5881d8f9da38b8cbf7771afe92bebc0664fc9a313b1505fd6cca592dcba59c5e

Analysis

max time kernel
32s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
Size 208KB
Sample260730-fps9lazelh
SHA256 5881d8f9da38b8cbf7771afe92bebc0664fc9a313b1505fd6cca592dcba59c5e
MD5 b41cbaaf83f8cb8f4af7f46197176170
SHA1 b516d482b4a241cefcc9fc19595b8b6cba81b0f7
SHA512 dd121dddb3ecae6374e256288ef3473124c9f88204c5a932294fe78b1e8eee0f8664e4d528b6d35daf58ad15bded1c86e11c8a1bcbda00346addfe02adb75427
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+cOfF4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+cONkEj1
TLSH
T1C1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1468	VABXAI.exe
4692	BTFM.exe
5208	VABXAI.exe
4256	STTRIMS.exe
2684	GTBO.exe
808	BTFM.exe
3456	UBI.exe
2288	STTRIMS.exe
3380	GTBO.exe
4800	MCFM.exe
1280	UBI.exe
1532	HKNJF.exe
4420	PVWCTO.exe
4532	MCFM.exe
3316	MLK.exe
2732	PVWCTO.exe
4412	HKNJF.exe
5320	HIWHLW.exe
5076	MLK.exe
2692	IRESCLQ.exe
2448	HIWHLW.exe
2584	BSUDLMZ.exe
4732	DXZWN.exe
2816	IRESCLQ.exe
5968	ZCLZYNV.exe
6064	DXZWN.exe
2940	BSUDLMZ.exe
6128	UFU.exe
5620	ZCLZYNV.exe
1876	OWRB.exe
4880	UFU.exe
5900	SEYCBY.exe
2540	EBIAJXJ.exe
2372	OWRB.exe
6140	ZJRXQKE.exe
1520	EBIAJXJ.exe
2004	SEYCBY.exe
3128	BMAFVZF.exe
4280	ZJRXQKE.exe
6052	QCUDH.exe
5128	QAFLLE.exe
4680	BMAFVZF.exe
5520	TIAABK.exe
3732	QAFLLE.exe
4840	QCUDH.exe
632	NOIZMQJ.exe
4996	TIAABK.exe
4624	BBFVNVW.exe
2060	XZSY.exe
556	NECAXTS.exe
4592	OXXC.exe
5632	NOIZMQJ.exe
4224	BBFVNVW.exe
3856	CUKGIC.exe
3544	MMX.exe
4952	RFTRFLB.exe
3340	XZSY.exe
3432	OXXC.exe
52	NECAXTS.exe
1256	CUKGIC.exe
4536	RFTRFLB.exe
2844	MMX.exe
5700	NBOVCHE.exe
1616	QBJUWK.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cc19d66 = "C:\\windows\\system\\BTFM.exe"	BTFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\463d21a4 = "C:\\windows\\SysWOW64\\NOIZMQJ.exe"	NOIZMQJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1926ad86 = "C:\\windows\\SysWOW64\\MMX.exe"	MMX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a3b32c61 = "C:\\windows\\TAJRP.exe"	TAJRP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\be11cf9e = "C:\\windows\\SysWOW64\\NECAXTS.exe"	NECAXTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b4c59bc2 = "C:\\windows\\system\\MCFM.exe"	MCFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fad8d838 = "C:\\windows\\system\\PVWCTO.exe"	PVWCTO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\afe9fc12 = "C:\\windows\\system\\SEYCBY.exe"	SEYCBY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\168a6235 = "C:\\windows\\system\\XZSY.exe"	XZSY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7721dddd = "C:\\windows\\SysWOW64\\NBOVCHE.exe"	NBOVCHE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\4d2d3eb1 = "C:\\windows\\system\\PJX.exe"	PJX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\86a43abc = "C:\\windows\\ZCLZYNV.exe"	ZCLZYNV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9e819fbe = "C:\\windows\\UFU.exe"	UFU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e819fbe = "C:\\windows\\UFU.exe"	UFU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b28125c3 = "C:\\windows\\ZJRXQKE.exe"	ZJRXQKE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\494d7996 = "C:\\windows\\SysWOW64\\BMAFVZF.exe"	BMAFVZF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a60c339e = "C:\\windows\\system\\BBFVNVW.exe"	BBFVNVW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2ef9ded1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe"	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a5e0d649 = "C:\\windows\\HIWHLW.exe"	HIWHLW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\10ce24ca = "C:\\windows\\SysWOW64\\OWRB.exe"	OWRB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\10ce24ca = "C:\\windows\\SysWOW64\\OWRB.exe"	OWRB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\168a6235 = "C:\\windows\\system\\XZSY.exe"	XZSY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\16b0194c = "C:\\windows\\SysWOW64\\RFTRFLB.exe"	RFTRFLB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\10ce24ca = "C:\\windows\\SysWOW64\\OWRB.exe"	OWRB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b28125c3 = "C:\\windows\\ZJRXQKE.exe"	ZJRXQKE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\494d7996 = "C:\\windows\\SysWOW64\\BMAFVZF.exe"	BMAFVZF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\463d21a4 = "C:\\windows\\SysWOW64\\NOIZMQJ.exe"	NOIZMQJ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\81c1619a = "C:\\windows\\SysWOW64\\CUKGIC.exe"	CUKGIC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\494d7996 = "C:\\windows\\SysWOW64\\BMAFVZF.exe"	BMAFVZF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\1926ad86 = "C:\\windows\\SysWOW64\\MMX.exe"	MMX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\88ab9dac = "C:\\windows\\ZCIYA.exe"	ZCIYA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\da2c21d3 = "C:\\windows\\VABXAI.exe"	VABXAI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\18aab59c = "C:\\windows\\system\\BSUDLMZ.exe"	BSUDLMZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\b28125c3 = "C:\\windows\\ZJRXQKE.exe"	ZJRXQKE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a60c339e = "C:\\windows\\system\\BBFVNVW.exe"	BBFVNVW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\42c4fb73 = "C:\\windows\\QCUDH.exe"	QCUDH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\81fb0eac = "C:\\windows\\system\\HKNJF.exe"	HKNJF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f24dea4 = "C:\\windows\\system\\EBIAJXJ.exe"	EBIAJXJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5abc934 = "C:\\windows\\TIAABK.exe"	TIAABK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\923dec0c = "C:\\windows\\system\\TWAWQDM.exe"	TWAWQDM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7721dddd = "C:\\windows\\SysWOW64\\NBOVCHE.exe"	NBOVCHE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\88ab9dac = "C:\\windows\\ZCIYA.exe"	ZCIYA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\3a6d64d6 = "C:\\windows\\MLK.exe"	MLK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18aab59c = "C:\\windows\\system\\BSUDLMZ.exe"	BSUDLMZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cc19d66 = "C:\\windows\\system\\BTFM.exe"	BTFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9b06fbe0 = "C:\\windows\\SysWOW64\\STTRIMS.exe"	STTRIMS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2f24dea4 = "C:\\windows\\system\\EBIAJXJ.exe"	EBIAJXJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4d2d3eb1 = "C:\\windows\\system\\PJX.exe"	PJX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\19ad39ff = "C:\\windows\\WPDFHGW.exe"	WPDFHGW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\24c512d6 = "C:\\windows\\GTBO.exe"	GTBO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\81fb0eac = "C:\\windows\\system\\HKNJF.exe"	HKNJF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3a6d64d6 = "C:\\windows\\MLK.exe"	MLK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\27257cf3 = "C:\\windows\\IRESCLQ.exe"	IRESCLQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\9f709375 = "C:\\windows\\SysWOW64\\DXZWN.exe"	DXZWN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18aab59c = "C:\\windows\\system\\BSUDLMZ.exe"	BSUDLMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f32b47e5 = "C:\\windows\\system\\QBJUWK.exe"	QBJUWK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4d2d3eb1 = "C:\\windows\\system\\PJX.exe"	PJX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\be11cf9e = "C:\\windows\\SysWOW64\\NECAXTS.exe"	NECAXTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\24c512d6 = "C:\\windows\\GTBO.exe"	GTBO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\42c4fb73 = "C:\\windows\\QCUDH.exe"	QCUDH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\b5c2157d = "C:\\windows\\QAFLLE.exe"	QAFLLE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\be11cf9e = "C:\\windows\\SysWOW64\\NECAXTS.exe"	NECAXTS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\923dec0c = "C:\\windows\\system\\TWAWQDM.exe"	TWAWQDM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\24c512d6 = "C:\\windows\\GTBO.exe"	GTBO.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\DXZWN.exe	HIWHLW.exe
File created	C:\windows\SysWOW64\BMAFVZF.exe	OWRB.exe
File created	C:\windows\SysWOW64\NOIZMQJ.exe	QAFLLE.exe
File created	C:\windows\SysWOW64\RFTRFLB.exe	NECAXTS.exe
File opened for modification	C:\windows\SysWOW64\MMX.exe	OXXC.exe
File created	C:\windows\SysWOW64\SWCUM.exe	OGVUAAV.exe
File created	C:\windows\SysWOW64\KWQAZ.exe	SWCUM.exe
File opened for modification	C:\windows\SysWOW64\STTRIMS.exe	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
File opened for modification	C:\windows\SysWOW64\DXZWN.exe	HIWHLW.exe
File opened for modification	C:\windows\SysWOW64\OWRB.exe	ZCLZYNV.exe
File created	C:\windows\SysWOW64\NOIZMQJ.exe.bat	QAFLLE.exe
File created	C:\windows\SysWOW64\NECAXTS.exe	TIAABK.exe
File created	C:\windows\SysWOW64\MMX.exe	OXXC.exe
File opened for modification	C:\windows\SysWOW64\NBOVCHE.exe	RFTRFLB.exe
File created	C:\windows\SysWOW64\DXZWN.exe.bat	HIWHLW.exe
File opened for modification	C:\windows\SysWOW64\RFTRFLB.exe	NECAXTS.exe
File created	C:\windows\SysWOW64\STTRIMS.exe	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\STTRIMS.exe.bat	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\OWRB.exe	ZCLZYNV.exe
File created	C:\windows\SysWOW64\OWRB.exe.bat	ZCLZYNV.exe
File created	C:\windows\SysWOW64\CUKGIC.exe	XZSY.exe
File created	C:\windows\SysWOW64\RFTRFLB.exe.bat	NECAXTS.exe
File opened for modification	C:\windows\SysWOW64\SWCUM.exe	OGVUAAV.exe
File opened for modification	C:\windows\SysWOW64\BMAFVZF.exe	OWRB.exe
File opened for modification	C:\windows\SysWOW64\NECAXTS.exe	TIAABK.exe
File opened for modification	C:\windows\SysWOW64\CUKGIC.exe	XZSY.exe
File created	C:\windows\SysWOW64\SWCUM.exe.bat	OGVUAAV.exe
File opened for modification	C:\windows\SysWOW64\NOIZMQJ.exe	QAFLLE.exe
File opened for modification	C:\windows\SysWOW64\KWQAZ.exe	SWCUM.exe
File created	C:\windows\SysWOW64\KWQAZ.exe.bat	SWCUM.exe
File created	C:\windows\SysWOW64\BMAFVZF.exe.bat	OWRB.exe
File created	C:\windows\SysWOW64\NECAXTS.exe.bat	TIAABK.exe
File created	C:\windows\SysWOW64\CUKGIC.exe.bat	XZSY.exe
File created	C:\windows\SysWOW64\MMX.exe.bat	OXXC.exe
File created	C:\windows\SysWOW64\NBOVCHE.exe.bat	RFTRFLB.exe
File created	C:\windows\SysWOW64\NBOVCHE.exe	RFTRFLB.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\windows\system\HKNJF.exe.bat	MCFM.exe
File opened for modification	C:\windows\HIWHLW.exe	MLK.exe
File opened for modification	C:\windows\system\BSUDLMZ.exe	IRESCLQ.exe
File created	C:\windows\system\EBIAJXJ.exe.bat	UFU.exe
File created	C:\windows\system\QBJUWK.exe.bat	MMX.exe
File opened for modification	C:\windows\WPDFHGW.exe	NBOVCHE.exe
File opened for modification	C:\windows\system\OGVUAAV.exe	TAJRP.exe
File created	C:\windows\UFU.exe.bat	IRESCLQ.exe
File opened for modification	C:\windows\system\BBFVNVW.exe	QCUDH.exe
File created	C:\windows\TAJRP.exe	WPDFHGW.exe
File created	C:\windows\system\BSUDLMZ.exe.bat	IRESCLQ.exe
File created	C:\windows\system\SEYCBY.exe.bat	OWRB.exe
File created	C:\windows\TIAABK.exe.bat	QCUDH.exe
File created	C:\windows\TAJRP.exe.bat	WPDFHGW.exe
File opened for modification	C:\windows\system\UBI.exe	STTRIMS.exe
File created	C:\windows\MLK.exe	HKNJF.exe
File created	C:\windows\UFU.exe	IRESCLQ.exe
File opened for modification	C:\windows\system\EBIAJXJ.exe	UFU.exe
File opened for modification	C:\windows\ZJRXQKE.exe	EBIAJXJ.exe
File opened for modification	C:\windows\system\XZSY.exe	NOIZMQJ.exe
File created	C:\windows\system\OXXC.exe	BBFVNVW.exe
File opened for modification	C:\windows\ZCIYA.exe	QBJUWK.exe
File created	C:\windows\system\UBI.exe	STTRIMS.exe
File opened for modification	C:\windows\system\HKNJF.exe	MCFM.exe
File opened for modification	C:\windows\IRESCLQ.exe	MLK.exe
File opened for modification	C:\windows\QCUDH.exe	SEYCBY.exe
File opened for modification	C:\windows\QAFLLE.exe	BMAFVZF.exe
File created	C:\windows\system\PJX.exe.bat	QBJUWK.exe
File created	C:\windows\ZCIYA.exe.bat	QBJUWK.exe
File created	C:\windows\system\OGVUAAV.exe.bat	TAJRP.exe
File created	C:\windows\GTBO.exe	BTFM.exe
File created	C:\windows\IRESCLQ.exe.bat	MLK.exe
File opened for modification	C:\windows\UFU.exe	IRESCLQ.exe
File created	C:\windows\ZJRXQKE.exe.bat	EBIAJXJ.exe
File created	C:\windows\QCUDH.exe.bat	SEYCBY.exe
File created	C:\windows\TIAABK.exe	QCUDH.exe
File created	C:\windows\QAFLLE.exe.bat	BMAFVZF.exe
File created	C:\windows\system\QBJUWK.exe	MMX.exe
File created	C:\windows\system\PVWCTO.exe	UBI.exe
File created	C:\windows\system\BBFVNVW.exe	QCUDH.exe
File opened for modification	C:\windows\system\QBJUWK.exe	MMX.exe
File created	C:\windows\system\TWAWQDM.exe	NBOVCHE.exe
File created	C:\windows\WPDFHGW.exe	NBOVCHE.exe
File opened for modification	C:\windows\system\PVWCTO.exe	UBI.exe
File created	C:\windows\HIWHLW.exe	MLK.exe
File created	C:\windows\IRESCLQ.exe	MLK.exe
File created	C:\windows\system\SEYCBY.exe	OWRB.exe
File created	C:\windows\system\OGVUAAV.exe	TAJRP.exe
File created	C:\windows\system\MCFM.exe.bat	UBI.exe
File opened for modification	C:\windows\ZCLZYNV.exe	DXZWN.exe
File created	C:\windows\system\EBIAJXJ.exe	UFU.exe
File opened for modification	C:\windows\GZYB.exe	TAJRP.exe
File created	C:\windows\system\PVWCTO.exe.bat	UBI.exe
File created	C:\windows\system\OXXC.exe.bat	BBFVNVW.exe
File opened for modification	C:\windows\system\PJX.exe	QBJUWK.exe
File created	C:\windows\system\MCFM.exe	UBI.exe
File created	C:\windows\system\BTFM.exe	VABXAI.exe
File created	C:\windows\system\UBI.exe.bat	STTRIMS.exe
File created	C:\windows\QAFLLE.exe	BMAFVZF.exe
File created	C:\windows\system\XZSY.exe	NOIZMQJ.exe
File created	C:\windows\system\PJX.exe	QBJUWK.exe
File created	C:\windows\system\HKNJF.exe	MCFM.exe
File opened for modification	C:\windows\MLK.exe	HKNJF.exe
File opened for modification	C:\windows\system\SEYCBY.exe	OWRB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1768	cmd.exe
4664	cmd.exe
1872	cmd.exe
6252	cmd.exe
1716	cmd.exe
5848	Process not Found
6604	Process not Found
6380	cmd.exe
2604	cmd.exe
6368	cmd.exe
2000	cmd.exe
4468	cmd.exe
4608	cmd.exe
6424	Process not Found
6672	Process not Found
1436	cmd.exe
836	cmd.exe
5944	cmd.exe
6464	cmd.exe
4720	Process not Found
1516	cmd.exe
3012	cmd.exe
1664	cmd.exe
4388	cmd.exe
6644	cmd.exe
5556	Process not Found
1224	Process not Found
4784	Process not Found
3844	cmd.exe
5544	Process not Found
5004	Process not Found
6284	Process not Found
2424	cmd.exe
5384	cmd.exe
6872	cmd.exe
5776	cmd.exe
5176	cmd.exe
3180	Process not Found
4320	cmd.exe
2024	cmd.exe
5648	cmd.exe
6012	cmd.exe
2624	cmd.exe
6316	Process not Found
1180	cmd.exe
6004	cmd.exe
3216	cmd.exe
1052	cmd.exe
2312	cmd.exe
4884	cmd.exe
2636	cmd.exe
5328	cmd.exe
716	cmd.exe
4284	cmd.exe
3636	cmd.exe
7140	Process not Found
6556	Process not Found
7492	Process not Found
3004	cmd.exe
4184	cmd.exe
4356	cmd.exe
6696	cmd.exe
2596	cmd.exe
5888	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2612	4292	WerFault.exe	87
408	1468	WerFault.exe	93
1488	252	WerFault.exe	100
3632	4692	WerFault.exe	101
1256	5208	WerFault.exe	111
5640	2684	WerFault.exe	113
4388	4256	WerFault.exe	112
4424	808	WerFault.exe	117
4344	3456	WerFault.exe	124
2428	2288	WerFault.exe	129
2248	3380	WerFault.exe	130
3708	4800	WerFault.exe	135
3292	1280	WerFault.exe	141
3372	1532	WerFault.exe	146
712	4420	WerFault.exe	152
1784	4532	WerFault.exe	153
5592	3316	WerFault.exe	158
4524	2732	WerFault.exe	165
4220	4412	WerFault.exe	166
1044	5320	WerFault.exe	171
3720	5076	WerFault.exe	177
964	2692	WerFault.exe	185
2752	2448	WerFault.exe	186
5160	2584	WerFault.exe	196
3492	4732	WerFault.exe	197
3804	2816	WerFault.exe	198
248	5968	WerFault.exe	211
3496	6064	WerFault.exe	212
2508	2940	WerFault.exe	213
4148	6128	WerFault.exe	214
5696	5620	WerFault.exe	220
2236	1876	WerFault.exe	229
2656	4880	WerFault.exe	231
2800	5900	WerFault.exe	239
720	2540	WerFault.exe	242
5508	2372	WerFault.exe	243
4236	6140	WerFault.exe	250
4696	1520	WerFault.exe	256
6024	2004	WerFault.exe	259
2044	3128	WerFault.exe	260
2876	4280	WerFault.exe	265
5176	5128	WerFault.exe	274
3720	6052	WerFault.exe	275
5100	4680	WerFault.exe	279
1348	5520	WerFault.exe	286
4980	3732	WerFault.exe	291
5588	4840	WerFault.exe	292
5404	4624	WerFault.exe	306
3940	632	WerFault.exe	304
4500	4996	WerFault.exe	305
3604	2060	WerFault.exe	319
1840	556	WerFault.exe	320
1348	4592	WerFault.exe	321
5472	5632	WerFault.exe	328
2512	4224	WerFault.exe	332
1996	3856	WerFault.exe	337
4956	4952	WerFault.exe	349
1204	3544	WerFault.exe	348
5956	3340	WerFault.exe	350
5504	3432	WerFault.exe	351
4416	1256	WerFault.exe	355
3708	4536	WerFault.exe	368
5648	2844	WerFault.exe	369
5472	1616	WerFault.exe	379

