T181A00232AFC328E28AA442EF43CA3700242AF4420310003092952882E2246638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

XWZAPY.exe.bat

Path C:\Windows\System\XWZAPY.exe.bat
Size 72B
SHA256 2f78778015b78a8a153189fe4be69dab0bda2d10fcfa7cd3d35b0cc510ad0b9e
MD5 2c324cb501a059cbabcd3219ae428f48
SHA1 ecf634a3764dc6ccc786b1fcf0b72554d530b147
SHA512 09ca7432d3f3aaf39ea5c057b22c66e129a6df558449f639023f439efe2a11907ef595e9bb1b98c51c44ed0c7d5de17b75544e99bb5a2932e53a62090cd069f1
TLSH
T1C4A00230AEC128EA882440ED434A3F00242AF4620310203092952882E2246638EA0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

XZV.exe.bat

Path C:\Windows\System\XZV.exe.bat
Size 66B
SHA256 d851f4902b40d979df77411a446a6929ee4923492bef8615cd9509fcfa85def3
MD5 b3438a3937f16e17a737a2e335b07a67
SHA1 8cb2731ce270152f9115d777ce4dd48c32534275
SHA512 5d4966c3d1d4eb1e4dcc0706b4adb72d7b42e24b91187fe5dfafe325e122a87f308e649ffdedc1afd683d64d1f2d4ceadc95142479a1102333dc567eb19e9107
TLSH
T17DA002300EE120E28824C06D6F4A3700242AF6620310003032970082F2246EB8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

YIL.exe.bat

Path C:\Windows\System\YIL.exe.bat
Size 66B
SHA256 901eae6ef61840dca5f3c26b4d4b28de250f4137e63cff25af6a69ae12986310
MD5 e45861105dfe20e9d2ec0f62c87de4eb
SHA1 498e3bce9e708ce52f3eac5e0b1fcdebbe2c3b6d
SHA512 4887ef34f3041ed580d521ae6caccb572b9d129dbb9feca0bee2a76a5bbbb45f5c1cea2460229300638b4d077f1dcb0ef9bda78084003d397ad415384d336bc5
TLSH
T11AA002302EC120F28824C86D434A3700042EF6438310002212970083E0044638A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

YPCY.exe.bat

Path C:\Windows\System\YPCY.exe.bat
Size 68B
SHA256 a054fe5a2f632d86637f398ab0477bf8ee18c9f8d7f7dccd65d35653eb2a9e7f
MD5 4566837be3be1d031362618b2a491c5e
SHA1 083665c2e90821c5b96c3828e0622d3e10ad8a86
SHA512 a3764b0370abf12c96ca1e7514545ff6daf955c267cad8feb3c25dac5c35b864cc9e5f83797071d94b9d5af9c9f13a2f816f52b94e727f8b4dcbd854b3a930ab
TLSH
T19DA002B00EC120E28C26406D434E3700042EF6430B3000A0129D0082E004463AAE08F8
MD5 SHA1 SHA512 TLSH

Submit Download

ZZQ.exe.bat

Path C:\Windows\System\ZZQ.exe.bat
Size 66B
SHA256 ea66a2a5104a7d23304a95a29a10449e818878875946f44eb6d0a0af184b7476
MD5 952a58d9387c38679bb115205136d04f
SHA1 caf412fd912e95403428db9ca4215264d59b3a68
SHA512 3ce05cfd940e538b3994f2c9d8cfbe136f0bfa3fa88c750c988bf3d2aff631a7630ee7d388ea4b9567e75ac0430a4bfdd4aac824fcd95bda28b783962e0fc811
TLSH
T136A0023C0EC120E28C24426DE3CAB700042EF442031000301A97008AF006463AA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