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HIWHLW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZCLZYNV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OGVUAAV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTFM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OWRB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TIAABK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QCUDH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XZSY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IRESCLQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NECAXTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NBOVCHE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NBOVCHE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QCUDH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTBO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MLK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZJRXQKE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTBO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCFM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZCLZYNV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EBIAJXJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSUDLMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CUKGIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TAJRP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFTRFLB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTFM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXZWN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOIZMQJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TIAABK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BMAFVZF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UFU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TWAWQDM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STTRIMS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZJRXQKE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSUDLMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PVWCTO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OWRB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBFVNVW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QAFLLE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFTRFLB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MMX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPDFHGW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOIZMQJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
4292	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
1468	VABXAI.exe
1468	VABXAI.exe
252	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
252	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
4692	BTFM.exe
4692	BTFM.exe
5208	VABXAI.exe
5208	VABXAI.exe
4256	STTRIMS.exe
4256	STTRIMS.exe
2684	GTBO.exe
2684	GTBO.exe
808	BTFM.exe
808	BTFM.exe
3456	UBI.exe
3456	UBI.exe
2288	STTRIMS.exe
2288	STTRIMS.exe
3380	GTBO.exe
3380	GTBO.exe
4800	MCFM.exe
4800	MCFM.exe
1280	UBI.exe
1280	UBI.exe
1532	HKNJF.exe
1532	HKNJF.exe
4420	PVWCTO.exe
4420	PVWCTO.exe
4532	MCFM.exe
4532	MCFM.exe
3316	MLK.exe
3316	MLK.exe
2732	PVWCTO.exe
2732	PVWCTO.exe
4412	HKNJF.exe
4412	HKNJF.exe
5320	HIWHLW.exe
5320	HIWHLW.exe
5076	MLK.exe
5076	MLK.exe
2692	IRESCLQ.exe
2692	IRESCLQ.exe
2448	HIWHLW.exe
2448	HIWHLW.exe
2584	BSUDLMZ.exe
2584	BSUDLMZ.exe
4732	DXZWN.exe
4732	DXZWN.exe
2816	IRESCLQ.exe
2816	IRESCLQ.exe
5968	ZCLZYNV.exe
5968	ZCLZYNV.exe
6064	DXZWN.exe
6064	DXZWN.exe
2940	BSUDLMZ.exe
2940	BSUDLMZ.exe
6128	UFU.exe
6128	UFU.exe
5620	ZCLZYNV.exe
5620	ZCLZYNV.exe
1876	OWRB.exe
1876	OWRB.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4292	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
4292	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
1468	VABXAI.exe
1468	VABXAI.exe
252	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
252	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
4692	BTFM.exe
4692	BTFM.exe
5208	VABXAI.exe
5208	VABXAI.exe
4256	STTRIMS.exe
4256	STTRIMS.exe
2684	GTBO.exe
2684	GTBO.exe
808	BTFM.exe
808	BTFM.exe
3456	UBI.exe
3456	UBI.exe
2288	STTRIMS.exe
2288	STTRIMS.exe
3380	GTBO.exe
3380	GTBO.exe
4800	MCFM.exe
4800	MCFM.exe
1280	UBI.exe
1280	UBI.exe
1532	HKNJF.exe
1532	HKNJF.exe
4420	PVWCTO.exe
4420	PVWCTO.exe
4532	MCFM.exe
4532	MCFM.exe
3316	MLK.exe
3316	MLK.exe
2732	PVWCTO.exe
2732	PVWCTO.exe
4412	HKNJF.exe
4412	HKNJF.exe
5320	HIWHLW.exe
5320	HIWHLW.exe
5076	MLK.exe
5076	MLK.exe
2692	IRESCLQ.exe
2692	IRESCLQ.exe
2448	HIWHLW.exe
2448	HIWHLW.exe
2584	BSUDLMZ.exe
2584	BSUDLMZ.exe
4732	DXZWN.exe
4732	DXZWN.exe
2816	IRESCLQ.exe
2816	IRESCLQ.exe
5968	ZCLZYNV.exe
5968	ZCLZYNV.exe
6064	DXZWN.exe
6064	DXZWN.exe
2940	BSUDLMZ.exe
2940	BSUDLMZ.exe
6128	UFU.exe
6128	UFU.exe
5620	ZCLZYNV.exe
5620	ZCLZYNV.exe
1876	OWRB.exe
1876	OWRB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 716	4292	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe	89
PID 716 wrote to memory of 1468	716	cmd.exe	93
PID 1468 wrote to memory of 1220	1468	VABXAI.exe	96
PID 1220 wrote to memory of 4692	1220	cmd.exe	101
PID 252 wrote to memory of 3044	252	2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe	102
PID 4692 wrote to memory of 2596	4692	BTFM.exe	106
PID 3044 wrote to memory of 4256	3044	cmd.exe	112
PID 2596 wrote to memory of 2684	2596	cmd.exe	113
PID 4256 wrote to memory of 3568	4256	STTRIMS.exe	119
PID 3568 wrote to memory of 3456	3568	cmd.exe	124
PID 3456 wrote to memory of 2012	3456	UBI.exe	131
PID 2012 wrote to memory of 4800	2012	cmd.exe	135
PID 4800 wrote to memory of 5528	4800	MCFM.exe	142
PID 5528 wrote to memory of 1532	5528	cmd.exe	146
PID 1280 wrote to memory of 4304	1280	UBI.exe	147
PID 4304 wrote to memory of 4420	4304	cmd.exe	152
PID 1532 wrote to memory of 4200	1532	HKNJF.exe	154
PID 4200 wrote to memory of 3316	4200	cmd.exe	158
PID 3316 wrote to memory of 1304	3316	MLK.exe	167
PID 1304 wrote to memory of 5320	1304	cmd.exe	171
PID 5076 wrote to memory of 3772	5076	MLK.exe	180
PID 3772 wrote to memory of 2692	3772	cmd.exe	185
PID 2692 wrote to memory of 1180	2692	IRESCLQ.exe	187
PID 2448 wrote to memory of 2000	2448	HIWHLW.exe	190
PID 1180 wrote to memory of 2584	1180	cmd.exe	196
PID 2000 wrote to memory of 4732	2000	cmd.exe	197
PID 4732 wrote to memory of 2812	4732	DXZWN.exe	201
PID 2816 wrote to memory of 5680	2816	IRESCLQ.exe	207
PID 2812 wrote to memory of 5968	2812	cmd.exe	211
PID 5680 wrote to memory of 6128	5680	cmd.exe	214
PID 5620 wrote to memory of 1508	5620	ZCLZYNV.exe	225
PID 1508 wrote to memory of 1876	1508	cmd.exe	229
PID 1876 wrote to memory of 2652	1876	OWRB.exe	232
PID 4880 wrote to memory of 6004	4880	UFU.exe	236
PID 2652 wrote to memory of 5900	2652	cmd.exe	239
PID 6004 wrote to memory of 2540	6004	cmd.exe	242
PID 2540 wrote to memory of 4284	2540	EBIAJXJ.exe	246
PID 4284 wrote to memory of 6140	4284	cmd.exe	250
PID 2372 wrote to memory of 5352	2372	OWRB.exe	253
PID 5352 wrote to memory of 3128	5352	cmd.exe	260
PID 2004 wrote to memory of 248	2004	SEYCBY.exe	266
PID 3128 wrote to memory of 2612	3128	BMAFVZF.exe	270
PID 248 wrote to memory of 6052	248	cmd.exe	275
PID 2612 wrote to memory of 5128	2612	cmd.exe	274
PID 6052 wrote to memory of 5888	6052	QCUDH.exe	282
PID 5888 wrote to memory of 5520	5888	cmd.exe	286
PID 3732 wrote to memory of 6048	3732	QAFLLE.exe	295
PID 4840 wrote to memory of 1436	4840	QCUDH.exe	298
PID 6048 wrote to memory of 632	6048	cmd.exe	304
PID 1436 wrote to memory of 4624	1436	cmd.exe	306
PID 632 wrote to memory of 1516	632	NOIZMQJ.exe	307
PID 4624 wrote to memory of 5088	4624	BBFVNVW.exe	310
PID 4996 wrote to memory of 3216	4996	TIAABK.exe	313
PID 1516 wrote to memory of 2060	1516	cmd.exe	319
PID 3216 wrote to memory of 556	3216	cmd.exe	320
PID 5088 wrote to memory of 4592	5088	cmd.exe	321
PID 2060 wrote to memory of 1080	2060	XZSY.exe	324
PID 556 wrote to memory of 1768	556	NECAXTS.exe	329
PID 4592 wrote to memory of 1740	4592	OXXC.exe	333
PID 1080 wrote to memory of 3856	1080	cmd.exe	337
PID 1768 wrote to memory of 4952	1768	cmd.exe	349
PID 1740 wrote to memory of 3544	1740	cmd.exe	348
PID 4536 wrote to memory of 836	4536	RFTRFLB.exe	370
PID 2844 wrote to memory of 3952	2844	MMX.exe	373

C:\Users\Admin\AppData\Local\Temp\2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\VABXAI.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\windows\VABXAI.exe
    C:\windows\VABXAI.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\BTFM.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\windows\system\BTFM.exe
        
        C:\windows\system\BTFM.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\windows\GTBO.exe
        
        C:\windows\GTBO.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 848
        8⤵
        Program crash
        
        PID:5640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1360
        6⤵
        Program crash
        
        PID:3632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1028
      4⤵
      Program crash
      PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1316
  2⤵
  - Program crash
  PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4292 -ip 4292
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1468 -ip 1468
1⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-30_b41cbaaf83f8cb8f4af7f46197176170_elex_emotet_stop.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\STTRIMS.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\windows\SysWOW64\STTRIMS.exe
    C:\windows\system32\STTRIMS.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\UBI.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\windows\system\UBI.exe
        
        C:\windows\system\UBI.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3456
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MCFM.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\windows\system\MCFM.exe
        
        C:\windows\system\MCFM.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\windows\system\HKNJF.exe
        
        C:\windows\system\HKNJF.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\windows\MLK.exe
        
        C:\windows\MLK.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HIWHLW.exe.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\windows\HIWHLW.exe
        
        C:\windows\HIWHLW.exe
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 832
        14⤵
        Program crash
        
        PID:1044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 940
        12⤵
        Program crash
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 1360
        10⤵
        Program crash
        
        PID:3372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1348
        8⤵
        Program crash
        
        PID:3708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 1020
        6⤵
        Program crash
        
        PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 1376
      4⤵
      Program crash
      PID:4388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 252 -s 944
  2⤵
  - Program crash
  PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 252 -ip 252
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4692 -ip 4692
1⤵
PID:3544

C:\windows\VABXAI.exe
C:\windows\VABXAI.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 796
  2⤵
  - Program crash
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5208 -ip 5208
1⤵
PID:4872

C:\windows\system\BTFM.exe
C:\windows\system\BTFM.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 812
  2⤵
  - Program crash
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2684 -ip 2684
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4256 -ip 4256
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 808 -ip 808
1⤵
PID:1044

C:\windows\SysWOW64\STTRIMS.exe
C:\windows\SysWOW64\STTRIMS.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 840
  2⤵
  - Program crash
  PID:2428

C:\windows\GTBO.exe
C:\windows\GTBO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 804
  2⤵
  - Program crash
  PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3456 -ip 3456
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2288 -ip 2288
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3380 -ip 3380
1⤵
PID:1492

C:\windows\system\UBI.exe
C:\windows\system\UBI.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\PVWCTO.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\windows\system\PVWCTO.exe
    C:\windows\system\PVWCTO.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 840
      4⤵
      Program crash
      PID:712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 1336
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4800 -ip 4800
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1280 -ip 1280
1⤵
PID:2812

C:\windows\system\MCFM.exe
C:\windows\system\MCFM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 812
  2⤵
  - Program crash
  PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1532 -ip 1532
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4420 -ip 4420
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4532 -ip 4532
1⤵
PID:4916

C:\windows\system\PVWCTO.exe
C:\windows\system\PVWCTO.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 812
  2⤵
  - Program crash
  PID:4524

C:\windows\system\HKNJF.exe
C:\windows\system\HKNJF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 796
  2⤵
  - Program crash
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3316 -ip 3316
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2732 -ip 2732
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4412 -ip 4412
1⤵
PID:3212

C:\windows\MLK.exe
C:\windows\MLK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\IRESCLQ.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\windows\IRESCLQ.exe
    C:\windows\IRESCLQ.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\windows\system\BSUDLMZ.exe
        
        C:\windows\system\BSUDLMZ.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 844
        6⤵
        Program crash
        
        PID:5160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1332
      4⤵
      Program crash
      PID:964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 944
  2⤵
  - Program crash
  PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5320 -ip 5320
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5076 -ip 5076
1⤵
PID:3560

C:\windows\HIWHLW.exe
C:\windows\HIWHLW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DXZWN.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\windows\SysWOW64\DXZWN.exe
    C:\windows\system32\DXZWN.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\windows\ZCLZYNV.exe
        
        C:\windows\ZCLZYNV.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 832
        6⤵
        Program crash
        
        PID:248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1012
      4⤵
      Program crash
      PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1328
  2⤵
  - Program crash
  PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2692 -ip 2692
1⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2448 -ip 2448
1⤵
PID:2428

C:\windows\IRESCLQ.exe
C:\windows\IRESCLQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\windows\UFU.exe
    C:\windows\UFU.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 832
      4⤵
      Program crash
      PID:4148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 804
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2584 -ip 2584
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4732 -ip 4732
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2816 -ip 2816
1⤵
PID:5048

C:\windows\SysWOW64\DXZWN.exe
C:\windows\SysWOW64\DXZWN.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 832
  2⤵
  - Program crash
  PID:3496

C:\windows\system\BSUDLMZ.exe
C:\windows\system\BSUDLMZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 796
  2⤵
  - Program crash
  PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5968 -ip 5968
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6064 -ip 6064
1⤵
PID:4416

C:\windows\ZCLZYNV.exe
C:\windows\ZCLZYNV.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWRB.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\windows\SysWOW64\OWRB.exe
    C:\windows\system32\OWRB.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\SEYCBY.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\windows\system\SEYCBY.exe
        
        C:\windows\system\SEYCBY.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 844
        6⤵
        Program crash
        
        PID:2800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 988
      4⤵
      Program crash
      PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 904
  2⤵
  - Program crash
  PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2940 -ip 2940
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6128 -ip 6128
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5620 -ip 5620
1⤵
PID:4824

C:\windows\UFU.exe
C:\windows\UFU.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\windows\system\EBIAJXJ.exe
    C:\windows\system\EBIAJXJ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\windows\ZJRXQKE.exe
        
        C:\windows\ZJRXQKE.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 840
        6⤵
        Program crash
        
        PID:4236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 980
      4⤵
      Program crash
      PID:720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1336
  2⤵
  - Program crash
  PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1876 -ip 1876
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4880 -ip 4880
1⤵
PID:3232

C:\windows\SysWOW64\OWRB.exe
C:\windows\SysWOW64\OWRB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\windows\SysWOW64\BMAFVZF.exe
    C:\windows\system32\BMAFVZF.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\QAFLLE.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\windows\QAFLLE.exe
        
        C:\windows\QAFLLE.exe
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 848
        6⤵
        Program crash
        
        PID:5176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1360
      4⤵
      Program crash
      PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 872
  2⤵
  - Program crash
  PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5900 -ip 5900
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2540 -ip 2540
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2372 -ip 2372
1⤵
PID:3556

C:\windows\system\EBIAJXJ.exe
C:\windows\system\EBIAJXJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 796
  2⤵
  - Program crash
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6140 -ip 6140
1⤵
PID:2144

C:\windows\system\SEYCBY.exe
C:\windows\system\SEYCBY.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\windows\QCUDH.exe
    C:\windows\QCUDH.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\TIAABK.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\windows\TIAABK.exe
        
        C:\windows\TIAABK.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 844
        6⤵
        Program crash
        
        PID:1348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 1192
      4⤵
      Program crash
      PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 1324
  2⤵
  - Program crash
  PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1520 -ip 1520
1⤵
PID:4232

C:\windows\ZJRXQKE.exe
C:\windows\ZJRXQKE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 800
  2⤵
  - Program crash
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2004 -ip 2004
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3128 -ip 3128
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4280 -ip 4280
1⤵
PID:5424

C:\windows\SysWOW64\BMAFVZF.exe
C:\windows\SysWOW64\BMAFVZF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 836
  2⤵
  - Program crash
  PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5128 -ip 5128
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6052 -ip 6052
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4680 -ip 4680
1⤵
PID:2740

C:\windows\QAFLLE.exe
C:\windows\QAFLLE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\windows\SysWOW64\NOIZMQJ.exe
    C:\windows\system32\NOIZMQJ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\windows\system\XZSY.exe
        
        C:\windows\system\XZSY.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\windows\SysWOW64\CUKGIC.exe
        
        C:\windows\system32\CUKGIC.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 780
        8⤵
        Program crash
        
        PID:1996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1320
        6⤵
        Program crash
        
        PID:3604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 1344
      4⤵
      Program crash
      PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1312
  2⤵
  - Program crash
  PID:4980

C:\windows\QCUDH.exe
C:\windows\QCUDH.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\windows\system\BBFVNVW.exe
    C:\windows\system\BBFVNVW.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\windows\system\OXXC.exe
        
        C:\windows\system\OXXC.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\windows\SysWOW64\MMX.exe
        
        C:\windows\system32\MMX.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 840
        8⤵
        Program crash
        
        PID:1204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1020
        6⤵
        Program crash
        
        PID:1348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 1000
      4⤵
      Program crash
      PID:5404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1312
  2⤵
  - Program crash
  PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5520 -ip 5520
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3732 -ip 3732
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4840 -ip 4840
1⤵
PID:4608

C:\windows\TIAABK.exe
C:\windows\TIAABK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\windows\SysWOW64\NECAXTS.exe
    C:\windows\system32\NECAXTS.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\windows\SysWOW64\RFTRFLB.exe
        
        C:\windows\system32\RFTRFLB.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 836
        6⤵
        Program crash
        
        PID:4956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1368
      4⤵
      Program crash
      PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 944
  2⤵
  - Program crash
  PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 632 -ip 632
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4624 -ip 4624
1⤵
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4996 -ip 4996
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2060 -ip 2060
1⤵
PID:3324

C:\windows\SysWOW64\NOIZMQJ.exe
C:\windows\SysWOW64\NOIZMQJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 824
  2⤵
  - Program crash
  PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 556 -ip 556
1⤵
PID:4860

C:\windows\system\BBFVNVW.exe
C:\windows\system\BBFVNVW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 796
  2⤵
  - Program crash
  PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4592 -ip 4592
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5632 -ip 5632
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4224 -ip 4224
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3856 -ip 3856
1⤵
PID:2644

C:\windows\system\XZSY.exe
C:\windows\system\XZSY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 796
  2⤵
  - Program crash
  PID:5956

C:\windows\system\OXXC.exe
C:\windows\system\OXXC.exe
1⤵
- Executes dropped EXE
PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 812
  2⤵
  - Program crash
  PID:5504

C:\windows\SysWOW64\NECAXTS.exe
C:\windows\SysWOW64\NECAXTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:52

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3544 -ip 3544
1⤵
PID:3692

C:\windows\SysWOW64\CUKGIC.exe
C:\windows\SysWOW64\CUKGIC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 844
  2⤵
  - Program crash
  PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4952 -ip 4952
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3340 -ip 3340
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3432 -ip 3432
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 52 -ip 52
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1256 -ip 1256
1⤵
PID:1088

C:\windows\SysWOW64\RFTRFLB.exe
C:\windows\SysWOW64\RFTRFLB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBOVCHE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:836
- - C:\windows\SysWOW64\NBOVCHE.exe
    C:\windows\system32\NBOVCHE.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4320
    - - C:\windows\system\TWAWQDM.exe
        
        C:\windows\system\TWAWQDM.exe
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 840
        6⤵
        
        PID:5956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 1020
      4⤵
      PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1348
  2⤵
  - Program crash
  PID:3708

C:\windows\SysWOW64\MMX.exe
C:\windows\SysWOW64\MMX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\QBJUWK.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3952
- - C:\windows\system\QBJUWK.exe
    C:\windows\system\QBJUWK.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\PJX.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
    - - C:\windows\system\PJX.exe
        
        C:\windows\system\PJX.exe
        5⤵
        Adds Run key to start application
        
        PID:2868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 844
        6⤵
        
        PID:5740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 984
      4⤵
      Program crash
      PID:5472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1308
  2⤵
  - Program crash
  PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4536 -ip 4536
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2844 -ip 2844
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1616 -ip 1616
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5700 -ip 5700
1⤵
PID:2784

C:\windows\SysWOW64\NBOVCHE.exe
C:\windows\SysWOW64\NBOVCHE.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2024
- - C:\windows\WPDFHGW.exe
    C:\windows\WPDFHGW.exe
    3⤵
    - Drops file in Windows directory
    PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "
      4⤵
      PID:5936
    - - C:\windows\TAJRP.exe
        
        C:\windows\TAJRP.exe
        5⤵
        Drops file in Windows directory
        
        PID:5064
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\windows\system\OGVUAAV.exe
        
        C:\windows\system\OGVUAAV.exe
        7⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "
        8⤵
        
        PID:4516
        
        C:\windows\SysWOW64\SWCUM.exe
        
        C:\windows\system32\SWCUM.exe
        9⤵
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "
        10⤵
        Executes a command shell one-liner
        
        PID:3012
        
        C:\windows\SysWOW64\KWQAZ.exe
        
        C:\windows\system32\KWQAZ.exe
        11⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\AFZM.exe.bat" "
        12⤵
        
        PID:3448
        
        C:\windows\AFZM.exe
        
        C:\windows\AFZM.exe
        13⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 848
        14⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 980
        12⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1324
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1008
        8⤵
        
        PID:5980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 940
        6⤵
        
        PID:1368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1020
      4⤵
      PID:4300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 972
  2⤵
  PID:3936

C:\windows\system\QBJUWK.exe
C:\windows\system\QBJUWK.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ZCIYA.exe.bat" "
  2⤵
  PID:2516
- - C:\windows\ZCIYA.exe
    C:\windows\ZCIYA.exe
    3⤵
    - Adds Run key to start application
    PID:4860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 836
      4⤵
      PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 988
  2⤵
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2868 -ip 2868
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4708 -ip 4708
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1600 -ip 1600
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2560 -ip 2560
1⤵
PID:1916

C:\windows\system\PJX.exe
C:\windows\system\PJX.exe
1⤵
- Adds Run key to start application
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 808
  2⤵
  PID:2160

C:\windows\system\TWAWQDM.exe
C:\windows\system\TWAWQDM.exe
1⤵
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 796
  2⤵
  PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4872 -ip 4872
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4820 -ip 4820
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4860 -ip 4860
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5032 -ip 5032
1⤵
PID:5624

C:\windows\ZCIYA.exe
C:\windows\ZCIYA.exe
1⤵
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 808
  2⤵
  PID:2452

C:\windows\WPDFHGW.exe
C:\windows\WPDFHGW.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 800
  2⤵
  PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5064 -ip 5064
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1784 -ip 1784
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 872 -ip 872
1⤵
PID:1996

C:\windows\TAJRP.exe
C:\windows\TAJRP.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "
  2⤵
  PID:1372
- - C:\windows\GZYB.exe
    C:\windows\GZYB.exe
    3⤵
    PID:5816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHTI.exe.bat" "
      4⤵
      PID:2356
    - - C:\windows\SysWOW64\IHTI.exe
        
        C:\windows\system32\IHTI.exe
        5⤵
        
        PID:3764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 848
        6⤵
        
        PID:4684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 980
      4⤵
      PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 952
  2⤵
  PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3868 -ip 3868
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1284 -ip 1284
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4916 -ip 4916
1⤵
PID:2292

C:\windows\system\OGVUAAV.exe
C:\windows\system\OGVUAAV.exe
1⤵
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4468
- - C:\windows\system\BAOKZ.exe
    C:\windows\system\BAOKZ.exe
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 832
      4⤵
      PID:124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 952
  2⤵
  PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5816 -ip 5816
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4156 -ip 4156
1⤵
PID:6076

C:\windows\SysWOW64\SWCUM.exe
C:\windows\SysWOW64\SWCUM.exe
1⤵
PID:6084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 828
  2⤵
  PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4620 -ip 4620
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6084 -ip 6084
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3764 -ip 3764
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4308 -ip 4308
1⤵
PID:804

C:\windows\GZYB.exe
C:\windows\GZYB.exe
1⤵
PID:5864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 796
  2⤵
  PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5956 -ip 5956
1⤵
PID:1916

C:\windows\SysWOW64\KWQAZ.exe
C:\windows\SysWOW64\KWQAZ.exe
1⤵
PID:3900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5648
- - C:\windows\system\NGEABL.exe
    C:\windows\system\NGEABL.exe
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 824
      4⤵
      PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 1368
  2⤵
  PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5864 -ip 5864
1⤵
PID:3496

C:\windows\system\BAOKZ.exe
C:\windows\system\BAOKZ.exe
1⤵
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 800
  2⤵
  PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3900 -ip 3900
1⤵
PID:1472

C:\windows\SysWOW64\IHTI.exe
C:\windows\SysWOW64\IHTI.exe
1⤵
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 776
  2⤵
  PID:4152

C:\windows\AFZM.exe
C:\windows\AFZM.exe
1⤵
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 796
  2⤵
  PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3048 -ip 3048
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2988 -ip 2988
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4584 -ip 4584
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5560 -ip 5560
1⤵
PID:4360

C:\windows\system\NGEABL.exe
C:\windows\system\NGEABL.exe
1⤵
PID:5624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRK.exe.bat" "
  2⤵
  PID:6116
- - C:\windows\SysWOW64\WRK.exe
    C:\windows\system32\WRK.exe
    3⤵
    PID:5588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:2424
    - - C:\windows\system\PUOCLYJ.exe
        
        C:\windows\system\PUOCLYJ.exe
        5⤵
        
        PID:3560
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:1052
        
        C:\windows\system\ANR.exe
        
        C:\windows\system\ANR.exe
        7⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:4664
        
        C:\windows\BIVQZ.exe
        
        C:\windows\BIVQZ.exe
        9⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "
        10⤵
        
        PID:3124
        
        C:\windows\EYIFP.exe
        
        C:\windows\EYIFP.exe
        11⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 832
        12⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 1008
        10⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 992
        8⤵
        
        PID:4344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 1376
        6⤵
        
        PID:5860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 988
      4⤵
      PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1320
  2⤵
  PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5624 -ip 5624
1⤵
PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5588 -ip 5588
1⤵
PID:2788

C:\windows\SysWOW64\WRK.exe
C:\windows\SysWOW64\WRK.exe
1⤵
PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "
  2⤵
  PID:5644
- - C:\windows\system\CIGK.exe
    C:\windows\system\CIGK.exe
    3⤵
    PID:1688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 840
      4⤵
      PID:4132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 972
  2⤵
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3560 -ip 3560
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3556 -ip 3556
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5948 -ip 5948
1⤵
PID:2264

C:\windows\system\PUOCLYJ.exe
C:\windows\system\PUOCLYJ.exe
1⤵
PID:5392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "
  2⤵
  PID:4956
- - C:\windows\system\ZGG.exe
    C:\windows\system\ZGG.exe
    3⤵
    PID:3000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 744
      4⤵
      PID:304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 956
  2⤵
  PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1688 -ip 1688
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5392 -ip 5392
1⤵
PID:3036

C:\windows\system\CIGK.exe
C:\windows\system\CIGK.exe
1⤵
PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 804
  2⤵
  PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6040 -ip 6040
1⤵
PID:2800

C:\windows\system\ANR.exe
C:\windows\system\ANR.exe
1⤵
PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 796
  2⤵
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3000 -ip 3000
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2788 -ip 2788
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4000 -ip 4000
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3632 -ip 3632
1⤵
PID:3588

C:\windows\BIVQZ.exe
C:\windows\BIVQZ.exe
1⤵
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\AZT.exe.bat" "
  2⤵
  PID:3548
- - C:\windows\system\AZT.exe
    C:\windows\system\AZT.exe
    3⤵
    PID:5168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:2312
    - - C:\windows\system\KSCFT.exe
        
        C:\windows\system\KSCFT.exe
        5⤵
        
        PID:4300
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "
        6⤵
        
        PID:5108
        
        C:\windows\YNAYQT.exe
        
        C:\windows\YNAYQT.exe
        7⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 848
        8⤵
        
        PID:4676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 980
        6⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 836
      4⤵
      PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 984
  2⤵
  PID:6076

C:\windows\system\ZGG.exe
C:\windows\system\ZGG.exe
1⤵
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEY.exe.bat" "
  2⤵
  PID:6044
- - C:\windows\SysWOW64\QEY.exe
    C:\windows\system32\QEY.exe
    3⤵
    PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "
      4⤵
      PID:1652
    - - C:\windows\SysWOW64\CHIIZ.exe
        
        C:\windows\system32\CHIIZ.exe
        5⤵
        
        PID:4384
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNVMKUH.exe.bat" "
        6⤵
        
        PID:2160
        
        C:\windows\SysWOW64\XNVMKUH.exe
        
        C:\windows\system32\XNVMKUH.exe
        7⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 844
        8⤵
        
        PID:3308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1348
        6⤵
        
        PID:5556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1008
      4⤵
      PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 984
  2⤵
  PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4152 -ip 4152
1⤵
PID:1136

C:\windows\EYIFP.exe
C:\windows\EYIFP.exe
1⤵
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 796
  2⤵
  PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2044 -ip 2044
1⤵
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2876 -ip 2876
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5168 -ip 5168
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2800 -ip 2800
1⤵
PID:1088

C:\windows\system\AZT.exe
C:\windows\system\AZT.exe
1⤵
PID:5704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 796
  2⤵
  PID:5608

C:\windows\SysWOW64\QEY.exe
C:\windows\SysWOW64\QEY.exe
1⤵
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\WDOPXI.exe.bat" "
  2⤵
  PID:3916
- - C:\windows\WDOPXI.exe
    C:\windows\WDOPXI.exe
    3⤵
    PID:3024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 844
      4⤵
      PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 972
  2⤵
  PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4300 -ip 4300
1⤵
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4384 -ip 4384
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5704 -ip 5704
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4564 -ip 4564
1⤵
PID:1752

C:\windows\system\KSCFT.exe
C:\windows\system\KSCFT.exe
1⤵
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 812
  2⤵
  PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5672 -ip 5672
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2796 -ip 2796
1⤵
PID:1844

C:\windows\SysWOW64\CHIIZ.exe
C:\windows\SysWOW64\CHIIZ.exe
1⤵
PID:468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 840
  2⤵
  PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2512 -ip 2512
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 468 -ip 468
1⤵
PID:1580

C:\windows\SysWOW64\XNVMKUH.exe
C:\windows\SysWOW64\XNVMKUH.exe
1⤵
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 840
  2⤵
  PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3024 -ip 3024
1⤵
PID:3096

C:\windows\YNAYQT.exe
C:\windows\YNAYQT.exe
1⤵
PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 796
  2⤵
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3020 -ip 3020
1⤵
PID:3852

C:\windows\WDOPXI.exe
C:\windows\WDOPXI.exe
1⤵
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPVRB.exe.bat" "
  2⤵
  PID:5664
- - C:\windows\SysWOW64\VPVRB.exe
    C:\windows\system32\VPVRB.exe
    3⤵
    PID:4552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\DCIX.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4884
    - - C:\windows\DCIX.exe
        
        C:\windows\DCIX.exe
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "
        6⤵
        
        PID:3492
        
        C:\windows\system\TDDJCFU.exe
        
        C:\windows\system\TDDJCFU.exe
        7⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOAPME.exe.bat" "
        8⤵
        
        PID:3692
        
        C:\windows\SysWOW64\NOAPME.exe
        
        C:\windows\system32\NOAPME.exe
        9⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 848
        10⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 980
        8⤵
        
        PID:2824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1000
        6⤵
        
        PID:5788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1356
      4⤵
      PID:5256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1328
  2⤵
  PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3324 -ip 3324
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4508 -ip 4508
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4552 -ip 4552
1⤵
PID:1528

C:\windows\SysWOW64\VPVRB.exe
C:\windows\SysWOW64\VPVRB.exe
1⤵
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "
  2⤵
  PID:5404
- - C:\windows\SysWOW64\RXG.exe
    C:\windows\system32\RXG.exe
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOOXLKX.exe.bat" "
      4⤵
      PID:3148
    - - C:\windows\SysWOW64\FOOXLKX.exe
        
        C:\windows\system32\FOOXLKX.exe
        5⤵
        
        PID:4524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 832
        6⤵
        
        PID:1136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1012
      4⤵
      PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1008
  2⤵
  PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4360 -ip 4360
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2364 -ip 2364
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4436 -ip 4436
1⤵
PID:1844

C:\windows\DCIX.exe
C:\windows\DCIX.exe
1⤵
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 796
  2⤵
  PID:256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1744 -ip 1744
1⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3056 -ip 3056
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4524 -ip 4524
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1536 -ip 1536
1⤵
PID:1044

C:\windows\SysWOW64\RXG.exe
C:\windows\SysWOW64\RXG.exe
1⤵
PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\IZBODBD.exe.bat" "
  2⤵
  PID:3720
- - C:\windows\system\IZBODBD.exe
    C:\windows\system\IZBODBD.exe
    3⤵
    PID:3372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 848
      4⤵
      PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1020
  2⤵
  PID:4324

C:\windows\system\TDDJCFU.exe
C:\windows\system\TDDJCFU.exe
1⤵
PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZOOMU.exe.bat" "
  2⤵
  PID:5696
- - C:\windows\SysWOW64\IZOOMU.exe
    C:\windows\system32\IZOOMU.exe
    3⤵
    PID:5432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 788
      4⤵
      PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 952
  2⤵
  PID:4500

C:\windows\SysWOW64\NOAPME.exe
C:\windows\SysWOW64\NOAPME.exe
1⤵
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 840
  2⤵
  PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4792 -ip 4792
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2828 -ip 2828
1⤵
PID:5608

C:\windows\SysWOW64\FOOXLKX.exe
C:\windows\SysWOW64\FOOXLKX.exe
1⤵
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 840
  2⤵
  PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2248 -ip 2248
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1348 -ip 1348
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5432 -ip 5432
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3372 -ip 3372
1⤵
PID:3404

C:\windows\SysWOW64\IZOOMU.exe
C:\windows\SysWOW64\IZOOMU.exe
1⤵
PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HIZDS.exe.bat" "
  2⤵
  PID:3768
- - C:\windows\HIZDS.exe
    C:\windows\HIZDS.exe
    3⤵
    PID:2264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TOGV.exe.bat" "
      4⤵
      PID:1364
    - - C:\windows\SysWOW64\TOGV.exe
        
        C:\windows\system32\TOGV.exe
        5⤵
        
        PID:3308
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOUALL.exe.bat" "
        6⤵
        
        PID:3816
        
        C:\windows\SysWOW64\KOUALL.exe
        
        C:\windows\system32\KOUALL.exe
        7⤵
        
        PID:5820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 1008
        6⤵
        
        PID:4944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1004
      4⤵
      PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1008
  2⤵
  PID:3472

C:\windows\system\IZBODBD.exe
C:\windows\system\IZBODBD.exe
1⤵
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\UIZ.exe.bat" "
  2⤵
  PID:304
- - C:\windows\system\UIZ.exe
    C:\windows\system\UIZ.exe
    3⤵
    PID:3260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "
      4⤵
      PID:5256
    - - C:\windows\GWGYYV.exe
        
        C:\windows\GWGYYV.exe
        5⤵
        
        PID:5868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMAHJR.exe.bat" "
        6⤵
        
        PID:5080
        
        C:\windows\SysWOW64\PMAHJR.exe
        
        C:\windows\system32\PMAHJR.exe
        7⤵
        
        PID:5788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 1368
        6⤵
        
        PID:5908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1020
      4⤵
      PID:1472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 988
  2⤵
  PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1140 -ip 1140
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4704 -ip 4704
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3260 -ip 3260
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2264 -ip 2264
1⤵
PID:3312

C:\windows\HIZDS.exe
C:\windows\HIZDS.exe
1⤵
PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 796
  2⤵
  PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5868 -ip 5868
1⤵
PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3308 -ip 3308
1⤵
PID:2624

C:\windows\system\UIZ.exe
C:\windows\system\UIZ.exe
1⤵
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 816
  2⤵
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2452 -ip 2452
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1064 -ip 1064
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5788 -ip 5788
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5820 -ip 5820
1⤵
PID:2492

C:\windows\SysWOW64\TOGV.exe
C:\windows\SysWOW64\TOGV.exe
1⤵
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 836
  2⤵
  PID:728

C:\windows\GWGYYV.exe
C:\windows\GWGYYV.exe
1⤵
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 812
  2⤵
  PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1272 -ip 1272
1⤵
PID:4608

C:\windows\SysWOW64\PMAHJR.exe
C:\windows\SysWOW64\PMAHJR.exe
1⤵
PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 840
  2⤵
  PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1088 -ip 1088
1⤵
PID:4208

C:\windows\SysWOW64\KOUALL.exe
C:\windows\SysWOW64\KOUALL.exe
1⤵
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\KYA.exe.bat" "
  2⤵
  PID:5820
- - C:\windows\system\KYA.exe
    C:\windows\system\KYA.exe
    3⤵
    PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\JIKRKJL.exe.bat" "
      4⤵
      PID:3416
    - - C:\windows\JIKRKJL.exe
        
        C:\windows\JIKRKJL.exe
        5⤵
        
        PID:4604
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ROPGVHH.exe.bat" "
        6⤵
        
        PID:4180
        
        C:\windows\ROPGVHH.exe
        
        C:\windows\ROPGVHH.exe
        7⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DZAT.exe.bat" "
        8⤵
        
        PID:4148
        
        C:\windows\DZAT.exe
        
        C:\windows\DZAT.exe
        9⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 844
        10⤵
        
        PID:620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1304
        8⤵
        
        PID:1996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1000
        6⤵
        
        PID:408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 1016
      4⤵
      PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1324
  2⤵
  PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3708 -ip 3708
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4556 -ip 4556
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5156 -ip 5156
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4604 -ip 4604
1⤵
PID:6012

C:\windows\system\KYA.exe
C:\windows\system\KYA.exe
1⤵
PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SRTCAF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3844
- - C:\windows\system\SRTCAF.exe
    C:\windows\system\SRTCAF.exe
    3⤵
    PID:3804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCKYN.exe.bat" "
      4⤵
      PID:4124
    - - C:\windows\SysWOW64\PCKYN.exe
        
        C:\windows\system32\PCKYN.exe
        5⤵
        
        PID:5260
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MAZXIUV.exe.bat" "
        6⤵
        
        PID:4496
        
        C:\windows\system\MAZXIUV.exe
        
        C:\windows\system\MAZXIUV.exe
        7⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 848
        8⤵
        
        PID:4740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 1000
        6⤵
        
        PID:5860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 1368
      4⤵
      PID:5944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 944
  2⤵
  PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4868 -ip 4868
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4852 -ip 4852
1⤵
PID:1368

C:\windows\JIKRKJL.exe
C:\windows\JIKRKJL.exe
1⤵
PID:5264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXUXPR.exe.bat" "
  2⤵
  PID:3068
- - C:\windows\system\ZXUXPR.exe
    C:\windows\system\ZXUXPR.exe
    3⤵
    PID:256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 256 -s 848
      4⤵
      PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 944
  2⤵
  PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5264 -ip 5264
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3272 -ip 3272
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3804 -ip 3804
1⤵
PID:2340

C:\windows\ROPGVHH.exe
C:\windows\ROPGVHH.exe
1⤵
PID:5788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 812
  2⤵
  PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5788 -ip 5788
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 256 -ip 256
1⤵
PID:4752

C:\windows\DZAT.exe
C:\windows\DZAT.exe
1⤵
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 796
  2⤵
  PID:2672

C:\windows\system\SRTCAF.exe
C:\windows\system\SRTCAF.exe
1⤵
PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 704
  2⤵
  PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5260 -ip 5260
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2076 -ip 2076
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4688 -ip 4688
1⤵
PID:4404

C:\windows\SysWOW64\PCKYN.exe
C:\windows\SysWOW64\PCKYN.exe
1⤵
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\QGNGWP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3004
- - C:\windows\system\QGNGWP.exe
    C:\windows\system\QGNGWP.exe
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SULW.exe.bat" "
      4⤵
      PID:5160
    - - C:\windows\SysWOW64\SULW.exe
        
        C:\windows\system32\SULW.exe
        5⤵
        
        PID:5904
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RXDHVHZ.exe.bat" "
        6⤵
        
        PID:4424
        
        C:\windows\RXDHVHZ.exe
        
        C:\windows\RXDHVHZ.exe
        7⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 852
        8⤵
        
        PID:4776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 1328
        6⤵
        
        PID:2636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1368
      4⤵
      PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 1340
  2⤵
  PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6096 -ip 6096
1⤵
PID:4344

C:\windows\system\ZXUXPR.exe
C:\windows\system\ZXUXPR.exe
1⤵
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\TLKZQ.exe.bat" "
  2⤵
  PID:1196
- - C:\windows\TLKZQ.exe
    C:\windows\TLKZQ.exe
    3⤵
    PID:1912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\WRRD.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:5384
    - - C:\windows\WRRD.exe
        
        C:\windows\WRRD.exe
        5⤵
        
        PID:5272
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZXAWBA.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:1872
        
        C:\windows\SysWOW64\NZXAWBA.exe
        
        C:\windows\system32\NZXAWBA.exe
        7⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 852
        8⤵
        
        PID:2772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 1368
        6⤵
        
        PID:1044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1020
      4⤵
      PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 980
  2⤵
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5116 -ip 5116
1⤵
PID:5604

C:\windows\system\MAZXIUV.exe
C:\windows\system\MAZXIUV.exe
1⤵
PID:5872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 808
  2⤵
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3936 -ip 3936
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5872 -ip 5872
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4948 -ip 4948
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 1912 -ip 1912
1⤵
PID:1044

C:\windows\system\QGNGWP.exe
C:\windows\system\QGNGWP.exe
1⤵
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 808
  2⤵
  PID:2708

C:\windows\TLKZQ.exe
C:\windows\TLKZQ.exe
1⤵
PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 748
  2⤵
  PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5272 -ip 5272
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5904 -ip 5904
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2744 -ip 2744
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4324 -ip 4324
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2492 -ip 2492
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5584 -ip 5584
1⤵
PID:3852

C:\windows\SysWOW64\SULW.exe
C:\windows\SysWOW64\SULW.exe
1⤵
PID:1248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVZNS.exe.bat" "
  2⤵
  PID:2460
- - C:\windows\SysWOW64\KVZNS.exe
    C:\windows\system32\KVZNS.exe
    3⤵
    PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\JYWQ.exe.bat" "
      4⤵
      PID:2072
    - - C:\windows\system\JYWQ.exe
        
        C:\windows\system\JYWQ.exe
        5⤵
        
        PID:4668
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MGF.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4184
        
        C:\windows\system\MGF.exe
        
        C:\windows\system\MGF.exe
        7⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 844
        8⤵
        
        PID:2888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 980
        6⤵
        
        PID:3280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1372
      4⤵
      PID:704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1032
  2⤵
  PID:4196

C:\windows\WRRD.exe
C:\windows\WRRD.exe
1⤵
PID:3292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\AACP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5944
- - C:\windows\AACP.exe
    C:\windows\AACP.exe
    3⤵
    PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\YLU.exe.bat" "
      4⤵
      PID:1848
    - - C:\windows\YLU.exe
        
        C:\windows\YLU.exe
        5⤵
        
        PID:2212
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FWJCNK.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4608
        
        C:\windows\system\FWJCNK.exe
        
        C:\windows\system\FWJCNK.exe
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 824
        8⤵
        
        PID:2532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 1012
        6⤵
        
        PID:4208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1360
      4⤵
      PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1264
  2⤵
  PID:3288

C:\windows\RXDHVHZ.exe
C:\windows\RXDHVHZ.exe
1⤵
PID:728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 808
  2⤵
  PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1248 -ip 1248
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3292 -ip 3292
1⤵
PID:2772

C:\windows\SysWOW64\NZXAWBA.exe
C:\windows\SysWOW64\NZXAWBA.exe
1⤵
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 836
  2⤵
  PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 728 -ip 728
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2092 -ip 2092
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1048 -ip 1048
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2780 -ip 2780
1⤵
PID:4568

C:\windows\AACP.exe
C:\windows\AACP.exe
1⤵
PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 812
  2⤵
  PID:3940

C:\windows\SysWOW64\KVZNS.exe
C:\windows\SysWOW64\KVZNS.exe
1⤵
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 844
  2⤵
  PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4668 -ip 4668
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2212 -ip 2212
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3752 -ip 3752
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2564 -ip 2564
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1724 -ip 1724
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4448 -ip 4448
1⤵
PID:1836

C:\windows\system\JYWQ.exe
C:\windows\system\JYWQ.exe
1⤵
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\AHVU.exe.bat" "
  2⤵
  PID:1120
- - C:\windows\AHVU.exe
    C:\windows\AHVU.exe
    3⤵
    PID:1124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 844
      4⤵
      PID:5556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 944
  2⤵
  PID:2636

C:\windows\YLU.exe
C:\windows\YLU.exe
1⤵
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\EFO.exe.bat" "
  2⤵
  PID:3588
- - C:\windows\EFO.exe
    C:\windows\EFO.exe
    3⤵
    PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\EIY.exe.bat" "
      4⤵
      PID:2504
    - - C:\windows\SysWOW64\EIY.exe
        
        C:\windows\system32\EIY.exe
        5⤵
        
        PID:1368
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYFDD.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4356
        
        C:\windows\SysWOW64\IYFDD.exe
        
        C:\windows\system32\IYFDD.exe
        7⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 832
        8⤵
        
        PID:5420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1340
        6⤵
        
        PID:1128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1324
      4⤵
      PID:3404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 796
  2⤵
  PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2696 -ip 2696
1⤵
PID:3852

C:\windows\system\MGF.exe
C:\windows\system\MGF.exe
1⤵
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 808
  2⤵
  PID:3388

C:\windows\system\FWJCNK.exe
C:\windows\system\FWJCNK.exe
1⤵
PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 804
  2⤵
  PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4500 -ip 4500
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2892 -ip 2892
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4220 -ip 4220
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1124 -ip 1124
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1672 -ip 1672
1⤵
PID:3288

C:\windows\EFO.exe
C:\windows\EFO.exe
1⤵
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYHI.exe.bat" "
  2⤵
  PID:1020
- - C:\windows\SysWOW64\ZYHI.exe
    C:\windows\system32\ZYHI.exe
    3⤵
    PID:5676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMI.exe.bat" "
      4⤵
      PID:4408
    - - C:\windows\SysWOW64\ZMI.exe
        
        C:\windows\system32\ZMI.exe
        5⤵
        
        PID:3352
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DCOUQU.exe.bat" "
        6⤵
        