TLFPEH.exe.bat

Path C:\Windows\TLFPEH.exe.bat
Size 58B
SHA256 05dae24bd86ad9abf4bb572c5fbb8bd2aa11e643fbd5a4982ab21a662eca9cb3
MD5 bf54ab030645c116292a28c42560fd40
SHA1 9a8d3d18103230cb4506e2684add5ccf478a2ae6
SHA512 b15b1cf0a0e95ec221dec5b5e749b1f3c93609a55d3b726f1a0961b854bff881646ca58fd793c24f7cb81cfe81c91d22d4bbf2b6a58222603b0d812a338edb65
TLSH
T154A002B03AC120C88837404943CA3728040AF460A290002013152C8062E4CE380A00B0
MD5 SHA1 SHA512 TLSH

Submit Download

TRGYSI.exe.bat

Path C:\Windows\TRGYSI.exe.bat
Size 58B
SHA256 029c34464269ef9eaddf8f33c9d02ed2184277a35544394f064bac6c2885039b
MD5 adf5e03ac3f180547557816eba12a649
SHA1 1cac06004dfd0e492c164ff76c8f002d8569c000
SHA512 d98162d4cac7ee070423ac92d9cc72326425e42210b6f330b1c3bf8f53d25fded47b74136a429980dd0becbd41d38482952ba84878bbeaf938e2f8f2a5c02ac6
MD5 SHA1 SHA512

Submit Download

ULV.exe.bat

Path C:\Windows\ULV.exe.bat
Size 52B
SHA256 be0998f59aa9656bbf319dbf30762be2adfe2ade4a1e49881f09dbf088b564b5
MD5 4c0ea2138a594cdd7e45a0b764a1916e
SHA1 49f32c9c9fae6cd86b8a5cd26dde0f58d4bb2570
SHA512 175093c9e2c017491ae757193e59a81a52ebc6e5ab1aeb472da58db26cd9558e36ca456c97cc367c737aba7ebd061217c0a4817a0fc1337ff674189c13b09566
MD5 SHA1 SHA512

Submit Download

URLV.exe.bat

Path C:\Windows\URLV.exe.bat
Size 54B
SHA256 a1d9ed777393c06830e8839b58381f79fadaeb39bbccf9a400485b59f935ac7a
MD5 5802841c87d893ac9229b5d6ba5c768c
SHA1 f5d12bfe64dcaefb097c439f1c95b02f8cb5225c
SHA512 e31833b6660c344601c9cec6ffbdfc49a041588accbb31833d4f64273a26a3d13ed44f772497cc90ac9b730bb347781a7c30baa33c995f65ac3dce72df789650
MD5 SHA1 SHA512

Submit Download

UYSNGOZ.exe.bat

Path C:\Windows\UYSNGOZ.exe.bat
Size 60B
SHA256 7849e2d0cd5033cb54901becf823d315ea914fd7b08c9ba78761c095367d5478
MD5 501f5e782676094251810a2d0c528c91
SHA1 ba65d519df29178a1b69900edc99b5f3b6e8722c
SHA512 1c2db900a69d09ce7c5f1b5914c263ac0fb88eca93f817030740956af0ed50e65c52bd555310567273c4209db9b9a181ce8801c90fd6ac71c715de6643e9aa60
TLSH
T143A002330AC33AC08C34404D436AB728048BF7420393000212378082600C44B80008BC
MD5 SHA1 SHA512 TLSH

Submit Download

VWT.exe.bat

Path C:\Windows\VWT.exe.bat
Size 52B
SHA256 0840778585fbff61a5dea550be9eaf9e4ceece6d8adb7892b8661307e87238c5
MD5 f0b562d5eb9864922497319a368e0fa2
SHA1 8c9bf372a9d73caccc63455b3d9ce28309702299
SHA512 e1e30d2410ffca38d91e0456a066e21cd93e1357591b4ebd8a6c343507dd56298da78dfa5f0f9da1d6fdaa3a3c70ec4d4439bb576a46004a13d38291a65ef017
MD5 SHA1 SHA512