        PID:5084
        
        C:\windows\DCOUQU.exe
        
        C:\windows\DCOUQU.exe
        7⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXS.exe.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:6012
        
        C:\windows\SysWOW64\VXS.exe
        
        C:\windows\system32\VXS.exe
        9⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VALANWA.exe.bat" "
        10⤵
        
        PID:5240
        
        C:\windows\SysWOW64\VALANWA.exe
        
        C:\windows\system32\VALANWA.exe
        11⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\EYXKYZJ.exe.bat" "
        12⤵
        Executes a command shell one-liner
        
        PID:2636
        
        C:\windows\system\EYXKYZJ.exe
        
        C:\windows\system\EYXKYZJ.exe
        13⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 784
        14⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 1368
        12⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 868
        10⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 980
        8⤵
        
        PID:4588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1364
        6⤵
        
        PID:2088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 1324
      4⤵
      PID:704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 996
  2⤵
  PID:3472

C:\windows\AHVU.exe
C:\windows\AHVU.exe
1⤵
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 812
  2⤵
  PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1368 -ip 1368
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1204 -ip 1204
1⤵
PID:3984

C:\windows\SysWOW64\EIY.exe
C:\windows\SysWOW64\EIY.exe
1⤵
PID:5608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 840
  2⤵
  PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2308 -ip 2308
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5608 -ip 5608
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4196 -ip 4196
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5676 -ip 5676
1⤵
PID:4776

C:\windows\SysWOW64\ZYHI.exe
C:\windows\SysWOW64\ZYHI.exe
1⤵
PID:5472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 776
  2⤵
  PID:2888

C:\windows\SysWOW64\IYFDD.exe
C:\windows\SysWOW64\IYFDD.exe
1⤵
PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\RAIZ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:1664
- - C:\windows\RAIZ.exe
    C:\windows\RAIZ.exe
    3⤵
    PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\DLXF.exe.bat" "
      4⤵
      PID:3360
    - - C:\windows\system\DLXF.exe
        
        C:\windows\system\DLXF.exe
        5⤵
        
        PID:3240
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KQYSV.exe.bat" "
        6⤵
        
        PID:4944
        
        C:\windows\system\KQYSV.exe
        
        C:\windows\system\KQYSV.exe
        7⤵
        
        PID:3404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 1376
        6⤵
        
        PID:124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1000
      4⤵
      PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 1356
  2⤵
  PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3352 -ip 3352
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5472 -ip 5472
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2960 -ip 2960
1⤵
PID:4444

C:\windows\SysWOW64\ZMI.exe
C:\windows\SysWOW64\ZMI.exe
1⤵
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 816
  2⤵
  PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3996 -ip 3996
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 624 -ip 624
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4740 -ip 4740
1⤵
PID:4944

C:\windows\DCOUQU.exe
C:\windows\DCOUQU.exe
1⤵
PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 804
  2⤵
  PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1492 -ip 1492
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4656 -ip 4656
1⤵
PID:4268

C:\windows\RAIZ.exe
C:\windows\RAIZ.exe
1⤵
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 808
  2⤵
  PID:5556

C:\windows\SysWOW64\VXS.exe
C:\windows\SysWOW64\VXS.exe
1⤵
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 832
  2⤵
  PID:6208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 3240 -ip 3240
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3312 -ip 3312
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2052 -ip 2052
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1996 -ip 1996
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2388 -ip 2388
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3404 -ip 3404
1⤵
PID:6276

C:\windows\SysWOW64\VALANWA.exe
C:\windows\SysWOW64\VALANWA.exe
1⤵
PID:6336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZYS.exe.bat" "
  2⤵
  PID:6720
- - C:\windows\system\KWZYS.exe
    C:\windows\system\KWZYS.exe
    3⤵
    PID:6916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCSMHRX.exe.bat" "
      4⤵
      PID:6156
    - - C:\windows\SysWOW64\RCSMHRX.exe
        
        C:\windows\system32\RCSMHRX.exe
        5⤵
        
        PID:5792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNIKV.exe.bat" "
        6⤵
        
        PID:4400
        
        C:\windows\SysWOW64\FNIKV.exe
        
        C:\windows\system32\FNIKV.exe
        7⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TIULB.exe.bat" "
        8⤵
        
        PID:6852
        
        C:\windows\system\TIULB.exe
        
        C:\windows\system\TIULB.exe
        9⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 848
        10⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1376
        8⤵
        
        PID:6232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 1008
        6⤵
        
        PID:2888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 1340
      4⤵
      PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 1036
  2⤵
  PID:6832

C:\windows\system\DLXF.exe
C:\windows\system\DLXF.exe
1⤵
PID:6372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUFFRDB.exe.bat" "
  2⤵
  PID:6780
- - C:\windows\SysWOW64\PUFFRDB.exe
    C:\windows\system32\PUFFRDB.exe
    3⤵
    PID:6888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 832
      4⤵
      PID:7132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 952
  2⤵
  PID:6856

C:\windows\system\EYXKYZJ.exe
C:\windows\system\EYXKYZJ.exe
1⤵
PID:6628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 784
  2⤵
  PID:6976

C:\windows\system\KQYSV.exe
C:\windows\system\KQYSV.exe
1⤵
PID:6648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 796
  2⤵
  PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6336 -ip 6336
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6372 -ip 6372
1⤵
PID:6792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6628 -ip 6628
1⤵
PID:6940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6648 -ip 6648
1⤵
PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6888 -ip 6888
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6916 -ip 6916
1⤵
PID:572

C:\windows\SysWOW64\PUFFRDB.exe
C:\windows\SysWOW64\PUFFRDB.exe
1⤵
PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HDCNUR.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6696
- - C:\windows\HDCNUR.exe
    C:\windows\HDCNUR.exe
    3⤵
    PID:6652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 744
      4⤵
      PID:7136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 932
  2⤵
  PID:6872

C:\windows\system\KWZYS.exe
C:\windows\system\KWZYS.exe
1⤵
PID:6244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTBZXH.exe.bat" "
  2⤵
  PID:6824
- - C:\windows\SysWOW64\NTBZXH.exe
    C:\windows\system32\NTBZXH.exe
    3⤵
    PID:6632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 832
      4⤵
      PID:6480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1308
  2⤵
  PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5792 -ip 5792
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4268 -ip 4268
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6244 -ip 6244
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2772 -ip 2772
1⤵
PID:6576

C:\windows\SysWOW64\FNIKV.exe
C:\windows\SysWOW64\FNIKV.exe
1⤵
PID:6956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 828
  2⤵
  PID:6560

C:\windows\SysWOW64\RCSMHRX.exe
C:\windows\SysWOW64\RCSMHRX.exe
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6956 -ip 6956
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6632 -ip 6632
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7060 -ip 7060
1⤵
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6652 -ip 6652
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6996 -ip 6996
1⤵
PID:6472

C:\windows\system\TIULB.exe
C:\windows\system\TIULB.exe
1⤵
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\VZSRC.exe.bat" "
  2⤵
  PID:7008
- - C:\windows\system\VZSRC.exe
    C:\windows\system\VZSRC.exe
    3⤵
    PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6380
    - - C:\windows\SysWOW64\AAO.exe
        
        C:\windows\system32\AAO.exe
        5⤵
        
        PID:6384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 852
        6⤵
        
        PID:6796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1016
      4⤵
      PID:6568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 908
  2⤵
  PID:6292

C:\windows\HDCNUR.exe
C:\windows\HDCNUR.exe
1⤵
PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\EUCQEF.exe.bat" "
  2⤵
  PID:7012
- - C:\windows\system\EUCQEF.exe
    C:\windows\system\EUCQEF.exe
    3⤵
    PID:4580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\EXYS.exe.bat" "
      4⤵
      PID:6172
    - - C:\windows\system\EXYS.exe
        
        C:\windows\system\EXYS.exe
        5⤵
        
        PID:3496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 832
        6⤵
        
        PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1008
      4⤵
      PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 964
  2⤵
  PID:7044

C:\windows\SysWOW64\NTBZXH.exe
C:\windows\SysWOW64\NTBZXH.exe
1⤵
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\DZER.exe.bat" "
  2⤵
  PID:6732
- - C:\windows\system\DZER.exe
    C:\windows\system\DZER.exe
    3⤵
    PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAVDTZ.exe.bat" "
      4⤵
      PID:6480
    - - C:\windows\SysWOW64\LAVDTZ.exe
        
        C:\windows\system32\LAVDTZ.exe
        5⤵
        
        PID:5940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 788
        6⤵
        
        PID:6332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1364
      4⤵
      PID:6304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 996
  2⤵
  PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4480 -ip 4480
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4924 -ip 4924
1⤵
PID:6976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3464 -ip 3464
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2824 -ip 2824
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4580 -ip 4580
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2432 -ip 2432
1⤵
PID:6972

C:\windows\system\VZSRC.exe
C:\windows\system\VZSRC.exe
1⤵
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 804
  2⤵
  PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6384 -ip 6384
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2084 -ip 2084
1⤵
PID:6220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5940 -ip 5940
1⤵
PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3496 -ip 3496
1⤵
PID:6164

C:\windows\system\EUCQEF.exe
C:\windows\system\EUCQEF.exe
1⤵
PID:6884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\KOCW.exe.bat" "
  2⤵
  PID:5420
- - C:\windows\system\KOCW.exe
    C:\windows\system\KOCW.exe
    3⤵
    PID:4600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 840
      4⤵
      PID:6624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 1308
  2⤵
  PID:4776

C:\windows\system\DZER.exe
C:\windows\system\DZER.exe
1⤵
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SWP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6252
- - C:\windows\system\SWP.exe
    C:\windows\system\SWP.exe
    3⤵
    PID:6968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\HWMPGBH.exe.bat" "
      4⤵
      PID:1424
    - - C:\windows\system\HWMPGBH.exe
        
        C:\windows\system\HWMPGBH.exe
        5⤵
        
        PID:6984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 788
        6⤵
        
        PID:1276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 1020
      4⤵
      PID:5848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1332
  2⤵
  PID:6892

C:\windows\SysWOW64\AAO.exe
C:\windows\SysWOW64\AAO.exe
1⤵
PID:6600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\MQLE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6464
- - C:\windows\MQLE.exe
    C:\windows\MQLE.exe
    3⤵
    PID:6376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BGFCDLU.exe.bat" "
      4⤵
      PID:7044
    - - C:\windows\SysWOW64\BGFCDLU.exe
        
        C:\windows\system32\BGFCDLU.exe
        5⤵
        
        PID:6168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 832
        6⤵
        
        PID:5176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 1332
      4⤵
      PID:5132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 1356
  2⤵
  PID:2604

C:\windows\SysWOW64\LAVDTZ.exe
C:\windows\SysWOW64\LAVDTZ.exe
1⤵
PID:1844

C:\windows\system\EXYS.exe
C:\windows\system\EXYS.exe
1⤵
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 796
  2⤵
  PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6884 -ip 6884
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4192 -ip 4192
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6600 -ip 6600
1⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1128 -ip 1128
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1844 -ip 1844
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4600 -ip 4600
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6968 -ip 6968
1⤵
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6376 -ip 6376
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6984 -ip 6984
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6168 -ip 6168
1⤵
PID:2428

C:\windows\system\SWP.exe
C:\windows\system\SWP.exe
1⤵
PID:6256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FAYGVT.exe.bat" "
  2⤵
  PID:7096
- - C:\windows\FAYGVT.exe
    C:\windows\FAYGVT.exe
    3⤵
    PID:6396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6396 -s 744
      4⤵
      PID:6624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 1324
  2⤵
  PID:732

C:\windows\system\KOCW.exe
C:\windows\system\KOCW.exe
1⤵
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\TSXD.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2624
- - C:\windows\system\TSXD.exe
    C:\windows\system\TSXD.exe
    3⤵
    PID:1252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 844
      4⤵
      PID:7028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 944
  2⤵
  PID:3832

C:\windows\MQLE.exe
C:\windows\MQLE.exe
1⤵
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\AUGOAAK.exe.bat" "
  2⤵
  PID:6860
- - C:\windows\AUGOAAK.exe
    C:\windows\AUGOAAK.exe
    3⤵
    PID:6688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 748
      4⤵
      PID:6448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 944
  2⤵
  PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6256 -ip 6256
1⤵
PID:7104

C:\windows\SysWOW64\BGFCDLU.exe
C:\windows\SysWOW64\BGFCDLU.exe
1⤵
PID:6300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 824
  2⤵
  PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1388 -ip 1388
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4700 -ip 4700
1⤵
PID:3032

C:\windows\system\HWMPGBH.exe
C:\windows\system\HWMPGBH.exe
1⤵
PID:7092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 804
  2⤵
  PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6300 -ip 6300
1⤵
PID:6424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7092 -ip 7092
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6688 -ip 6688
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6396 -ip 6396
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1252 -ip 1252
1⤵
PID:7076

C:\windows\FAYGVT.exe
C:\windows\FAYGVT.exe
1⤵
PID:6196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TEGQDSF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2604
- - C:\windows\SysWOW64\TEGQDSF.exe
    C:\windows\system32\TEGQDSF.exe
    3⤵
    PID:6964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KENVPIA.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4388
    - - C:\windows\SysWOW64\KENVPIA.exe
        
        C:\windows\system32\KENVPIA.exe
        5⤵
        
        PID:6684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 844
        6⤵
        
        PID:6940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 980
      4⤵
      PID:6268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 976
  2⤵
  PID:6768

C:\windows\system\TSXD.exe
C:\windows\system\TSXD.exe
1⤵
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 800
  2⤵
  PID:7088

C:\windows\AUGOAAK.exe
C:\windows\AUGOAAK.exe
1⤵
PID:1276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\AGH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:1716
- - C:\windows\AGH.exe
    C:\windows\AGH.exe
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\LWC.exe.bat" "
      4⤵
      PID:4756
    - - C:\windows\LWC.exe
        
        C:\windows\LWC.exe
        5⤵
        
        PID:6236
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DRN.exe.bat" "
        6⤵
        
        PID:7112
        
        C:\windows\DRN.exe
        
        C:\windows\DRN.exe
        7⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 844
        8⤵
        
        PID:3940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 1364
        6⤵
        
        PID:3032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 996
      4⤵
      PID:6912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 944
  2⤵
  PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4560 -ip 4560
1⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6196 -ip 6196
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1276 -ip 1276
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6964 -ip 6964
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2416 -ip 2416
1⤵
PID:7156

C:\windows\SysWOW64\TEGQDSF.exe
C:\windows\SysWOW64\TEGQDSF.exe
1⤵
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\BMQ.exe.bat" "
  2⤵
  PID:7116
- - C:\windows\BMQ.exe
    C:\windows\BMQ.exe
    3⤵
    PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 844
      4⤵
      PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 1356
  2⤵
  PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6684 -ip 6684
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 1132 -ip 1132
1⤵
PID:3280

C:\windows\SysWOW64\KENVPIA.exe
C:\windows\SysWOW64\KENVPIA.exe
1⤵
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 836
  2⤵
  PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6236 -ip 6236
1⤵
PID:2488

C:\windows\AGH.exe
C:\windows\AGH.exe
1⤵
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 808
  2⤵
  PID:7152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 920 -ip 920
1⤵
PID:6516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2480 -ip 2480
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 432 -ip 432
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2956 -ip 2956
1⤵
PID:6660

C:\windows\LWC.exe
C:\windows\LWC.exe
1⤵
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\IVNZSFI.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\windows\system\IVNZSFI.exe
    C:\windows\system\IVNZSFI.exe
    3⤵
    PID:6952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIRI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6368
    - - C:\windows\SysWOW64\DIRI.exe
        
        C:\windows\system32\DIRI.exe
        5⤵
        
        PID:6940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 848
        6⤵
        
        PID:4432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 980
      4⤵
      PID:6416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1336
  2⤵
  PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:964

C:\windows\DRN.exe
C:\windows\DRN.exe
1⤵
PID:6528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 808
  2⤵
  PID:3512

C:\windows\BMQ.exe
C:\windows\BMQ.exe
1⤵
PID:6864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6864 -s 804
  2⤵
  PID:6624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6952 -ip 6952
1⤵
PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 6528 -ip 6528
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6864 -ip 6864
1⤵
PID:1044

C:\windows\system\IVNZSFI.exe
C:\windows\system\IVNZSFI.exe
1⤵
PID:6620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\BTV.exe.bat" "
  2⤵
  PID:3832
- - C:\windows\BTV.exe
    C:\windows\BTV.exe
    3⤵
    PID:6660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\FUK.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:6872
    - - C:\windows\FUK.exe
        
        C:\windows\FUK.exe
        5⤵
        
        PID:6212
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QMTZP.exe.bat" "
        6⤵
        
        PID:1044
        
        C:\windows\system\QMTZP.exe
        
        C:\windows\system\QMTZP.exe
        7⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MDV.exe.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:6644
        
        C:\windows\system\MDV.exe
        
        C:\windows\system\MDV.exe
        9⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 740
        10⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 1000
        8⤵
        
        PID:6412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 1012
        6⤵
        
        PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 940
      4⤵
      PID:5776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6620 -s 944
  2⤵
  PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6940 -ip 6940
1⤵
PID:6332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6620 -ip 6620
1⤵
PID:6640

C:\windows\SysWOW64\DIRI.exe
C:\windows\SysWOW64\DIRI.exe
1⤵
PID:6876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\YRJOG.exe.bat" "
  2⤵
  PID:6756
- - C:\windows\system\YRJOG.exe
    C:\windows\system\YRJOG.exe
    3⤵
    PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZQV.exe.bat" "
      4⤵
      PID:6452
    - - C:\windows\SysWOW64\MZQV.exe
        
        C:\windows\system32\MZQV.exe
        5⤵
        
        PID:2284
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\IFPZDY.exe.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:5328
        
        C:\windows\IFPZDY.exe
        
        C:\windows\IFPZDY.exe
        7⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 832
        8⤵
        
        PID:6408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 1004
        6⤵
        
        PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 984
      4⤵
      PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6876 -s 992
  2⤵
  PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6876 -ip 6876
1⤵
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6660 -ip 6660
1⤵
PID:5848

C:\windows\BTV.exe
C:\windows\BTV.exe
1⤵
PID:7136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\WCSLS.exe.bat" "
  2⤵
  PID:6388
- - C:\windows\system\WCSLS.exe
    C:\windows\system\WCSLS.exe
    3⤵
    PID:7052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\XQY.exe.bat" "
      4⤵
      PID:2204
    - - C:\windows\system\XQY.exe
        
        C:\windows\system\XQY.exe
        5⤵
        
        PID:6764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 1376
      4⤵
      PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1304
  2⤵
  PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 7136 -ip 7136
1⤵
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6212 -ip 6212
1⤵
PID:6944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2348 -ip 2348
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6740 -ip 6740
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2284 -ip 2284
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 7052 -ip 7052
1⤵
PID:1580

C:\windows\FUK.exe
C:\windows\FUK.exe
1⤵
PID:964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 808
  2⤵
  PID:3288

C:\windows\system\YRJOG.exe
C:\windows\system\YRJOG.exe
1⤵
PID:6508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 808
  2⤵
  PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 964 -ip 964
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6508 -ip 6508
1⤵
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2304 -ip 2304
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3328 -ip 3328
1⤵
PID:6976

C:\windows\system\WCSLS.exe
C:\windows\system\WCSLS.exe
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6764 -ip 6764
1⤵
PID:1704

C:\windows\SysWOW64\MZQV.exe
C:\windows\SysWOW64\MZQV.exe
1⤵
PID:6184

C:\windows\system\QMTZP.exe
C:\windows\system\QMTZP.exe
1⤵
PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 796
  2⤵
  PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5580 -ip 5580
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6184 -ip 6184
1⤵
PID:824

C:\windows\system\XQY.exe
C:\windows\system\XQY.exe
1⤵
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 808
  2⤵
  PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4980 -ip 4980
1⤵
PID:5176

C:\windows\IFPZDY.exe
C:\windows\IFPZDY.exe
1⤵
PID:6448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\JUCPP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5776
- - C:\windows\system\JUCPP.exe
    C:\windows\system\JUCPP.exe
    3⤵
    PID:5200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZTO.exe.bat" "
      4⤵
      PID:3288
    - - C:\windows\SysWOW64\RZTO.exe
        
        C:\windows\system32\RZTO.exe
        5⤵
        
        PID:6808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 980
      4⤵
      PID:6164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 964
  2⤵
  PID:3096

C:\windows\system\MDV.exe
C:\windows\system\MDV.exe
1⤵
PID:6768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SPEGRG.exe.bat" "
  2⤵
  PID:6664
- - C:\windows\system\SPEGRG.exe
    C:\windows\system\SPEGRG.exe
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\KSWQBR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:5176
    - - C:\windows\KSWQBR.exe
        
        C:\windows\KSWQBR.exe
        5⤵
        
        PID:6592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1012
      4⤵
      PID:6436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 944
  2⤵
  PID:6316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1836 -ip 1836
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6768 -ip 6768
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6448 -ip 6448
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5200 -ip 5200
1⤵
PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2036 -ip 2036
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AACP.exe.bat

Path C:\Windows\AACP.exe.bat
Size 54B
SHA256 8f91d2874b3562ab047f154699869248a0250eaf100a36bc42da6bcbf78d689c
MD5 e5b42e5351af39bbfc6378599c1bc5f1
SHA1 a384e04ef7359b3977ca52c25fb0d988c5ceff8d
SHA512 c9964df9af31db6a1aabb5e79fd7081cc5efefe0b7bb6c65ae03ef5acad849c8801bfa8db81672e4460b49d73d718e2e502f7eedd6650230b8d6a679c6a72c1f
MD5 SHA1 SHA512

Submit Download

AFZM.exe.bat

Path C:\Windows\AFZM.exe.bat
Size 54B
SHA256 a2eb1170fa75a986310b09e428b3596cde3ee6bcbc91bfdb297d66988c615e9c
MD5 cbcccf615b5c0f89143d70cf8d57de18
SHA1 321f910add1ef709a4ed10dd1a6986f0dd2e5f80
SHA512 233d04fef53396e98285215cf7438c06f6bb44966e8899c3b49faf304ce47288aadc0833c50bcbef48a6920b880e808945e94096a2eba27af83f2ee6c130a3e8
MD5 SHA1 SHA512

Submit Download

AGH.exe.bat

Path C:\Windows\AGH.exe.bat
Size 52B
SHA256 bb7f502d394539329b3ccfb2b0344ddab0b8a9c4419d321cddda167fa9495890
MD5 5295cd7826e0d472cd3ca11fcba81d31
SHA1 29bed790b31fb9efd7707a5c2b7279563a30065d
SHA512 abe2405a08da7242591d6ca6b38fd1006462a063c08a765f0572ac6f4192ff31dcab526dc30de444066231fc5f0aa525b4cee0d939ecc041c1e572bc6a873ff0
MD5 SHA1 SHA512