Submit Download

WCSBTO.exe.bat

Path C:\Windows\WCSBTO.exe.bat
Size 58B
SHA256 4db0240396845d022ac73f7da28c082b25b4f7c262020ba14c827a69c7d78d9d
MD5 c40e1444bffcace041789f63ba1c66c5
SHA1 0b8fb43aec2c5e7c59a982a8250618b7bb750e76
SHA512 41abd11e052396d41aebabebf0ab7fbf6ecd42649c7f8c98bcc209e0d985d4483b6916af2e5e63961af03c8659c80ff46cc2d0d5dbeb8d5aa58084e55faf9b3f
MD5 SHA1 SHA512

Submit Download

WXJRLPA.exe.bat

Path C:\Windows\WXJRLPA.exe.bat
Size 60B
SHA256 32b3ce9d8bdbe16ef318b023d96382aad3a629dd340d11c22b81e1446bb78cee
MD5 36a813a1ed41c957178a1c15cd49c9fe
SHA1 2b78fe9de7fa8240cbd1b987d53c67b3c3f7e505
SHA512 b07a07bc7dc32c902bc48917bb027d0ce19fb560dd79189cfcf9a4f613aa6d97553b5f7019e8a0da1637d651e0407e99157ab40b0315e37189be0ba8cca9d0ad
TLSH
T1D3A002B088C1A2C0882C424B43CA37280C0BF44302120200D33D00A0FA074C382880B2
MD5 SHA1 SHA512 TLSH

Submit Download

XCF.exe.bat

Path C:\Windows\XCF.exe.bat
Size 52B
SHA256 6a50871e0bc47a9f08d6356b866861e17f285a54ac40fdd103160a94d814f147
MD5 9b3521be33c7398b777e7f1ed552e790
SHA1 66b02f1a5dfd26127e9684301efceaaf1f3e2641
SHA512 0802c46050e1fd346f365f56f3f40599eca47d8e9971202dfc4e250ede06b1879d57b9d5f59807bb31e4248a8ad93a78779338d40e16ca4e0f0d1fac39b11c97
MD5 SHA1 SHA512

Submit Download

XWJZUC.exe.bat

Path C:\Windows\XWJZUC.exe.bat
Size 58B
SHA256 4d8a15c0afe8405ac0787a8c0441a72b853c28a9aad15c0101d95108ccf2d106
MD5 ee9399408d583a6b79f384160c7203aa
SHA1 b3c52e791baf4dd2ea7a5085096c07f15fea80ee
SHA512 b5c960324f5a3fc3343d03166201507e295052ab687912c591c699cecc55a9f6a258714b9959efa708f0f17832cb3fb0cf8209c33419c7be3379a98c1842d6ff
MD5 SHA1 SHA512

Submit Download

YMGQVU.exe.bat

Path C:\Windows\YMGQVU.exe.bat
Size 58B
SHA256 231fac4e394bd2e30e132f1d2bdb7944b9c1b6efc5e8b80dadeb4721f5b58933
MD5 104b282b51ff8085a8b71d3f2a84ba78
SHA1 df763eab342b334084d2ff0d66ab20400bde8af1
SHA512 f7dff0eed11d7fa366e11433d51e5ba8e6825448210f22bed659cf7c9ee734ba895c249921852c14c5f8541ff401839bb239d28a478860c4ed3f2637e93d3dd8
MD5 SHA1 SHA512

Submit Download

YPH.exe.bat

Path C:\Windows\YPH.exe.bat
Size 52B
SHA256 61b44dddc09d6aa8b5e72a230197b7e76c70db00bc5a8e26a1e1130cac667ba0
MD5 27ddb9fe438dfd5ca4fead243488e8f5
SHA1 f63b768073948adfc26880abb54f3393cc96aaf3
SHA512 f8164f165cff8174ac7f52f4592e505a89c11d389186f7015de335bb2d6d84a39411024ac3c47ef205e14e30579d00d2599242620af0f6f017567e8d2cf21c72
MD5 SHA1 SHA512