Submit Download

AHVU.exe.bat

Path C:\Windows\AHVU.exe.bat
Size 54B
SHA256 55e22ebbdb80ff2d4d3579877f95f21ef5cf97567c7060202a9c77e3e91f79f6
MD5 c3f3ecb334dacbabd07abe35b01eea3a
SHA1 9d2b50236ff0f6b0d3a6f7dc6efa7371e003485c
SHA512 b9267e96bb6a2a944f656e7b0fb4b694f9f8f4134ea9ce5970d680751e338dc5c367a8cde252f36bd3b96ed84d079f8311e1d1b25e9729652a8e45a1980c38f9
MD5 SHA1 SHA512

Submit Download

AUGOAAK.exe.bat

Path C:\Windows\AUGOAAK.exe.bat
Size 60B
SHA256 675ccbcec3e5992bb5706c193c19a422c80ba68277c8c306ce7cc7fa21c472f8
MD5 3ac0191634f336ae414377a14e15f825
SHA1 58fe3ea88cb231d706e3b49dc1eb3879102e7903
SHA512 093eda76f069c277b54e0cca24a18747dcd7a0a52e25e995df43e5a78b8f116fc08bd72bd535ae35147bbbb543d5bcf2c0825d7f6297d2c9583186d9edb9fa1a
MD5 SHA1 SHA512

Submit Download

BFERUGQ.exe.bat

Path C:\Windows\BFERUGQ.exe.bat
Size 60B
SHA256 372b23d0b348e79545d0839b5462609283dee2aff7111f9a1412647a3d98453e
MD5 d711806c638c4f27befcf1c72eca2307
SHA1 9c7640422a30cab37dff29555be8f679c57e2bc5
SHA512 17b9ec48b41be09b74fa67a827accc6a2cb54cc41a4a265c3c32441fc88407e89840578b4a498ddc98a0f016b7a9e371c5cdb68ecb40acc0d040114dbcc5949c
MD5 SHA1 SHA512

Submit Download

BIVQZ.exe.bat

Path C:\Windows\BIVQZ.exe.bat
Size 56B
SHA256 feee3aca998fec466b50438985e190a770360e936d9ad80ed4e95eb43d725176
MD5 3b912a04b02507819eb99085ae8ab949
SHA1 d197fa622691da34237b75f4f3da1681c5dc4416
SHA512 50c42cfd4920337a4d318d634c201ccc8f4ef9a946d62bc3da3bb356034802240dbc5758ab6d49764acbb3fba83cf4a8c9317d027be15ec5197f5894147b9fb0
MD5 SHA1 SHA512

Submit Download

BMQ.exe.bat

Path C:\Windows\BMQ.exe.bat
Size 52B
SHA256 22e30057b1809f242e8a4d392833ec5e7770af24c48443d2facc604ccd9148ca
MD5 7a8fe63ce580324107d9922494aad65d
SHA1 d77912dfca4b58e44ce9ac1b6c3ddcb0f3b72517
SHA512 8be31f05c009e4aeb925dc3880aaf7da91882acad1d73cd40210f4ad8b80f14ca119146593ea070f608b7f18201f82b81b2593882d8ec5161401916d16859a39
MD5 SHA1 SHA512

Submit Download

BRIEI.exe.bat

Path C:\Windows\BRIEI.exe.bat
Size 56B
SHA256 691f97ea39e08e4be9f448cb5d79a5f28454e6576cd248b0b0560100562976f6
MD5 f95fa68d58980bc0849083d0ba9ee048
SHA1 168f5b5e24daeae976db7cbf82bbb9c4bd2ab1fa
SHA512 829a82f1e2ac61b409bf17382d69a28196a10d0b847819139144e0557d1b3e770e439f2780db5fdf05b267bf41803689e04530be2d8a132217ed52ad7ace453d
MD5 SHA1 SHA512

Submit Download

BTV.exe.bat

Path C:\Windows\BTV.exe.bat
Size 52B
SHA256 f56ec3a6f2c0d782b086d0e56f470697e3f6e98ef9a419498daefda3380d87ac
MD5 c51508a07c62ea17c7bf371c39d0497c
SHA1 8fb8e438f3d8e3f2fa93e285deb7149afe2d722d
SHA512 924f0204bd15501bfa75192fb4ccc71c143fe31cc3cddd3af611bc19422acb4ab6f1104314535eb540572ded154ad7cc4caa1941cf844fd757bb3dfcf8143833
MD5 SHA1 SHA512

Submit Download

BZTU.exe.bat

Path C:\Windows\BZTU.exe.bat
Size 54B
SHA256 8e3c6e616e868c52a25dd0fcf548bf0159254b87de4d49fe65df1a337f26052e
MD5 40ebe6d3dd21d600287a8ae8ae8d3f07
SHA1 de70e4f6911c3e6f0cac2ee577c376f3e2a52952
SHA512 cb26977c511065a85bf688b3479b59005eda8ca22d821558f05de8b32fee634856bff97d4f433c27f8aa63a19b0b120e16120b273f3ce8685f7495f7e9847ba7
MD5 SHA1 SHA512

Submit Download

CVJJH.exe.bat

Path C:\Windows\CVJJH.exe.bat
Size 56B
SHA256 4a8d7070b2ba716f742b4d31f45ba99f719a259faf29d5354869b7f847c11fca
MD5 db7cefd028f442d692c7b228430c2dd7
SHA1 1e34d8501429e564d5c568f1c2537e3369697cc7
SHA512 79bd7aa6d13eaaf179fb2603166462af82bed091077e4116a6d8709826e3b7c2ec1777bd7bf9d2a2112ccdb01ecaaca899ac30911eedb55b375d5710b555e5cf
MD5 SHA1 SHA512

Submit Download

DCIX.exe.bat

Path C:\Windows\DCIX.exe.bat
Size 54B
SHA256 96cb2963c3d5423b057520ec1d283b8dbce14d0dc4d28875e61c8040adf2adc8
MD5 d1eb192bca60c451371cd02686feb611
SHA1 1c40e8c2ea30965a1b6fb68d0b6deaea0fbbba18
SHA512 965f7bb9759ab83b2a933a365787531fd0a2e1afb0894bfe7937b78eacac67f654fad99b12adad13466ca0d51bd0781c53310c19f1e4038a67e070be96f1599f
MD5 SHA1 SHA512

Submit Download

DCOUQU.exe.bat

Path C:\Windows\DCOUQU.exe.bat
Size 58B
SHA256 4aa027f466bc35af8fe88097acc554ef63f871935032651246ed2dec92185c4e
MD5 bd7ad40d0675a9818f0d116b8a8adf9d
SHA1 0210cddab180e8bd350421c841e16f8827c5c613
SHA512 14bb984182c3e0f4f706b9f132a92fc9ddb4311411d7bf5c64d0c73e91b3570a9e516de777350abaaf938e73211bb5c7949a5a80431dd95859bd06afd3e2bd55
MD5 SHA1 SHA512

Submit Download

DOPFLOW.exe.bat

Path C:\Windows\DOPFLOW.exe.bat
Size 60B
SHA256 4bd35f934351a12b2210433bd8977c50498beaed49add7f254c9f8b4a5fe04ca
MD5 b6135d23ee3ec5e653a6318c9d91e375
SHA1 7df8e161a39a29256ea02257320d35177548c28d
SHA512 11d7247f62db53123f5e0899cd2fbfbe4fc122f1297dacf2a5f0ad8340fc7b9fb677308d9cfb03188dd6ae951c2e68c69f277fe8a015c8685ef7d0aeb1faf4cd
TLSH
T17EA0023A0AC130E08A34404DE34E3700040AF6C80B10A000129F08E06204E7B82C00B2
MD5 SHA1 SHA512 TLSH

Submit Download

DRN.exe.bat

Path C:\Windows\DRN.exe.bat
Size 52B
SHA256 1607e10216c5469a38a141b36608e0f00e382448941d74a380e978b8dec94b65
MD5 c97caa1437c1f19959310b480a48f8b6
SHA1 3136dde244790af9058c3361be7bef3da4efe236
SHA512 b23ae7529e38a96c98d44759d7b8f1d06d4061b1fcafe824849b35cc3735985214885c1db1eae928feb7f2db00499162132a848030b3eaf9225b0bd127d7f8bd
MD5 SHA1 SHA512

Submit Download

DZAT.exe.bat

Path C:\Windows\DZAT.exe.bat
Size 54B
SHA256 0bfde58495e9f75e4d217a6fdb3c5038846fc66ca05aa9bec484f62e96b8534f
MD5 1419f507d3ea7951e7db3566be295ee9
SHA1 e9fe97690abfef0c761e7b7fa851c40af6c79da5
SHA512 b3d25c1a460517311771acb2df82da27e12f74fbaf41853d54d6ce7be152fdf2e04b87759d26f11446486839b5e4731dfde9f80b25756735d06b5709654ebc6c
MD5 SHA1 SHA512

Submit Download

EFO.exe.bat

Path C:\Windows\EFO.exe.bat
Size 52B
SHA256 a80713ee4284552fa8ef27e3d2ab90bad2130b6c6354fd2a5c3bf36425717ef0
MD5 e5f79acb2e97816b1e03b67dcfb8b1d0
SHA1 5e1237213db3afb6687eec78b59fe541618e4b80
SHA512 568b070c88f2f24588f3737bb7885623c3c99d83d29ef91800ef25c9b54e0a75b20cf62f4d5670fb9103705d372ea1fab338e2bce68c179608e8d5f9bcbdb77f
MD5 SHA1 SHA512

Submit Download

EYIFP.exe.bat

Path C:\Windows\EYIFP.exe.bat
Size 56B
SHA256 ba04cc1edf2d890413e514460fdaa1386f6d96a3ce12f5525f245cbe318c2b7c
MD5 3b1e74f373fc711e6e72075ac42e3f82
SHA1 e87b53c9abfa10f46eefc415d83056708662432c
SHA512 a3d5a2a867b515689b5e4c49d4a7ed1f4e9d4165cd6ef909684861f2edd892a66e21c8ebf066087839cd2e181fff7709b142d1bc99136bbdbe1be41469e229ce
MD5 SHA1 SHA512

Submit Download

FAYGVT.exe.bat

Path C:\Windows\FAYGVT.exe.bat
Size 58B
SHA256 907b57e17ffb96ec98ec4f17ec99411e142a496b8248fdc3ad708dd84ce5adae
MD5 775d79ae772862623329fa770bc28f27
SHA1 19f79460c88adff4b6b67f83cd57bb45802ee6ce
SHA512 8bb9493e7844915f8eb69855e414d11b0ee884fb0e87fb2443bf955f351eadbf3f4fff48f487267ae9c2833be896e6fdcfc62f865db088161f8e75c66e131f53
MD5 SHA1 SHA512

Submit Download

FUK.exe.bat

Path C:\Windows\FUK.exe.bat
Size 52B
SHA256 63c9267326f43184cc10b33bcb8fa0efde139d44959e09085dab40dddc07a06b
MD5 212edc6eaeb026e287c1c76bc0477c7f
SHA1 1e278d28d5035109f31e1ce9bce4235e0fcf3d9f
SHA512 b6859b98103fab02a5e935214b1585bf8f13ff6496f3d3e59536eaadfcd9721dcf8fe7aa893c53691cd12db874037f484184463fe6bd02a6414e96c21098572a
MD5 SHA1 SHA512

Submit Download

GTBO.exe.bat

Path C:\Windows\GTBO.exe.bat
Size 54B
SHA256 66272403b387636ddae8e23a9ab83dc14002738ac4bc602bd166a905e63a2386
MD5 2c5f3129e21fee79f01debb8e63b4483
SHA1 0ebc4bacea18087405307d1137bba8f09e84d6e8
SHA512 eb6bddab5abf8eda001173397ebc5c77da2c3551768b185ac8eb02fed16abf582f1f86e13cdcf2dd2a33e4d55b1d0322597505e0b04be5e94c8105568df3cd50
MD5 SHA1 SHA512

Submit Download

GWGYYV.exe.bat

Path C:\Windows\GWGYYV.exe.bat
Size 58B
SHA256 ae8afc9f65fa6e97a3ad9cf2e9b6821cfe38cb7ba6a8843ad60744a2b3461807
MD5 8c26ccfa4eb6716384727a21ac5e085c
SHA1 ae623f0fd85affd84b6a181e45e4b6b39b6bc2f3
SHA512 be0f6bd33dda0d84124054bb0d1c1101b218850c292b3eb8f264f1cdbad91085f2eaf9f4168bb0712ecc7767f44fd23a51efeff990c50b20e26edbedd933aa58
MD5 SHA1 SHA512

Submit Download

GZYB.exe.bat

Path C:\Windows\GZYB.exe.bat
Size 54B
SHA256 c5dd834ec7334563014db225f7ae0deaeec800696de10584da84833284ea11ca
MD5 869b75e55b196a7e193e52b1f5014f05
SHA1 227204994aae464c73d0326eebcae6c4f6ecca79
SHA512 abc64bbab4a32616aec77136f7aba7ca43a75685fa7434b0513a7cafce85bfebea318d9b73688febb2f3d27e2caa57e42f6c6585db5478e230717f1719d46c82
MD5 SHA1 SHA512

Submit Download

HDCNUR.exe.bat

Path C:\Windows\HDCNUR.exe.bat
Size 58B
SHA256 d883acc690afb1b3bd2c1da3d571d10a7d36982359b112795b3712c4097ca501
MD5 161786ee8e6b638dad91838a1a1e786b
SHA1 73e47751db3fb0c33e0aeef294387d9dc8138118
SHA512 2df7f55e7468465389590d256dcc5b535c5675529e7d14349b445aa514d48fbdcc28afc4fbfc8bad8a616f93e36fee8ffa847dec29727bda113ab539e1bed1d2
MD5 SHA1 SHA512

Submit Download

HIWHLW.exe.bat

Path C:\Windows\HIWHLW.exe.bat
Size 58B
SHA256 7ac17022ca29dc59bbdb6502d20a5cac2a6450a8edcc3f90fa764b2a1f465599
MD5 258afc649141857b4dcee966eef5f2a6
SHA1 47d96c1315684c86bc08ff2c8b5b29cc94a52099
SHA512 7002f1c297b3881cc6d67d51ffade8934daeae980d1012f6875d47825062f9e501ef6173bbde1a10f23442314055afb35ced631a0a3b458377c383fbd3ea3f02
TLSH
T1F5A0023008E1AAC0C8244A49634A3708E40BF4400210000A129582A260246E3A0000B0
MD5 SHA1 SHA512 TLSH

Submit Download

HIZDS.exe.bat

Path C:\Windows\HIZDS.exe.bat
Size 56B
SHA256 7ff7b00849366f8ed62f58bf4b22a991bb598717d3446acc8a91b3d1caf0e896
MD5 61ad2002a156af96e637e57623159255
SHA1 12427465834a79c92afa7f05ad99116b246780f3
SHA512 bb240dd0ed6fac9b0f180d093357496a519d910acc8a17d57591044a5599588babfed2d496dc7fcca2066dfba32f7c6b3e6f068604de2fa2ace77de9577e67b9
MD5 SHA1 SHA512

Submit Download

HPX.exe.bat

Path C:\Windows\HPX.exe.bat
Size 52B
SHA256 e2ba947b618d40cd06ef2dd97069595ecaff405fe96706223ad2b9babe1aad45
MD5 48aa885ecec42a2de96420cbe97a2b3e
SHA1 3269792c13f824edcb62c8443e26dd54f64c2cf2
SHA512 6fdd86701f9bd50424578d41139fe9e2f12eb64ce93e0fc1b3f97774700497e487f9e73d1e2f20716f9771a08d9e1e1186a82c9da74c40c09a5c6a2ed983c427
MD5 SHA1 SHA512

Submit Download

IFPZDY.exe.bat

Path C:\Windows\IFPZDY.exe.bat
Size 58B
SHA256 f5db2cdde5fd299a5d9dfd78863e6a4270fb0837c2a79cb2156b27b1efc153b1
MD5 3a4ca91251e4070a397e5ffe133771e5
SHA1 5faecf7d29b181550139b0ec82b2068469c0b68a
SHA512 58899ac1dff73430f96e6c7b59cdb0ad8698fb63efe0901b39650b23709b4bbf80cbe17992067b85ab4f0c1792683d17dd65f5984f20112b81bdd63eac0dffa8
MD5 SHA1 SHA512

Submit Download

IRESCLQ.exe.bat

Path C:\Windows\IRESCLQ.exe.bat
Size 60B
SHA256 f03f6cae9d50711faab5c0f9dcbc9f2dba6a7a408b3c0958095cd81fa8348a58
MD5 57c576b291f05ed9c34305de89859d8b
SHA1 cb8674c53edca87b5004095bc6897f0eff2ac040
SHA512 6a704b8147fa933fa05b4e8cd1e683d4ebf43b99101098c6b0ff60d943c05d34b2db351ee0b77a554801884064969c06b14b27cff95b5a388762c83419a7d15c
TLSH
T134A00230A8C320CC88B4CA4BE34A37000E0FF440A23083001A3500E8700664B80000F3
MD5 SHA1 SHA512 TLSH

Submit Download

JIKRKJL.exe.bat

Path C:\Windows\JIKRKJL.exe.bat
Size 60B
SHA256 f39fafe28fff37165d390ef6aaae51a308a6ad7f56fd4c5e19cc0a7037b52ef6
MD5 e961330f66c279b4b11b8399516199d9
SHA1 60e66fe161fca34051fd6ee67d0ef410da875200
SHA512 3181cdeabfd614d47604afbc88349ec303b39a953bbb6a69ace97a2d366ed359640d68b17c811644308a7f8e04252e43666aa3ea2474f56d563413e05a834901
TLSH
T144A002B208C122C08826C84D436A37820E2AFC6002100002BA1F0080608E44BA0800B0
MD5 SHA1 SHA512 TLSH

Submit Download

KSWQBR.exe.bat

Path C:\Windows\KSWQBR.exe.bat
Size 58B
SHA256 faea327a4e80f25c288c08d7a154718d15bc26bd39cab2db110c0a3040f88d1d
MD5 94a77c212d1bc66be03ab1dfc59726ba
SHA1 99e69f942bca750ea29438d2c80e403b19c23d05
SHA512 93e0303d30afcb4a89c19b555b8840bb5dac50dbeb405c7b9a1ee9f324138ceee0a450e0536848cc648c116f07a7c49094fa26f5bb40089c3fa02c7ac37d34c6
MD5 SHA1 SHA512

Submit Download

LWC.exe.bat

Path C:\Windows\LWC.exe.bat
Size 52B
SHA256 35c24517dc37880bf150f40e053234ab1e438993681cd446d99ec9c1bce51b8c
MD5 6d9a409b9413a5f4fba98a1299ec32b7
SHA1 d6f03cdb4833c99b765386b7c39dc5c2f790a7e0
SHA512 85fab627af096982b6ffc14763daed59c0d93a0793980da6757520830cf456712f7641a1dd0e89cd78395b3ad96935fc658c98cff6c5b0f10c63a9de0addedb2
MD5 SHA1 SHA512

Submit Download

MLK.exe.bat

Path C:\Windows\MLK.exe.bat
Size 52B
SHA256 9c6fb75b53a97603b1f32829952df053862198a5365c2a100e22596e089314c9
MD5 d82a0719b89c5d5f59efe3e8e828c158
SHA1 ef110cd5b2c55adffb777c7274599354278e8fbb
SHA512 e52ad6f2352273e8936874ccb8e57557077a4ab3291e383c9e4b684e0ec5aadb9c539799293873f09283b77bba517476ee843fadcb1fc293baf732365a20a4cd
MD5 SHA1 SHA512

Submit Download

MQLE.exe.bat

Path C:\Windows\MQLE.exe.bat
Size 54B
SHA256 599e6fe91f6c1d9164dd1d33135f090ffb1db57b95f3720ab15cbc9155d05418
MD5 9cd479e8757066423737b34d0c304b98
SHA1 4c76f3fc2a16c6149c3d6b30a123c8d66a750e77
SHA512 dda3fd18aed4af2eba0b476266f820d4f4c615993eceb526d59d6d6daef703b4ae4de9428eef03c5b4e678de35f9581e033739d053e670e371ee2b5e5c347ed7
MD5 SHA1 SHA512

Submit Download

PCQDW.exe.bat

Path C:\Windows\PCQDW.exe.bat
Size 56B
SHA256 7f28c914744fede6069d57a8550ba83a82a41e0f45eeb79b3dfa288413cab9db
MD5 92b6792bd3ec70c7026e9c2ee4d3e346
SHA1 103a85dce2f022272ddbdffb9346fdf6bcdc0f9d
SHA512 c895a2467ee0ca23b32231e07dd199edc6bb54db82cdb04c0364c53c585fd1a24f08962fb4e6c9a1b62a04ce83f934469ce1d8d14537cf5177d8473acfc1d29a
MD5 SHA1 SHA512

Submit Download

QAFLLE.exe.bat

Path C:\Windows\QAFLLE.exe.bat
Size 58B
SHA256 81f861d906ab432731a68c058fe4d2a89d53b92bfa9d7b96de0696c42020c87b
MD5 6f13508fef1fb2730503ce596c69a818
SHA1 cc046b63f3af864ff7c1c64dad349aaa20aa759c
SHA512 c14f8e4d60ca6ac7982d9904230656031c95dc3fad6617b5bf64a6173941a5a349449524fab4506f223f20ccbb220ded5d526db7485c7445df94651623fe9cd0
TLSH
T198A002300AC320CA8C266049634B3F28840EF4400212E20C121508806027C4380803F0
MD5 SHA1 SHA512 TLSH

Submit Download

QCUDH.exe.bat

Path C:\Windows\QCUDH.exe.bat
Size 56B
SHA256 0ac57d6896f7420e42e2653633f836dd176d67c1885533432f18c94a06edeba8
MD5 f3a7a75a706eb9af190c52e508a451aa
SHA1 8847b0a8b0e56c85cbd57fa0d5a956212785e4a8
SHA512 d35b3af14a12b6cdb9402e1ea6b669656914735d48c72e96307da9b9aa813d0444b930cee76d59b1f0e6bef05d8edf00e4b1c4b9ea71668514dbfaae2c70eb1d
TLSH
T15590023088C12AEC8824C2C9434A3730860EF440023080281395088060864E3A0200B0
MD5 SHA1 SHA512 TLSH