Submit Download

ZKXYQJX.exe.bat

Path C:\Windows\ZKXYQJX.exe.bat
Size 60B
SHA256 affa846019ffcb86f6455fac74e805a7337fa852c09a3bcfd94ebd947ec56be4
MD5 4b7c767eaf5e4943df26aa69249336c2
SHA1 38313dfc69cabe5bfcf2b6b76655fcd89ce52c33
SHA512 91420c8a9f6ea1dd03f4c6aa056f776ec344c107bad1a4d19440f334cf4b8e599fc839228b16aacabf5a12237599c1dffe3ae2ce796ab72b7ed67ad39c501319
MD5 SHA1 SHA512

Submit Download

ZRO.exe.bat

Path C:\Windows\ZRO.exe.bat
Size 52B
SHA256 c9125a87cd309e840cffd9964b063d2ad4e772dbe87a607c2c03ccebc72183ad
MD5 2d7a0c5e0420dfc1c0a9cb6554667fc0
SHA1 9318bd465da67b4fb567ab5a6aa4f4ddd5fce8a3
SHA512 c1aeb7503cd826a036659171ee79f3472f7b2bacc05f092c70589f9f6806f35e5e40c0d2bac14d0c0975164c014853467427cd1e9a9876f2f90feaf68adc280a
MD5 SHA1 SHA512

Submit Download

GYTL.exe

Path C:\windows\GYTL.exe
Size 208KB
SHA256 9756ed02ec8a31f0c6e926b90f9d54049d24350fdf2b28d708e4456a92dadfdb
MD5 643ed5d697b83e147bf5f4e50696585f
SHA1 e73b22dcada0a610fd1fe131debc7dc8a1e42bb9
SHA512 40b995ca4e526a84a77c7756c74231de9182bbafac0fd274b14ba8814194677eb12fd2596d087e773945d29218e13a7f4c5e77d204d6d6d31bbc4fa0623f1795
SSDEEP 3072:30gYb1NUS3XNSV1FnpJy4P4TeIjOvXxwXhi39nca39r4oINAFvK7zBiUSxBLY4pC:3u0kQfr1uhi39cc9soI9QYkEj1
TLSH
T1D9248DD477A4F126D4B31734C9EBD6A05A69FC529FA1833BBB84738E5D30A9009F0B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OJGFKLF.exe

Path C:\windows\OJGFKLF.exe
Size 208KB
SHA256 2a4105a2330802557253b55018f8ddf442f2f1ac0e41c2c51ac0c055d1521e22
MD5 be2cf7b31ee8bf9417cb79fcdc5b63fe
SHA1 1cb677eeca279914bed7350bf27ff4743abc9295
SHA512 cf30b9a9d693e903eee64f275702c1c0928c238fe122b0d0a02b1f61179239939a6ff388e4bb71ff638ebcadb040d71eb694c7265f72fdd337e52a05e0c725a8
SSDEEP 6144:C3DSxvc4wN0Xz+kwn8nNfkXqk3dK6ntkEj1:Fx07N0j+GGq6tkC
TLSH
T184249C09BE90D4A2E377273564F596E40A75FD52AFFF020B3990B75F2A722664821F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUFP.exe

Path C:\windows\SUFP.exe
Size 208KB
SHA256 2df3141ef79507ff7b9252db76600d6b105f624ce88085c99dabd6513063fd0d
MD5 0a6f0749f541eb065f90d39c846dbac3
SHA1 f73ca5b804f336c0e6d4afe4636c5670f910c336
SHA512 4ef994d1814318b589fe4e9572da96d299e5ca13cb2152554d6d308897f89c145ad7d47eb547227a582c91e47b2ad3ee57d069bd40fe6d3c130ffd897f39b043
SSDEEP 3072:GmVncV1d8GUqXoJ6kXNKE8hWmc9NPvRvbY6wChjxny4pLthEjQT6j:mJPUqtkdOhWmc9NnRvc6lh9ykEj1
TLSH
T1D824AE1578759B0AC4D3123C9AE092D83FB9BC11EF354B2B678837AF157125E4F0AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TRGYSI.exe

Path C:\windows\TRGYSI.exe
Size 208KB
SHA256 ec6b748fa19311870d201752fe8f5cf18d95ff1f20abaa2ff0dbb0062cbecb6e
MD5 877eb29fe484ad25f5980db099afdf42
SHA1 2b008ab8ebc0021372da0e68c8abb94670e02d08
SHA512 9e2750d0dae37421901639d667c6bf4e7742b1d3e0a2e641a5583cfa5169fcea2f05b42a378912e028f297314d1ba1818de26ed0fe1795a466da2161297e44ff
SSDEEP 3072:prAS3Io1RuF9uqAiYbRd/pXlJWPBF83vUiQMCN71mCWUy44pLthEjQT6j:1YovufuFiYbRd/nSiK71mCLzkEj1
TLSH
T151248D727185C4A3C27726344AF3CF5446B7BE52AFA09B2F28D0B72DC9333419A66794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZKXYQJX.exe

Path C:\windows\ZKXYQJX.exe
Size 208KB
SHA256 0590aaa497d2e3ccca08e5c8c5dee28edf568a280052c480f9de1b2b728a26bc
MD5 0c1900ddba334dd3691ca4529ac34cb1
SHA1 56ad0dc789e9432a640035529ace9d5949fa803a
SHA512 22f15636dfaab33b16df279c88df0f76d334899e9c304e71f3590952d2cab1b231dbc422e50a3aff1648bfacaca80f93a85f2c596fd44d7ce493d1f50f3e9bf9
SSDEEP 3072:tWameMtVINoqIb4bxe405ePV5MUs3QI5Er1LIkGoMxo1l4pLthEjQT6j:tWIgalIb4NPLPPHI5ErbfMW1lkEj1
TLSH
T164248E10B7E0C592D467123848F2DB68A676BC48EF27DB4F3A4C770FA9F168109B5672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AKSQQLB.exe

Path C:\windows\system\AKSQQLB.exe
Size 208KB
SHA256 36b2833fcdcf217eaa8ff2a650a03e5d913a287436c248b9f74996451dc2b2b4
MD5 576c9a96c31decc4a53b73032da6d6c1
SHA1 279499dc8320b1b8906a9db613b7fb745a730485
SHA512 b0c3ab88eae6c39401b26977dffa23572fdc436102dcbd594d701485ec65f20cf5b8a08b4e2b98fb41af640dcb9e841ff06120cec6e73c9f07c36f6fe7d13954
SSDEEP 3072:RhWzi7s/Jkug/mBHRasCyKY11vW20ALoE5NPp5+T2WM/2M4pLthEjQT6j:RhYSJ/mlMWKY11exE5Bp5+aW6kEj1
TLSH
T1B6248E02B1C0D89BD9B316700AF396949A7EFC31EB63811FB240772EEC36BA54A71755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AME.exe

Path C:\windows\system\AME.exe
Size 208KB
SHA256 eddf4d7386c2f48ae79ab904b99deea5cf50522215867266f5cebfb25ad37644
MD5 5166c5dab2a23f83cff0d761579d0894
SHA1 66bc23ca2a68eaa72c14013113d3141481687dc6
SHA512 f7314da7be9ebfae684b31d60aec2562c8d270926eac7676399e2f8d414faec64a335ccdc445ca8c45eb87e4de486be651d375209dfb87763245120f1cfcd8f8
SSDEEP 3072:vsBnMyw0ONKDNFvx5qFcUpV68rUL6wLR+9z6pby6d4pLthEjQT6j:vxYN75/yVwL6wLIzEW6dkEj1
TLSH
T128249DC973AACA43D05B2B384CD759E065B8BC73AFA5814BBB04F39F28315A944B1771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EYAWBQB.exe