Submit Download

RAIZ.exe.bat

Path C:\Windows\RAIZ.exe.bat
Size 54B
SHA256 7054d61fb2e52004693512f4d84c94480be1444b70cd0b064bea2db61fea51a9
MD5 24cfe1653a25906614c7f71154fa3d74
SHA1 d62fe21ae27668e5289d1ec954453e4a6b1ba63c
SHA512 b782a8073c4cb3fdcad3c7720d6e1fd26d27309d30596bcb216457dc9bc16d599371cad09b7f2bfb45e8754a1c45fb0c76c2b08ab180df7c76dbcdd33c5d1705
MD5 SHA1 SHA512

Submit Download

ROPGVHH.exe.bat

Path C:\Windows\ROPGVHH.exe.bat
Size 60B
SHA256 f4b00921496e0783865ec4a988e5504b1a4c6de108a5cf30df5550aa0b39478b
MD5 1b3c9e9782d7b50025fa1ce5e8220b51
SHA1 87c2164755256a741a8669ec4350f24fc9bb8900
SHA512 9676a0561914a6680dc0815ec0bc16dd88d59c621217c2ae2bd868a873e96fc78261126d7397927cd5f5c83d8b4441ce3cb5b26073c368155cda548ee7e0f6da
TLSH
T100A0023808C120C8C8A44849CBCBB720060AF6420290000013152A8070A446B80000B8
MD5 SHA1 SHA512 TLSH

Submit Download

RXDHVHZ.exe.bat

Path C:\Windows\RXDHVHZ.exe.bat
Size 60B
SHA256 842cca2fb15751fa5c0c3393deb44dea49b3033c144622fd4cc39cc2ad7c2dc6
MD5 1a95cc249665e75b98f72f54f55b8fbf
SHA1 7a437c9063570fa21fdc04520e8c7bd33a7319a2
SHA512 4914fca13105de8507336e4949bc8760edb5f2bdbcac6ea29422d5cd6d186d7cef8badfe9d8212c627bbaa79521d256c6c19c4ea6cd7400e8efb85912b6bab2e
MD5 SHA1 SHA512

Submit Download

AAO.exe.bat

Path C:\Windows\SysWOW64\AAO.exe.bat
Size 70B
SHA256 9aa262504de03552d3af02f9118796a54af3094259ef006a90e04fe744f691bd
MD5 b6788a041734dfa7b10a0a87907988ec
SHA1 c8e7c05096f6ab68e8575548d79aa0d976052b8a
SHA512 1efa241e41fbbfb95fa2b3a07fec3f5fcab8eebc39552478791544fa1d2a8751d458d1dc62a725d31d3acc78b4e757f47fc79c0f6692c8550355996ab644c3d1
TLSH
T151A002380BC1ABF08824406DC34AB730062BF44AC3100030129522C3E00446B8E2ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

AMQ.exe.bat

Path C:\Windows\SysWOW64\AMQ.exe.bat
Size 70B
SHA256 393709f960fbe998ebfb81497c22e32151d123c9aa3c680be93cef5b3766eb0a
MD5 0cf29f8d692d898a67135bcac4d9aee9
SHA1 8e18f066769ea25bc0ad6c8a820aa732b5e10397
SHA512 a0a0b52b793ead792a4cecc2a1468a7d68e185309a1041a99ebfc11e6051cd014f68f02a3e6cdcf5e64bc52a5458df46eb9066889cd13b52b7da0abec26f4af3
TLSH
T192A002300AC128F0C824426DC34A3730242EF44A031800201E9520CAF80646B8E22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BGFCDLU.exe.bat

Path C:\Windows\SysWOW64\BGFCDLU.exe.bat
Size 78B
SHA256 9a95254a7370dfdf6cedcfa04ad1b502eb8a1e7d5922ca5de6feb3f7d6da37bb
MD5 5ce57f5a36c9c330a0fe21dff5004733
SHA1 0d7bd401c5872ae96e89d3cd39f4832fe8352ab7
SHA512 d099294b86f75074027a6f8f8fd0fd2cc1723e606ea17333638d6ed6cb59b59310ccb320f2958a85328a670864eadd6239a1d64c662e14e348b7ccbe7e847d9f
TLSH
T166A002300AE1A0E0882440EDE34E37E0043EF6CE03300A2C129520C2E084C6B8E30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

BMAFVZF.exe.bat

Path C:\Windows\SysWOW64\BMAFVZF.exe.bat
Size 78B
SHA256 2575721e7c6202aa273d4bbc240e4c7aa9eee3487e311c311c0f1bd22815de99
MD5 c141e4237f15f4fd60f7b870eff71817
SHA1 7e966df41702c370e5ae74da74dea800e792a061
SHA512 42d70f26ceac330204dde7952b4f35d3e6f11d1836280e3ea22ec0170ec3a88e074be62b1e92762b05cd6fea23b1357ba5c15e636c9af31896e855c084d17bd2
TLSH
T1AFA002300AC330E8A8AC406DC34A37A3242AF4EE0B380020129728E2E20444B8EB0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

CHIIZ.exe.bat

Path C:\Windows\SysWOW64\CHIIZ.exe.bat
Size 74B
SHA256 f657904ac841c327155fb5caed0c665411a5585318d7a683681e42a99bbcb87e
MD5 91e1ed2e400022dd943566d540c97a12
SHA1 e7e7ea846219fd0d6e6777091bc10effeefa1fba
SHA512 7739f00f62e748211a5763a062e61ceb645fe16e2d6a4b0928b83d08613a75ca7e8d469d7351ffc6514acb08451dd3b74ec0cf7606b2f34c947f557ba14fd4ca
TLSH
T150A004310FCF30D44414C05DC34537304555FD4543100011355551C3D0054474571C7D
MD5 SHA1 SHA512 TLSH

Submit Download

CIE.exe.bat

Path C:\Windows\SysWOW64\CIE.exe.bat
Size 70B
SHA256 1ca6c2187fbdb4c7b771f965b5b19cd89c80a3ad063da4d6de28210a0e8c7f56
MD5 2ca408c57406195f99baea989d240bde
SHA1 c3304def91ee29cca965c64870b0902b1fbae29e
SHA512 64577b2cc3366ff227dcc74967f3bdbf0d6d796a22dfecdf6dddd5dac70ddbb0b911b0d30fb7103750eefc99bc0cbd4a636fc7249ca22bdcad9b3b52b4f4ee63
TLSH
T1F3A002B00AC330E288A4406DC34A37200C3EF44A831280209A9DA0C3E80444B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CUKGIC.exe.bat

Path C:\Windows\SysWOW64\CUKGIC.exe.bat
Size 76B
SHA256 d890b4ef7abebe212a9a9c4d5cc5ee4aa4dadb9ee005d4630b83807642185c5b
MD5 e4819541f427499c8c5b62bd0e2a893e
SHA1 6c87a8ca78a402ed4864e796c7635e9c0caec4a5
SHA512 0e897b7d52771fe8763d3a242a31fc878aea0d6a2abeccca8691763ee2e07b4b70fc75ebe7d6491e02cdee0f97c25df728f7564c8a23d4481a8a3b78b1353c8d
TLSH
T17EA002302AC1B0F08C24627DC34B3720042AF64B83100B281BD5A0C3E004CCB8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DIRI.exe.bat

Path C:\Windows\SysWOW64\DIRI.exe.bat
Size 72B
SHA256 5133ac3ac23534d4a20478ab19c9b399d496ee601f436b2014ff2196417e7a2a
MD5 428bc81d9e38dae94be15d4eda73b5d4
SHA1 9eee567366081093e87ae0ceee22846e24e07914
SHA512 354fc550f9255653116f0fe5273c7cd21d0ce59de306c45ff5175f6dcce06ccc3a921e5fda9a6d86eec62aac1a83c6b66223a82edaf84a47036737ba88c318ff
TLSH
T1E7A002300AC120EA8834C26DCB4A37A004EEF44A831083A0129730C2E80444B8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DXZWN.exe.bat

Path C:\Windows\SysWOW64\DXZWN.exe.bat
Size 74B
SHA256 c70c3a036a1c748a437d810a1630e5d8b709718c4233f973fc4d9d8fbee55149
MD5 78aa9454fae494ec2cd2c6d2e734f949
SHA1 319d468c235bdac0e39ffdf4ec420b780ca757ce
SHA512 3a0ed77e2e9c662480900c7872eb1fc53abb1ff4dd1941a4bf46505887aa85346e9eea419c6031a2939afd7655daac113802e188ac127d5f9a57eeb63bfa7e66
TLSH
T105A002380AC920E0C82440EDE34A372004EEF44A839082209E9728C2F20444B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

EIY.exe.bat

Path C:\Windows\SysWOW64\EIY.exe.bat
Size 70B
SHA256 d4bb768c7a0af07dcfae7c8f49e3e39c1c9b5aa78760871765330438227811c2
MD5 21b1326ad02b4c903015949c5f4d5009
SHA1 d21cce36cf0bb577ea37a8326d11d02744ce107f
SHA512 c0f596a38c1cd8180fce432099980eb66c7fcb507caf847409068b697cacde057feb662aafcebcb35ce7459d13026665ca0aa436a0a0e4149ff942f6293f87dc
TLSH
T137A002320AC120E8A824406FC34A3720043EF44A8B90802012D528C3E00444B8AB8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FFWRJH.exe.bat

Path C:\Windows\SysWOW64\FFWRJH.exe.bat
Size 76B
SHA256 f4b87af9bf3f3c4906d335be44ffcdb9a8ac1fc31070f400cb2b4dd71aa0cdfe
MD5 be2afbc42f41ebc08325e3743c2f01df
SHA1 03867352cdc6e0d7a36e16bef2286f032e0482f9
SHA512 37c5c6c2e317f11477dc96669c866eb0c64c4fc5021b662c7e61ac0bc4247da2fe30912e943d248b20e9a4cdf21f6ace9103281d52c5935d0729fea8d72722a3
TLSH
T1A1A002308AC928F8CC26706DC36E3738042AFC6AA31020201B95B0C2E8C466B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FGFCP.exe.bat

Path C:\Windows\SysWOW64\FGFCP.exe.bat
Size 74B
SHA256 b5176a778a9d55d2e8ec795ae784d776593cce7300a14379b6374671249f9ed4
MD5 5cf529043a73b7bd55d178c56e3c3266
SHA1 d26abc7dc44ce9ffc9c038d741a3c81d615a5ed3
SHA512 0abd5c6f3a3c9dc339335d4ecff9c151975f4bb63c3702b45784ad196463947d2d0000f8701f4f4c56123057d5ba795b309e104edffd965580bd14d6dbd645ad
TLSH
T128A002380AE128F28824606DC34AB7A804AEF64E033030AE129520C2E00444BEAA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FNIKV.exe.bat

Path C:\Windows\SysWOW64\FNIKV.exe.bat
Size 74B
SHA256 5e5727da65becb7c3db8c4fe79d80460f5befe3184dc49b166141dcbc01ae2c7
MD5 d2efba71a750b519c52709d2a67cecdd
SHA1 5be20c2e6c65bf088ef50c5e204de7e936da5a93
SHA512 e040c2217f717216bbf75be81ea907b8f136dcd26b5be6eb91dddc14d7355550c112f8f2b753e4738a8d42aa798bfa52b7c51daccd8c2f8c89753437a21a8ee5
TLSH
T140A002320AC128F0882C406DCB4A372C063AF64A0B30A023129520C2E30C46B8A20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

FOOXLKX.exe.bat

Path C:\Windows\SysWOW64\FOOXLKX.exe.bat
Size 78B
SHA256 8e8700eddd982d796dad08b125d9fd1b69e803082f0a89405a8aafc2387d5cc3
MD5 9311eb416d1e009930cb8e97fca325e9
SHA1 baeb7c2b8adc026baeb233729d0890c624f01287
SHA512 693bcb7c4e4a743d20df1e32d0788e7f223b9a288200ed320212459feb3ecc45398c1b96f9e844aa4f0fdf1105e0ac2e910162ca00f56f354e4e11ebc2a49907
TLSH
T154A0043405C154F05C34445DD3473714DC15FCD54330D054117730C3D0044474570C74
MD5 SHA1 SHA512 TLSH

Submit Download

GGBUPVA.exe.bat

Path C:\Windows\SysWOW64\GGBUPVA.exe.bat
Size 78B
SHA256 b4bde1dd01cf17a261d27969f6bac64d83ded0b98f10caa455451870488a7c1b
MD5 79e71211e678dd43a7501fa10ee895a6
SHA1 eb375a7d9b7f9139a74d6e6c54477fa7d99781c3
SHA512 4288ff9f9df9e06674819c0a1e50a3fac446af94d5f0e0b3442bfe2b6ef242df1a13f63dde023d2ae02cf0c0639559619ba93d7dcb00916cf6f15ddb4321dc8b
TLSH
T12CA002308BE13CE08C24406FC34AB7208CABF44E031000F8129FA8C2F00C44BEB20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

HIOGYKT.exe.bat

Path C:\Windows\SysWOW64\HIOGYKT.exe.bat
Size 78B
SHA256 05e32b1bca9bae38311257cc370eb5d412a05bb20f7cc93678682eea1f3e540f
MD5 35f211fa23803c3a26ec4c6f673186bf
SHA1 176e0bf903929b6f1e605d975250228f7f58d515
SHA512 15632450b0fb2dd549e20e0aeea97c2e36d80307c03e451d8de47d9e165213cdc187c7fe883bc07a95ab6d75a75e71e697a7c8977d18889e7818093599c639d5
TLSH
T177A0043047C310D4C414405DD3457750041DFC4503314514117711C3DC054474515D74
MD5 SHA1 SHA512 TLSH

Submit Download

IHTI.exe.bat

Path C:\Windows\SysWOW64\IHTI.exe.bat
Size 72B
SHA256 cebd98c8727cf37e5dc973e5c349ecb672af9cd58d451e31d84d43550561b79a
MD5 8c5335cbf85ba8cfd1cc22cda6250cbe
SHA1 587ba2a7c944327652787705bd3f267194c8190c
SHA512 f0a805f7e48b4c0a2cd632c53c6561513170fa65e9835ee2e85924507e8dc3f158599a6b2c62252a0f33ac82473cf49028acf825701cfd7a0089ba0ef6de6e99
TLSH
T169A002B00BC122E08C2440FDCB4A372084AAF44A031008201A95B8C2E00444B8A20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

IYFDD.exe.bat

Path C:\Windows\SysWOW64\IYFDD.exe.bat
Size 74B
SHA256 58c13fd99e4f38dba940e9e2d133b677b90acc63b6ca68e67164a358b5290ec0
MD5 b28f1424b8da83f5dea301c40e01be24
SHA1 05582d1f980a606cc9a043078c6b96aad1646c00
SHA512 5539678fa939a2c87f96b24e4a168571672ee10c764becd8952d8c721bdf6b69e16102d274dc7bf9fa503b22ec86316ebdd91c73e1c031520adfc46e43a23b87
TLSH
T162A002B00AC1A8E08CA4406DC34A3720042AFC4A0312083312DD28C2E00444BCB28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IZOOMU.exe.bat

Path C:\Windows\SysWOW64\IZOOMU.exe.bat
Size 76B
SHA256 b10cb1a71241d684e6cbd168e90be888291f81b5373fa2d2f4f53151e7cd31ee
MD5 dcaea43d528150bfb45e6ab54b2372b1
SHA1 d3788ff1e74a35c33754917f10c9bbbb4d74193f
SHA512 4186f9efc7a7a08572e76713cebec6702e0d98ad5227a1a63564007a3e38326d4fc287466e205e7a9306fc8c7593d9fa7a6200ea447ba2b5e1177e3366c0d695
TLSH
T1A4A0043015C310D0441440DFD3557F100475FCDD07140130137514C3D004C47C554C75
MD5 SHA1 SHA512 TLSH

Submit Download

KENVPIA.exe.bat

Path C:\Windows\SysWOW64\KENVPIA.exe.bat
Size 78B
SHA256 9d23e1f14b8930f105644ed0ab216230c6af2ff43ea21e1e93f0513d77b7d007
MD5 b447d2eb838b0db5e02ce4e64a72c743
SHA1 e3ff9a8d057889b9d6d3c6a14c62514d931d3ac5
SHA512 0af8c85b31256a31336811f65c523b7ffd0590ebba3f2fe1bdec46ab19c006c1fbf4761b94d0f0938193984ce10553506d2378d64db5675e8e1d898c346bf440
TLSH
T143A0043045C310D15C5440DFD34537110C35F45543300010115D14D3D40C4CF5530CFC
MD5 SHA1 SHA512 TLSH

Submit Download

KOUALL.exe.bat

Path C:\Windows\SysWOW64\KOUALL.exe.bat
Size 76B
SHA256 e87b77bd986dc6d508dc9aac2681f848419f36b36defc6088a1dc63735fa80ad
MD5 1b417cdfbb3bd4702e23078380d92960
SHA1 e561b46a18f6191ec3923390029810ff52cb024f
SHA512 f74f7295677573912964dba428371465781800111ed005ef835de41a9846f0e04f7ec5b8a62a7dad2356dd362f5dc03684f4dea8183c7db71c57ca50a1cbdb1d
TLSH
T1D4A002B00AC920E0B82CC06DF34A3720043AF4CA03102020329528E2E00CC4B8AB0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

KVZNS.exe.bat

Path C:\Windows\SysWOW64\KVZNS.exe.bat
Size 74B
SHA256 07c8ac92dfd153712035346a5057784eada98f71d7b445a062a1fa8c19b9fa88
MD5 a722f388e98415a7ed6ce7bbdf34a418
SHA1 48ed2fe351ec05be9a4d50f039ab28bf9698baf9
SHA512 77bc0fd355d3e0a6570e774a4b990d8cc10b7a695a3073dcdf73d91ccbadfdfe6ef2ae72c5c1bf30d4669d30ad90b1bcfec525248b695f408700acb0a4065b59
TLSH
T1D8A002380AC1A8E0CCE4486DE36A3720063AF4CA031082209395A8E3E08C44B8A28CBC
MD5 SHA1 SHA512 TLSH

Submit Download

KWQAZ.exe.bat

Path C:\Windows\SysWOW64\KWQAZ.exe.bat
Size 74B
SHA256 d905c96e6be62793756bb3be8636f675e8dec6db504fd0693cd0d1e6f6211163
MD5 d4f74a06ba3c74f2b4f0180fce772e2e
SHA1 187261157aeadfad9d719bc3abaed977ae3e12e4
SHA512 f2a3a7c5815a9eee616c6d139a879577d69d96780d4a4f87503cf730498f34d8b73b8b1660b075f937688454d395543a67c9940b96675f7f2847c6d46058c1b0
TLSH
T16AA002328BC322E0CC24406DF3CA3720063AF44A03120020129D28C2E00C44B8B3CCB8
MD5 SHA1 SHA512 TLSH

Submit Download

LAVDTZ.exe.bat

Path C:\Windows\SysWOW64\LAVDTZ.exe.bat
Size 76B
SHA256 ef1397248622dd8471d2fffe01422f882ceff71c32642365f1d3627df50a9316
MD5 525628fee55bffc527fe482c5fa613ad
SHA1 8ccaf5086416240ab82ebf36360b22fac1f43129
SHA512 8da209bf5a58428ab93d35dbf685f39490ff3aa20fa3fe36805dafd0e20cfcb568b03e78fa88ddcf7851854769cd419c7139fc61264358dcd7a3a45928e3e007
TLSH
T149A004770FC317D44414435DC34577104D3FF45503101050515515D7D4044C74550C74
MD5 SHA1 SHA512 TLSH

Submit Download

LVOXQUK.exe.bat

Path C:\Windows\SysWOW64\LVOXQUK.exe.bat
Size 78B
SHA256 4bdbd52c97243d1c39e1671abe1fef60c292ed269ec4eafe6ee206e8301b65fc
MD5 fef9f7afa6c7eac5efb74b3544fce121
SHA1 ed3f89dac762d013b8d36a6bb755a9d0fc9b899d
SHA512 e65bebfa45732bded78779dc57e15ab1889db7ab7637fee370907909ea1ffdadaaa6d0003f32936c8d62f0fe823e4ca948a30f364326e0263aef33e5b0ba03b1
TLSH
T172A004300DC175D04414415FC34537740415F445031D005151D777F7D4074474510C74
MD5 SHA1 SHA512 TLSH

Submit Download

MMX.exe.bat

Path C:\Windows\SysWOW64\MMX.exe.bat
Size 70B
SHA256 f48a3ee4b08a6501d2cbb320f253f69c18e58a672b4fca8bc8c719098a44b08c
MD5 0da9322dea6178e187f2a1c074fa4999
SHA1 bf950c5c058494f986e8491ba69ccd61fea08567
SHA512 fd55375187e7c68309e62516d5d8c78f5f6a2a351d3ffe0dfeb41727cc31bcde722466326700aafe6fd429095ed96dd32dddfaf319c440d11c8b0720b822de32
TLSH
T1EBA002380BC320E08E24406DC34B3720A42AF4CA031880A0129520C3E80644B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MZQV.exe.bat

Path C:\Windows\SysWOW64\MZQV.exe.bat
Size 72B
SHA256 9b4a2e2b45fa4c9dc3919e7b1d859c9c859c367cb95a90be08324f818ffc5260
MD5 8c7a2f23bec2f8591e0cd7208f4a4791
SHA1 3156741540c047d33664add9b8b46aa3085320ad
SHA512 6b2e8c6df5295b8518e4a8e24022af9a7d74259e6dc6046b8d404e44401b42ac74b6daacafe163d929a80d29b5820a8b6602a92313ad16da03b9905b609ebab3
TLSH
T1ECA002382AC128E08A24407DCBCB3720072AFC4A0310803A139520E2E80644BAA20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

NBOVCHE.exe.bat

Path C:\Windows\SysWOW64\NBOVCHE.exe.bat
Size 78B
SHA256 5fb5ad80abb9f060c90d81a8bb902cd3fe84bb421303034b80dd79d63483448a
MD5 b933182e45449a0e7a0c80815c46f6a6
SHA1 a757a115741f78bc7209d9af90006216bcc2937e
SHA512 0446f402ad4dbe2b1cced2a1e318d13efabf75800614b68c716236b5811752101ca4a69aff20087f0500dc022bbeb646b8882c19b459219999474731ef758a9d
TLSH
T160A0043005D35CD15455405DC34537140C35F54D03514050117530C7F014447C550CF5
MD5 SHA1 SHA512 TLSH