Path C:\windows\system\EYAWBQB.exe
Size 208KB
SHA256 056362d7f2e4fa6cb967a1f8266ea729a5194272f3cfcafa8dd3e082e45716e7
MD5 bce8c61ae66dd6ffb3b5dfd4d144ef27
SHA1 0054dca1e1646437fde55f7de5000bb616b94df4
SHA512 cf9748e1a38b2776a0fc4d40d79c4ee80d697e222a099e97d6c644c28ea173d96aee2ded7aa18166c30578a3db0bd6b23620ee013d03434fcd7895cf59869177
SSDEEP 3072:Cqd+x6cFwhq5N+od/mBi3+/x6M32m80FqkeiV7AuEfDLTNabu4pLthEjQT6j:N+kcF65KuBo+MMwzkCkEj1
TLSH
T1A4248B413B91CD47F03752F0D8E687AC59BBBC0BBB61536BA5687B1D28F13288C26391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LYZGAM.exe

Path C:\windows\system\LYZGAM.exe
Size 208KB
SHA256 fc000a352eddbb8d58a529c1b5dc3d490535611ac70d1c9fb3a6035ce27de7eb
MD5 df6418d89215079df3a2fef3284af6ce
SHA1 a39f5486982a788e3fcd06c596656b69eff3258d
SHA512 b3ecb16151e4a3afce14f8a59aced85947e2da1052586ad91382cddca3dbc207ceb6c4ee23418e3d78395e3a18795209e710d10fb953c2851197768f1eead451
SSDEEP 3072:jkEGEGL6astBidwE3xjVMYG9Rbr59pQZO8ijI7GlUhT2J4pLthEjQT6j:jkEGEqddA/pQZOJjI7Gl9JkEj1
TLSH
T110249D62B071DA8AE8970B345CF6D3EA35B57DA0DBAD832B3954735F00723544E06BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIWRRAS.exe

Path C:\windows\system\MIWRRAS.exe
Size 208KB
SHA256 72c2516bb55b7d95c49d708396c4be29f2f4affedb81c5a180df4067bfdbd9f0
MD5 ceadca7e49ae75a74febcae965d08c6b
SHA1 5cf6d231df91842306f28f61493c9f4a0348d1a4
SHA512 27032d73eab3693e0afeab71a5ce8b370ae23e0091456e8d5bbe7c84f10451437b9d5feea238027b34a95dbaedde376a7b06e0f779ad45036845711d0cddec1d
SSDEEP 3072:DQLWulLf3oP0xWmtYWoxWAZXV6r1IfiujCb2Zgz4NeMR4nod0WDf4pLthEjQT6j:SDoGtQx/ZXVFfiiCbygM7R4no6WTkEj1
TLSH
T1E6246C477596C4C6D06312344CE6C3641E76BC22AF7182B7B9E933BE6E79264CCA1363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-260-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/120-291-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/952-98-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1072-375-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1180-400-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1180-386-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1444-102-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1792-199-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1792-177-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1796-234-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1796-198-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1860-220-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1860-240-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2036-362-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2076-184-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2076-165-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2312-104-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2312-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2420-355-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2420-347-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2484-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2484-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2700-425-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2700-398-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2816-73-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2816-89-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2908-266-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2908-256-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2920-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2920-118-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2976-133-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2976-155-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3100-317-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3100-289-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3124-78-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3124-66-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3316-101-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3408-180-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3408-136-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3960-261-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3960-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3968-423-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4188-99-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4244-303-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4244-286-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-204-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-182-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4436-75-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4440-236-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4440-242-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4576-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4576-74-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4672-449-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4712-77-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4712-31-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4744-422-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4776-360-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-227-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4936-448-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4948-354-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4948-316-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4964-356-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4964-361-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5080-241-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5080-231-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5212-424-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5212-399-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5280-292-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5280-258-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5480-447-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5480-421-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5572-373-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5620-357-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5696-358-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5696-350-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5768-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5768-32-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-90-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5800-183-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5800-150-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5808-237-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5808-203-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5840-359-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5840-352-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5908-95-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5908-100-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5916-387-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5916-374-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5956-315-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5956-353-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5972-440-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5988-314-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5988-351-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6056-318-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6056-290-0x0000000000400000-0x0000000000438000-memory.dmp

Download