Submit Download

NECAXTS.exe.bat

Path C:\Windows\SysWOW64\NECAXTS.exe.bat
Size 78B
SHA256 24c1a393b6f46aa3fc676235ffb45d7607160e8c4a9f23be3cbaea27f364a0d2
MD5 74d726cc89dc5701c03e9727b2847b18
SHA1 38e255b301cc0ebe69fd981486e239ed20bf6033
SHA512 40e488fc9e32d2f3faa33c30d4019876e7d1b5cd979bffe4db7468234e35ad2f2d2509732e0140f37481fcf6f0aea28211e99c35c4bc08a2738e7dfe40244d4a
TLSH
T1E4A002308BC122E28C26407DC34AB720043AF4CE03100020929DA0CAE02C44FCAA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download

NOAPME.exe.bat

Path C:\Windows\SysWOW64\NOAPME.exe.bat
Size 76B
SHA256 b07cc394984120367ccc0071125604b9e5974f480d28d1f059a22362532489d4
MD5 2c61e96f56c9acff901632c8ea3ebc77
SHA1 d15bd96917bb5f8855a6a777a16051110bf6ff48
SHA512 b777676bc1325e1940a188024afc6777589ef9da6cb488464a7c1020cbf9aed526899f6fc0fe56b429a4a00bc581b5a4ef51c4173135fa1c5e1a225fd47b95af
TLSH
T188A002300FC328F0883C406DC36A3F20243AF64B033A8820129D22C2E88444FCBB8EBC
MD5 SHA1 SHA512 TLSH

Submit Download

NOIZMQJ.exe.bat

Path C:\Windows\SysWOW64\NOIZMQJ.exe.bat
Size 78B
SHA256 8a1345bb8cd476721de0c4a94d08582fe3fc0bcb4b02ab6574df0634fe44502a
MD5 ec8c3f30980a74151a5583f468a2ad18
SHA1 98a44242688f7b65f1b03534b3791a63261dc0b9
SHA512 a8683d92c3882aabcee3223c2550a87332969048f10920ded24fc6c87b2ecc5f867a0b06fa798567291568bcaf98b8df30f92b6356a0b1933ba80d5aa5300829
TLSH
T194A002302AC12CE0AC2C40EDE34A3F38043BFCCA03100020129520E2E08644BCAB0EBC
MD5 SHA1 SHA512 TLSH

Submit Download

NTBZXH.exe.bat

Path C:\Windows\SysWOW64\NTBZXH.exe.bat
Size 76B
SHA256 7ca2c88744ab3c961b2a9fc4a420cefb221ef81e64795434b0094b896e16c468
MD5 dba9e0d27bc573f4240b37a3e8f99302
SHA1 43db43f12dee7424d523fc9e5e9f9154c5468c47
SHA512 3c70fe64c3266c70bbb43b8fee7b75a1a228204206400e6c4f33dc14efbf68037280a9831a5b513de67520183886263a98a66c1a4ae4f3b8be55663528036f20
TLSH
T12EA0023C0AC120E8BA24407FC36A3F30843AF44A031000A0139520C2F88446BEAA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NZXAWBA.exe.bat

Path C:\Windows\SysWOW64\NZXAWBA.exe.bat
Size 78B
SHA256 15bbc41b78b0e1127d66bc031d190cd55344ac2d1cec1114372cdc71bcef7398
MD5 bf079eb6bdcd1a2bb16aa655edf5ff65
SHA1 47ab343c03b9cae63fd98e05dcee8c592212f8bb
SHA512 52a2f00ec1c44eebc3e3dea438c354f88e1d1e3a161d23881fc47c3e20b6afa71872cb39f3e7bf764e6b45d15ff1834bf846e7aa03489f931e8ec79bb97c7856
TLSH
T128A002B20EC1A0E28824406FC34A3F280C3AFC4A03100230B39D20C2F00446BCAA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ONFU.exe.bat

Path C:\Windows\SysWOW64\ONFU.exe.bat
Size 72B
SHA256 91b182b59eea20fb153e4025a5a30b5446a00314624d0bda71e331b19d588cc0
MD5 5b1a769cfef9895593c75d757796b35c
SHA1 1255d22a973a7b309e5311337dc5052c548fb434
SHA512 4ce32b0de1af2ebfdc4d07b0989f6ce90e7c1a890ebd808c5fab51feb697956db2c80b133c31eb8a37ab1244f41bf527c6d0366923e99f763ffd5dcad783429c
TLSH
T1A9A002300AE120E888AC40EDCB4E3738042AF4CA83108030929530C2E004E4F8B20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

OWRB.exe.bat

Path C:\Windows\SysWOW64\OWRB.exe.bat
Size 72B
SHA256 eaa8629d92e5f4cb99a49cf3f8583b778e8eaaacce369b63722682da69d7ba63
MD5 e6c500051ad991fefd7dd4abaa3a8e87
SHA1 34c093edaf886a7f380c5418ba9924c2011e5907
SHA512 2924816dcaa57651bad983e942d66596885c441242d528092ad11b8fefe0537e71a7b0b8ad3fe238f21e73e79f8de7ffc5b746a6f5d4d81f0b34b9ff8b6050d7
TLSH
T1B5A002300AE120F08834406DC34AB72804AAF44A031002A0929522CAE804C4F8E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

PCKYN.exe.bat

Path C:\Windows\SysWOW64\PCKYN.exe.bat
Size 74B
SHA256 f1a102a39636554a1290af20c13db9ccd6f392564156e627eb614f2d978f4a6b
MD5 ecd894a147c63787c3d221f376fb7456
SHA1 b635aec1baddf89e27cfcdc49042c7d5b3bd28d4
SHA512 3fc5a41adcf72ed83b3d6fee3eaf34d0ffc7048aef17486865b88ba8f1c136c20b4733bb6b7eb9a419d7b1109ebd77245e5fc389db60b26d5d8500a821dfacc0
TLSH
T141A002B02AC120E0882C406DC3CA37282EAFF44A0BD00230929528C3E00444B8EA0EF8
MD5 SHA1 SHA512 TLSH

Submit Download

PMAHJR.exe.bat

Path C:\Windows\SysWOW64\PMAHJR.exe.bat
Size 76B
SHA256 55b95d67b8ace12d5fd489e9151af0aa38586c41d68d32f1f856037c139348cd
MD5 23bae9c1f2fbe781a4a9ed20d4f38316
SHA1 06473bbc034874887df741c6c46e199a2c8b5bae
SHA512 1fd7dd1a02bfd0fd920288a8d6ee4c3aed5f0f4ccb8ed74240d3c8b35131eacd6a51bf6ade1829e7f4ac4b8dc4239d9d8c1fba8e312368cfc5d97983f6254780
TLSH
T14CA002320AE122E88A24406DC34A372024AAFC4B0B1000201A9520C2E00444F8EB0EF8
MD5 SHA1 SHA512 TLSH

Submit Download

PUFFRDB.exe.bat

Path C:\Windows\SysWOW64\PUFFRDB.exe.bat
Size 78B
SHA256 461c91524b7eb72a1f944e5735379792d598e65c65a4facc4200c72e4292576a
MD5 faccfb815c2b414f61bb8a4d3c37c840
SHA1 771bde7ff0833b689bfb08bfd17e35405cde7f9a
SHA512 7115b01acc9c85f661dd7e34ac0f5e6370e858e047f5bcc20c2699ebb35d5ffb78a4357f0b89ad8567e96ecdc669deec7f1fd2d27af9d6422f3b1014e26e8ab9
TLSH
T188A0023C0AEB28F08C244C6DC34AB7E00C2EF44A0B120020929520C2F00644FAEA0EB8
MD5 SHA1 SHA512 TLSH

Submit Download

QDQXADA.exe.bat

Path C:\Windows\SysWOW64\QDQXADA.exe.bat
Size 78B
SHA256 ff55d01e721a0a2572dedeb3265b036292e7537e66138c86bbc88a0226a3d6b8
MD5 0eff7a6a7b205a1f07a2fdf1fc5e6ac0
SHA1 94c6462bfc99f19567d0eb1badb399053ba256eb
SHA512 7c970805bf42a2983c9f1c2090031586b077bc1523528546909383398f6cc0a6c47a439e059e7f6450fa1d2394f6a60426696a22eb952613ad3621087d69a6a6
TLSH
T155A002B08AC12AE8E826606FC34A37200C2AF44B0318002A1B9F20E2E00444F8A20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QEY.exe.bat

Path C:\Windows\SysWOW64\QEY.exe.bat
Size 70B
SHA256 b76aab5e26a50c2440c4c9945e24ed08e94ee7b39845b40f1682296823c6e8ef
MD5 033e60e05e758a6f9cb798f55a3d9414
SHA1 fa30bdcc1973d0899b6f4735aad08d0659f4fb36
SHA512 4a97d71535e7b8fb0086e84c5d09edbb4a0ca2b8d6f286cfab29e26d383c7f9c7d94fc101862121c30f251c257243f02c167ba5fa6b64076ee1650d7c1b50f9a
TLSH
T1DDA002300AC1A0E08824406DC34A3720043AF46A8B100020129520C2E00644B8AA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download

RCSMHRX.exe.bat

Path C:\Windows\SysWOW64\RCSMHRX.exe.bat
Size 78B
SHA256 f2b972720d4dc7a45981e5c378b5cdeb12274c2a4e5534f3163733af7f78e6d0
MD5 e391c19fffb89ba2bc0b4790a77037f6
SHA1 ab10e9c9c68e76b4928c51f2af911e13145c069b
SHA512 a01dfbf8aad5b0a6de8e1889381939dd88f3ad47eaf7b24868b5e0e4ca993e9cc31d56e8386cd2120b164b68ea89084455c9e479404042abba3c9d8329f9811b
TLSH
T1AEA002300BC920E8CC24406DC3CA3F3084AAF4CA03130AA01295A8C2E024C4B8FA0CFA
MD5 SHA1 SHA512 TLSH

Submit Download

RFTRFLB.exe.bat

Path C:\Windows\SysWOW64\RFTRFLB.exe.bat
Size 78B
SHA256 553044468207358f6ba81116eccbd172df73eac60080922152c08c0d0e2e0917
MD5 da2f3e60e17b32f797ef84d2303c1f85
SHA1 44163881e2132691f9ab2232bf1763df0daf9b30
SHA512 18e8f87e65af62f09aa6d30a7dd43ff28f43c8a7c144c622ab58dfd846630e7925f3ea9947628f77bd94570b171009b0330c5faa9a0a9c354c667495db49267a
TLSH
T1FCA002300AC320F0882CF0EDF34AB720042AF4CA031A00201295B0C2E00446B8E2ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

RXG.exe.bat

Path C:\Windows\SysWOW64\RXG.exe.bat
Size 70B
SHA256 2ae96a70b7c5fb2c75c80822756096984e9d832c5946abf44d42953b2ef4e017
MD5 b8550c1fe27dbc8ef23ef56e4df91b58
SHA1 322e1bfd407b5eb802ab896cdc8ea144f8a594cf
SHA512 caa3345d70264c3659f34db1296152dcc52d72d18d3c6e14f35ad569ad2879fc7d5ab69b21d56e0b23420e19b1eec05905c904ad834ba76af123f0d3637f8bb4
TLSH
T1AAA002300AC930E08C24406DC34A3FB2842FF44A03120020B295A0C3E20444B8E28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

RZTO.exe.bat

Path C:\Windows\SysWOW64\RZTO.exe.bat
Size 72B
SHA256 e402533150477f9fde2cbc6b7699854950672d7f5c014819cd796efb5e5d9315
MD5 1047ba0c8ce08e7c54fa762f4dba76a8
SHA1 d54d5cf37d7424194274b754ced9da9422c59094
SHA512 5b7d4786495427f8d99849888b23c6b962f2c3df499df44dfb3c1086cdb4afd728616433606ae1aac305e17d762dc98cee2b59082c1418941063681976b99d9f
TLSH
T148A0023C8BCB23E88824406FC34AB720242AFC4A8312202013B5A0C2E08444BCE38CBA
MD5 SHA1 SHA512 TLSH

Submit Download

STTRIMS.exe.bat

Path C:\Windows\SysWOW64\STTRIMS.exe.bat
Size 78B
SHA256 3a3e64b14f424d19fa52cef13fe2e2419d180a07d14548cd640e2458ffb89298
MD5 cad0e3b240d6fbf1df9a4036bcad9f69
SHA1 f53e2d8a87799bad51ed0981af892a0448eb00c2
SHA512 34ec894cf283a7e7db1cef4733f3cbac6e0d85dbf6a6b6642d18582069b2696303b60ab3c50a62ba66a105607161072326f18cf7b01cfbc8f5e63cbf0570a077
TLSH
T1BCA002300AC1A0E08C2440EFE34E3FA0042BFC4A031A00201295A2C2E00C44BCA28EBA
MD5 SHA1 SHA512 TLSH

Submit Download

SULW.exe.bat

Path C:\Windows\SysWOW64\SULW.exe.bat
Size 72B
SHA256 ad71ad7bd8597a1c31276fc03d9f7d9a4a5d8960cf3016404f849f51889af72e
MD5 828cf4db57f9be327673c58222ddeeef
SHA1 c71e675f44a0d4d486604cdfbeaecf0063b9d680
SHA512 f4d12daedd9db115ce7bee75cf6254e86ddad355212051e06e5b54ed416701a25acdcd610612d42bcaf4e694305254c26ca3ad2342e9de5b648b4040e21f6b92
TLSH
T163A002308BC120F88826426DE34E3720042EF64B03B2802012D5A0E2E0044EB8A22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SWCUM.exe.bat

Path C:\Windows\SysWOW64\SWCUM.exe.bat
Size 74B
SHA256 cc57818100b2218f760e62240a431311ecc3370b0d62e89e555ec322d1dfc8d5
MD5 d876f86ecb76a5b60f0aad299b99679c
SHA1 94c1632c832ec0a42540bd4e93032e6aa92706e2
SHA512 a98a03ed7b6694e4b1bcd806f1b9bf31e3c9565735c667106e1543ce7875fdf9702decc19ed789080d5c3b7b06d63e5866c82e49063ab16552de5691e7bef6d0
TLSH
T1B1A002380AC1A8E88824407DE34E3728242EF44B031020209295A2C2E004E4F8A2CCB8
MD5 SHA1 SHA512 TLSH

Submit Download

TEGQDSF.exe.bat

Path C:\Windows\SysWOW64\TEGQDSF.exe.bat
Size 78B
SHA256 1cdaf4db50f7249573bd89daf41f035f6b6ff7385b49cb71c8190bb3ba8093a3
MD5 703678dfc1aa9e5e3b55cc3766d93b21
SHA1 e9388ec277e864327e2122cab8672c1c4c70700c
SHA512 1e45ce8697ce594aa2b5191e8fba799520512c7f01c54b1bf0991c0b28f2f20de4d7c5c7452437d589efbedf1a8d610c925310a9cef22e645eebd113b337659c
TLSH
T1B5A002380AC933E88834406FC3EA3732042EF44E031000201295B0E2E0C46EBAAA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download

TOGV.exe.bat

Path C:\Windows\SysWOW64\TOGV.exe.bat
Size 72B
SHA256 3d68003c661f73b7d62000f4d62dfbcfcaf4e10d7f9757ce739ce20cd4f44fb3
MD5 027cbd48a89a2ae4ef2dbaaacc5bb582
SHA1 b1659a20a3062998ab85c88fd8dfec4e3afe26ff
SHA512 ee2fb07d9b2dfbdefdcf2aa925c726c4b854df235029a8c71fe2fc02bde30e9331c24a68ae43eb9f2eeab42b7241ddc931c91ff583277b253d72c3770a6523e2
TLSH
T11CA002300ACB20E08834606DCB6B373804AAF44A0B10002012B520C2F00E44B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

UHRTGQ.exe.bat

Path C:\Windows\SysWOW64\UHRTGQ.exe.bat
Size 76B
SHA256 68d2e9bca1f6d2e364b1a16038cbce4bb6053d475d4db9e962e5b6a7b63df2ea
MD5 3b6cf37bbe6a2da4c0a3a8d2ad091b64
SHA1 efdf3759b7240f91036fe7631a3991fac1567032
SHA512 901f699aeb8c3c4c0325fc168fe62535be343ee0e2fc36fbf1ae0284918734d05c6b2b84f354bd648f9aa6e77bdcdcc785af90b947408d24c015c1626a1d9cae
TLSH
T162A0043407C110D04417515DD77D7714C45FF4C503101070157D14C5F4044474510C74
MD5 SHA1 SHA512 TLSH

Submit Download

VALANWA.exe.bat

Path C:\Windows\SysWOW64\VALANWA.exe.bat
Size 78B
SHA256 cf9bdb6baa741971f25a074f2d81a6394eaeef1bf93018778859212b42c0b5a5
MD5 70ac8eefb01116447c829da4dd814fcf
SHA1 0f17bdc539ad5acafe2319210f1aa610197511c1
SHA512 dd61b057895346516c81dad29747cb1d5f41c73cfde73e722ad87c9e0e3bd4201595d53df98c898cb5d4ef2c939eca88b5049f3c5c898f234fc397584b7ba343
TLSH
T16FA002302AE130F88C24487FC36E37202C2BF44A033200B213FD22C2F00664B8A28CBC
MD5 SHA1 SHA512 TLSH

Submit Download

VPVRB.exe.bat

Path C:\Windows\SysWOW64\VPVRB.exe.bat
Size 74B
SHA256 95c35f6ecc13c23a00d39d6b72831e75f7e1fb17b89f18309f9433f7d18a48c7
MD5 b2b7f84d6876f2906ef976c403abe55f
SHA1 9d6b2a82faf9fd79dc7bd8907d72a400ce4b918b
SHA512 eaacb20af551ba59290e5bf03320d17dab12e62cddd8339cd5e09d43292eea031e711d1d9dce744e1f6f87256fc58d2e4fdeb96ba1599a1ec61ce3797ebe5669
TLSH
T176A002320AC920E0A824406FC34A372084AEF44A033002201B9520CAE08644B8EA2CBC
MD5 SHA1 SHA512 TLSH

Submit Download

VQQW.exe.bat

Path C:\Windows\SysWOW64\VQQW.exe.bat
Size 72B
SHA256 66c139548e4f79a7f75cd43c5df3e1dd15744c6b2227e10a84d55355ea7f1a4b
MD5 ff6e3ab3417947f6a54cf0c9c9a2fc5c
SHA1 d948d1ed973e2068ff47bec061e92c58f99934a9
SHA512 f6d007cf60795ba3f68aa6048d45f5d42e7b0a86a4c3b53fc2d6f185510ddde7962e06332cbd47e803b97e45f7425b74365d6509b20273e92cbcad3056cc4d92
TLSH
T134A002300BC128E088A4406FC3CA3720042AF4CA0390282813D520F2EAA646B8A20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

VSIY.exe.bat

Path C:\Windows\SysWOW64\VSIY.exe.bat
Size 72B
SHA256 3f937bb1051a9d775328ecbb92fa881cf2a5875b1503ac088f878d13c771a677
MD5 10b1e9e96566424ef2f80c1872b9f4d5
SHA1 ab9ebec25df0ff35222a364ec2e3f6f8c56db298
SHA512 3214feadd6fe48484e1f5c2740253fb1f596ebab7e25a59ff56c6339be17d400a647bc2ae212b4c711a83024474201fcdb3b52869f3771529920ff2ec959e3ca
TLSH
T1C9A002300AC120E08824436FC34A37A0063AF44E831020201BDD20C3E00644B8AB0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

VXS.exe.bat

Path C:\Windows\SysWOW64\VXS.exe.bat
Size 70B
SHA256 6bfa9807a644c20a9fb30b61e44440618a7223a9ec526b714a2c006e512e861f
MD5 c70e4ed5d03ab32c88bc02e741ad2137
SHA1 514f2a634e6b0dccbbdb35ebcdee08748685e71d
SHA512 898614d9443da338baafca0730cc5038206b296998556616abf884e1f570c6b539138c070b481544c4fb1ec50fc3a7f839feb0b3d1bda83fc2577232e68f7524
TLSH
T14FA002300AC130E08826406FC34A3720042AF44A031000201395A0C2F20E44B8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WIJYL.exe.bat

Path C:\Windows\SysWOW64\WIJYL.exe.bat
Size 74B
SHA256 d1b3552097fce1434f8cc07f871cc7b43dcdfa66ae40576bfb3a92dab79906f0
MD5 18b5922ca187b326f68dc46fdf8147d1
SHA1 a41ab33b88b33afd16a790514e1ec08d4d637660
SHA512 5b2370f80512d344685117e8fc5b3964bdd4b3965f0dbf2cec3a6cd63c122fc9f501f1c83a4bc49403d383a961629184319c76588d14b8bce447bbf0d98870d4
TLSH
T1A4A002328AE1E0E0C8ACC06DC3CA3720242FF44B231000201295A0E2E00444BCA20EBA
MD5 SHA1 SHA512 TLSH

Submit Download

WJYZL.exe.bat

Path C:\Windows\SysWOW64\WJYZL.exe.bat
Size 74B
SHA256 a810e19c428a498c08f19fb26ff85407980ce8f7763f9591b6c48883f3e0a7dd
MD5 0b082e94ebe840369e2bb90430886d68
SHA1 4c45ab6c0fff8731dff42cc801340d76f601eaab
SHA512 a2dd175cc4fe12d009283ef06522e3c293b13c520dbc7d886ca6a36496139438ace0a5e9285ec4a37b54ba191184d56674223cb0372b52cdf976f20923d90a88
TLSH
T184A002B20EC320E0C8A4C86DE34A3720042BF44B03100020B29720C2E20444B8A30EB8
MD5 SHA1 SHA512 TLSH

Submit Download

WRK.exe.bat

Path C:\Windows\SysWOW64\WRK.exe.bat
Size 70B
SHA256 8224501190b70b1f0d21142bc271f468a42dc89dce8cff115ab1112bb2812001
MD5 649981bb16cf3f142e6b24cae276e958
SHA1 cd0caa37954a105f8d3758959dfdea37dde3588a
SHA512 ccaa87b827914341164b07ffc89f74cf073f32b8e16a16fe58ae04cac7043e1ec231faf253a0d75adf59ace0c4f79d9be21b0ac618f8401119e5b9f5764267b9
TLSH
T129A002320AE120E0C8E440EDC34A37A204ABFC4A033802201A9522C2E80444B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

XDNXEJD.exe.bat

Path C:\Windows\SysWOW64\XDNXEJD.exe.bat
Size 78B
SHA256 f60bb53890a763b79cd619fda3906118ca4ca495a1281f628eda3864e5e41658
MD5 3a08dfc41f6a7bf7d31e91ea1259d9f9
SHA1 554add380792013554fe8dd6eb02649d5d7b6fb4
SHA512 255510927e074ddeedb587ff2af1ab395f354040e484a716e8834233c9d48cb4a88aff5cd59eab3980b310d80341e033f75d691794490376022c9fb583354d18
TLSH
T1CEA002300AC3A0E08824406DC34E37EB042AFF4A031000301AB520C2E2044CB8B20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XNVMKUH.exe.bat

Path C:\Windows\SysWOW64\XNVMKUH.exe.bat
Size 78B
SHA256 0a3882d514ff09b1e8cba1d171453e73314aa9a24a72ab347bb6090aebbd225d
MD5 2e3098ff39a322b544cbfc7e895b432d
SHA1 57089d0bfddd8e556e5b290eb1254e1d194418b1
SHA512 70552eaf6ffbf4c45fcba8ae10ea92ade7b941a2bd21c985fb1f434847693fc78e71b8160379b553a456ec815e41fe7d7cc91eec64dc8f882b2c53c50436cf5a
TLSH
T1E8A0043045C153D44414705DD74D37714D35F54553101010535551C1D04C5FF4511CF4
MD5 SHA1 SHA512 TLSH

Submit Download

ZMI.exe.bat

Path C:\Windows\SysWOW64\ZMI.exe.bat
Size 70B
SHA256 9cdebc379688f1e8fda940050e918189fd8efaf042d35128605573683d6ee841
MD5 6ed90cd59cdc88e5ba8d68246823a8a9
SHA1 5a7b0b1bbd662b95bff2d2968db1e8f248f3e5b1
SHA512 65e8b40f01b84a9fececdf857ca1cf2a7748bfa267d322ce35fabf888235f3f1f6437f5954cba18f4ef7c0313b8b55fe2657f945b44b995910bc1b1c5293ff37
TLSH
T15DA0023A2AC120E08824406DCB4A3F2024AAF66B23180020129520C2E2044CB8A22CBC
MD5 SHA1 SHA512 TLSH

Submit Download

ZYHI.exe.bat

Path C:\Windows\SysWOW64\ZYHI.exe.bat
Size 72B
SHA256 78cf14fd903e5f33218b26274031916dce4918e49a20263e5bd0fe3af7cb56fd
MD5 7cba1716a44fbfbbe737ab51307d1339
SHA1 430ef860670c9e4ddede7a8e04c1048291794298
SHA512 b1b7de86346f1905cf4aebc2f77e14c7e1489dec84cc4f732392641221c04573015b08d6e48b49764f49533084cf4ab3dd2b388e47492dafbb3a072c28e3bb22
TLSH
T127A002320AC120E0A82C406DCB4A372024AAF44A039000F01295A0C2E20C44B8A38CBA
MD5 SHA1 SHA512 TLSH

Submit Download

AHUIEGE.exe.bat

Path C:\Windows\System\AHUIEGE.exe.bat
Size 74B
SHA256 0d7b6de638ee82ac0d360f63a8a1eb8943686d34a957a1e413d52d7cf9c02a65
MD5 66b9d5aec7d5c9eae1642f827f18d656
SHA1 b5b9d79a3d19196ccd1b17521912988840b28899
SHA512 8747e377a2aac10c88dfa9f80d9d522e1be8717df0be1de5caefe64f373dc10d606bb4f3aa18c369c591e88fc3025e13de81ca3a0ab6028e575eb97bb24e14ce
TLSH
T12FA004300DC310D1445444FD47453740045DFD510731D01417550145D00D45347115F4
MD5 SHA1 SHA512 TLSH

Submit Download

ANR.exe.bat

Path C:\Windows\System\ANR.exe.bat
Size 66B
SHA256 660541187cf8394e482870e992f21680709034f144964436cb28154a118cb6b6
MD5 426db4400d44ae04cdd229e568a9b3a6
SHA1 99ae1f68e066b415af982e69ccab87eb676fbdc5
SHA512 b7bf10daef6d28891ccdc9fe99ed9b3f94e969ca084a112019a32fcb2fa566f581d1f7219ae5014bbcf44e50d5c25cd96c2dc10d89b3426b19096980a8d57d00
TLSH
T1A9A002300EC328F28824406D434A3700042AFC422310003812D50082E08C46B8B388BE
MD5 SHA1 SHA512 TLSH

Submit Download

AZT.exe.bat

Path C:\Windows\System\AZT.exe.bat
Size 66B
SHA256 e90bafe4b0634921e1975f3ebf98e51467a917dafad2bdeb744290c073b4681e
MD5 4bce1932a202a80a332454e78be4a83f
SHA1 caf53282faf47cc4bcb30af032d77f9672379086
SHA512 0c55f209456427a2eb3632d889ae2302fe6c7d26475ddc083948988cf7cf4d0a1752fc59db5ad272a0df72608ddc1c430c63e25e7032078b46dc972bac23db52
TLSH
T1B8A002300ECB28E2882C486D634A3780043AFC4203102A2812970082F0044638B208BC
MD5 SHA1 SHA512 TLSH

Submit Download

BAOKZ.exe.bat

Path C:\Windows\System\BAOKZ.exe.bat
Size 70B
SHA256 8ad6a490782a401133c9e1ba810691bfa0f4a2a54483ecffda11c3fb55e7e305
MD5 e052e2085811c1fe379460953cffd453
SHA1 87dfec42675b22593b471c252b6070e8549ff094
SHA512 3f1dc29de91014b0068cf3bce179c0b99288f9ca49d843c678118a4c22d311a9e5e799a81409b4a545960e9a7bda192296a68558554201e1b60df3082d2bb6c1
TLSH
T139A002320FE3A0E28824406D434A37000E2AFCC20332F22012D50082E204463CA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BBFVNVW.exe.bat

Path C:\Windows\System\BBFVNVW.exe.bat
Size 74B
SHA256 d45dd88eda17dee80d353cd5ba84d667cfaf75a205077ed0a8cb2b101cb5e253
MD5 d37013949732b631120c6ad5081ea9a7
SHA1 665e09b7319fddeb630181e574cb2a1ba3df573d
SHA512 11c20374e02d46d6cc78641199d4fb2618a566ace67125b4e0ac2346cddce8e740e44e40af7e9e307cf90d386e79bf5c754269ddcd91f9036e9a9cd94d85360e
TLSH
T11CA002B00EC320E2882440EDC34E3F00042AF6CAA33088B892D520B2E0044738EAAEF8
MD5 SHA1 SHA512 TLSH

Submit Download

BGPLH.exe.bat

Path C:\Windows\System\BGPLH.exe.bat
Size 70B
SHA256 c587c0eec8fc30ad1d8875fcbcdb4984b7b117016ce5b31b93c6fecd7b1ffd73
MD5 376a32805eb547003a37eb8e1052703f
SHA1 f1e31d37ebb41919c15ac8a431ca7bd2638f49c5
SHA512 795432c71c9d7ff4f6dad26d0ad274119d4bde1b3a76ad008d103de74645b62b2b920583c18c458ac322fe7d3f384ebac90da7656f154a11151a2a93c0a82f50
TLSH
T16FA002300EC120EA883C40ED63CA3730042AF4420312082033950282E8844738E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BSUDLMZ.exe.bat

Path C:\Windows\System\BSUDLMZ.exe.bat
Size 74B
SHA256 63d663f55b10f7352e93cfbf1fe98488a8551029b833fd7c6d7a2793bdc69703
MD5 ba9699d3d7766ad46746f2943207a2dd
SHA1 27a8fcf83cbf473f42092ef70abd552cbb01aa5d
SHA512 23ff0ae9107422f17e5b9a459b9da14621a91b09340c0ff2f74fe02c9102c462dc194403a3798ae0d88414e0787abe18138111cae3f24dc1ffdfd9e2d186b4cc
TLSH
T155A002320FC320E28AA44AEDC3CA3720042AF4428B1820A0139D0A83E0844638AB0EB8
MD5 SHA1 SHA512 TLSH

Submit Download

BTFM.exe

Path C:\Windows\System\BTFM.exe
Size 208KB
SHA256 c0b0c53a4da3285aa2a38b5401c3a0a15c505285ce06551757c7cedc293b933c
MD5 7be3a383df828450b1f8605d1a7da383
SHA1 cf81e4a5236c2ffd7e7778a183e529ef55e29190
SHA512 01969724dd038a784cca80f7e0086ee820bf5a07507b079204799646fd7b4064f82fee7197fec9d2e8cd9e2df4f0034fd20d09e2d2081858b708ff70575e0791
SSDEEP 3072:NoZrfmsryu8FLsBi7hlptL7vmCepQlHN250UXhmquz4pLthEjQT6j:sfK+izpx7VzumqakEj1
TLSH
T100249F327589C116D1A75A305CC1CEE906BABC726FA2C10B7505375F2BF2FA908747AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BTFM.exe.bat

Path C:\Windows\System\BTFM.exe.bat
Size 68B
SHA256 6370d470d2a5122efa05747f9749048330d0eccb1652c38aaf7899b32147a55d
MD5 1415b0dccdcc55fb6057d8b0c9eb6ae3
SHA1 bcd57a48f713e3d8001232e72d2f27e058f6fb56
SHA512 d14d948515a92b590f7ea6042ad7f55ad6ab333a43be9352d92c44a56f2448707aa2eaf97784ffc3d3b1d093c3acce614afafddc91fe7bce6f34b2f0c1c5f133
TLSH
T17FA002B00EC120EA8824406D434E373204AEF44223100020129D00C2F00446B8A20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

CIGK.exe.bat

Path C:\Windows\System\CIGK.exe.bat
Size 68B
SHA256 9458e17815f0100d19e12606f91c81b42a340c4d7c3125909a8c5ceb6520a7df
MD5 394910e16a23ea48c1a94c42ac2c1769
SHA1 b8437794d6b3b2f93990972fa1e30c0e00b6ad59
SHA512 8eef94675fd6b56d8bbc5c841d30a50b15e3e78316685a5510ac1faf8d5d2fdf0229d921077bb2b251d8a0ce47bc7aaaf88e1d9d030cecee990958a5ee00455a
TLSH
T11FA002300EC122E38C24606F43CA3F80A4AAFC420318C02A129D00C2E004463CA20ABE
MD5 SHA1 SHA512 TLSH

Submit Download

CKPH.exe.bat

Path C:\Windows\System\CKPH.exe.bat
Size 68B
SHA256 7e3ed144444d6c36fbd8fa6d7e57740ce6201308f1bd7e47196ee6f7863eb790
MD5 c38a995020632da9832a7c34ea446149
SHA1 3889655a93698376f79c50848a659ee4c29b0e1f
SHA512 3aa183ae67970cb60890f3252d09a02ce120c9e65a7a150dc9cc6d6ac73c1899fb6cc7365e13388f416ff10708d877582996968738d118da6b0598e9274aedb8
TLSH
T162A002300EC120EACC2C706D434A3F200C2AF46203108020139500C2E0A46738A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

DLXF.exe.bat

Path C:\Windows\System\DLXF.exe.bat
Size 68B
SHA256 d5566587d25494314fe94c630abf70e52808e4e3411f37ceaa7c5f64f8177606
MD5 5aa1cd38d1e2fd313ed34508331ad83f
SHA1 4236d6542876c60558aaf2ddb077caef44d15210
SHA512 24e166ff1c712ab18880d2b986101da146515f56a4e6c2025fc11674cb82f2accaef15e71f23a80f7f597890ec5c6f5b8dea4c9f59daaf2e39761d426711e96c
TLSH
T137A002300EC132E28826406D436A3F020C2AFC43231002A01E9D0082E0044738AE88B8
MD5 SHA1 SHA512 TLSH

Submit Download

DZER.exe.bat

Path C:\Windows\System\DZER.exe.bat
Size 68B
SHA256 d6bb582b9e356d4824c21de635dbeef506debdc9865549a0cf0c4f455935accb
MD5 26b1b37ddd72ace7cc80fd86c736a5b2
SHA1 bc91755da90d3c8f45594b3b693d09155c20c5ed
SHA512 288dc795e574ff44fbe47330f319ac640c3a781a227a9a2a1714a01249e9fe4dece664b485a1e45135a004c704e0dfad5efd8a3c777e5fd318ad8c587c272489
TLSH
T1BEA002388EC1A0E28824406D434B3702042EF442031000201A958882F00447B8A388B8
MD5 SHA1 SHA512 TLSH

Submit Download

EBIAJXJ.exe.bat

Path C:\Windows\System\EBIAJXJ.exe.bat
Size 74B
SHA256 8fbec0410d966625abb0a02bd39237e1d6c9fc249c4bb04cac7def44df17622b
MD5 75842b05ed4cc05ca6d2584e5027653f
SHA1 ee44ae08cd219ac243830dc8e69fcb1a4b92b086
SHA512 a84659001e5d9f61b78b82d827b046a8b6e0499c64f168b6487015cb02e127a995388401b00322b56752578721b85521ca084461076bc42851b254e13133c730
TLSH
T167A002300EF130E38AA460ED634A3F02042BF4C28313022032D50ACAEC044638AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

EUCQEF.exe.bat

Path C:\Windows\System\EUCQEF.exe.bat
Size 72B
SHA256 d9f525267ee44f2c4d2a86be2dfbc90582ed7e3b8ab2d7cf3434341b7a4e58a6
MD5 de787a726bde0eaebb4c61c93e1b56d2
SHA1 c96586d9c53bc4b9e135085ec945c79afcfdff88
SHA512 af2fc458db07849fa7c17dc9572457214f6080253ffc89808f960850db8dbcea11a5783234ab2ac4b9d6ecc906db360dc0fe4210b387e0ec8d53ecb52e275ee3
TLSH
T1BCA002380EE130E2B8A4406F434A3F0306AEF462833000B812DF008AE0044638AA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

EXYS.exe.bat

Path C:\Windows\System\EXYS.exe.bat
Size 68B
SHA256 f369cc4891e61dbc59d85489392dc50f07ac108a5e8162266dd920e0da5a99f2
MD5 f431cd531a20760159fd8fc304c0851f
SHA1 2aad35db04e418b0add37421a7b1c2cd0a8a8097
SHA512 6d4f497fd03e97d7fb70c03c69ffe03a2f3c45f10bb5bfe39863e726b8bf29e2564a001ffa946b5e8d8f13a4885e997407df3ea4fb0b5c3b6c25ea8dd58efe53
TLSH
T1B9A002308EC920E28824406D634A3F8C342AF4CE0B10202012D5E08AE00C46B8B208B8
MD5 SHA1 SHA512 TLSH

Submit Download

EYXKYZJ.exe.bat

Path C:\Windows\System\EYXKYZJ.exe.bat
Size 74B
SHA256 715f1677877d5cb9326f9cb7b2a13a94e2bba2624b2220310661adb461dee641
MD5 246711832921ccdc7b00dbd6744bca7d
SHA1 654adeca3f91b881c420472502f73f3dc7436117
SHA512 08b157208abbf2e38a059ad8870999d6dc41bc52f93445ebca83f950311145d18f808f166e7bf5fc7a4fdb9079f86693f68dbd3343fc961679c7cbbc17a2e8ba
TLSH
T1F6A002380EC128E2C824C0FDE3EA3F00042FF4430330022012F7008AE0046E3AA2AABC
MD5 SHA1 SHA512 TLSH

Submit Download

FCOFT.exe.bat

Path C:\Windows\System\FCOFT.exe.bat
Size 70B
SHA256 e26dd37e283e6d05257a2518caa3ea98b0b5b68c1f3a05d05632b336fff37335
MD5 93d92a77f1a55506a3b84ecbe838b36e
SHA1 6e76259921e0b6f86cb2aa53e686f1d932300a6a
SHA512 222f871e91fb72b7f80cd62c44be2457b4310d3a3d76fac2f0f75e785264565ca1710f89f9ff38ac7e95cc56e57b274e6728cf5ae819e87576572fc346cb7856
TLSH
T14BA002300ECB20EA8826406D436A3788043AF44A03100E2232B70082E0064638A288F8
MD5 SHA1 SHA512 TLSH

Submit Download

FDVRFQT.exe.bat

Path C:\Windows\System\FDVRFQT.exe.bat
Size 74B
SHA256 fa659720a36bc48741483a96829d3d69ddc9fd89dcf958e1b0d4910dd144ae52
MD5 da9388bd1e9e8d9633c76031b2bf720e
SHA1 8f4f0569cb54abe00911357de61a4d714f6fc2b6
SHA512 5a4d11f89aa197609669d0b22b73d1f2cd51ac62ae67c615607a8280a62d473213c16362327f914e76c171c7a093498d53f21631ba259dff1622b814de4d712a
TLSH
T17CA004300DC714D14414457F435737440415FC450310157431570051F00D5D34510474
MD5 SHA1 SHA512 TLSH

Submit Download

FWJCNK.exe.bat

Path C:\Windows\System\FWJCNK.exe.bat
Size 72B
SHA256 3e66b64cd9ece48f1e13091afdf99788da1854223ebfe3d88d9288111c4e5174
MD5 0286901ae51bf96f0263315d5529c101
SHA1 16e5fc3256c670ab36ea4d978e0580951082e19e
SHA512 4e7df9ff1dc2b2b27d211a813687aac5a3254e7543bbaaac8c33801e9a7e254f3078ab0d90fa723a9505160bec006d61f630b3ab03c77ed6182b616de4929567
TLSH
T179A002B00EC120EA882C406DE36F37800C2AF44B8318082012D5008AE3844638A208FC
MD5 SHA1 SHA512 TLSH

Submit Download

HKNJF.exe.bat

Path C:\Windows\System\HKNJF.exe.bat
Size 70B
SHA256 9bf299a5a8e184765d14b59c8d99d7fb3692f09722979e8a03f37c75c8b5d9c7
MD5 69b795e2107b603f8d8a13a55872a79d
SHA1 a4a98eddcaff3a33974d750f6beb12ce28c6b45d
SHA512 b52e6c448c3f84ed6c7de6b044ac26a127250318aec144b0d8a928477a224c56ef99f08ae78790f50fac86ff1510ac7df8df9403449625b76586d50f0cf32d2d
TLSH
T1DBA002300FC930EA8CA448ED4B4F3782042BFC4223100C381A9F80C2E0047EB8AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

HTAJ.exe.bat

Path C:\Windows\System\HTAJ.exe.bat
Size 68B
SHA256 2946f2a490e81dcfb4c24cf1b7789743914b3ec9892ff0243ce02d29c7fed124
MD5 f13f406e043547515e09380894090d77
SHA1 34e36e9f0f54c5c241de824f226e6423d2b91573
SHA512 b127a7308e83b6588d3c2869080c680cdb16dfaf803c35de817bc2ac7c8d42c5765f573bcc80c4b06b75bad50425deee6f15783ba423f3da01767675b29e620a
TLSH
T19EA002300FC1A2EA882440ED634E3780062FF46203100C20129F0083E0064638AAC8B8
MD5 SHA1 SHA512 TLSH

Submit Download

HUL.exe.bat

Path C:\Windows\System\HUL.exe.bat
Size 66B
SHA256 04c33e490486a8de3c38d2cb8bc6890650e8069fe69a917d523972be0d3af3d1
MD5 2593f31e882b4896c332bc6c6c2e3a70
SHA1 312712ed57d21fca021d86389d4bac296242b3bc
SHA512 8acca3595f24c357e72334e52b4e26e4ebbac0d4bbcbc54f25ac22018eb7533b0986e9157da1243d747e32724bf302f51ac70d8fd322b8c27d32219e5dd015dd
TLSH
T101A002300EC120E3A824C0EF434E3700062AF44203100820B29F8082E0044638A228B8
MD5 SHA1 SHA512 TLSH

Submit Download

HVMCJN.exe.bat

Path C:\Windows\System\HVMCJN.exe.bat
Size 72B
SHA256 717e56d02936eda0d0432c65a1a45472a10895bd15c5dbfa2e88fc720d9a42da
MD5 6f7af523d9990cc86eb34304784c2fa1
SHA1 04fe46cb538baf284d259a7fc8db7616a5175350
SHA512 e5c2b3352ffe7f8c0d3edf963e83900a20d4f5db4ca4822e3283e5abaf9d19d9b95458a27887f770bcde79c24b88686300bdbb4a5c6650ec476134b45170c9f4
TLSH
T1B0A001200E8120AE8A3680AD434E2600282FFA7203D00820AADB88C2B004473AA288F8
MD5 SHA1 SHA512 TLSH

Submit Download

HWMPGBH.exe.bat

Path C:\Windows\System\HWMPGBH.exe.bat
Size 74B
SHA256 e8931a1f94ea5f8e890c203027284e7ce5580351c81fe275e84f61332f7ab515
MD5 72e6393f4a016797b0af063d2cd68bbb
SHA1 24bab611802737347ae0a349c2cdb767a8aa2319
SHA512 b3358e72e6b1790d06cef5b898002b0bd39fae4454eaa6fef76cb81a26984dfcc2b5849db55517ea745c9c9c36bcdeb645cc705b7e0cff0a6c316fb1b74d09b8
TLSH
T143A004300DC150DDD43D40FD434D37104D15FC4107150410135F0045D0444F3C554574
MD5 SHA1 SHA512 TLSH

Submit Download

INLFOC.exe.bat

Path C:\Windows\System\INLFOC.exe.bat
Size 72B
SHA256 2289ee12e3341f9c239fae54966b0a02dbf818c4ed7f46a13930ef681f8616e8
MD5 8822a1bb8d74bf09b970ca1f5d19075a
SHA1 08c1ac36ee9c8c902ef55d9fa18716e3442f29cd
SHA512 f5f3df2362f692fb58753151a577b3388d5ac5adf0f057b6b210cca99cf704c7f87c7ce829fe16c68f6c492ccbc9fd74f2d2884d827c4de5e9a2c5ee748345bf
TLSH
T199A002B02EC1A8E28836606D434A3700042AF46A2310022092D72082E204C638A228B8
MD5 SHA1 SHA512 TLSH

Submit Download

IVNZSFI.exe.bat

Path C:\Windows\System\IVNZSFI.exe.bat
Size 74B
SHA256 ff26f918e99ba9a90261f071fd8fc9dc81a971899528ba6388a2852c723dc7cf
MD5 a68d74c3b5a803250ceeeb0d9848092f
SHA1 d34d5223a120d22f5be8f31fd6d4b1187c9ccf43
SHA512 97d66e1e9adee8d51d735dc5d2503e82be939caa442539faeb5f4a344d1509045f424243fe7dc5714facc517207616c3f9870004d66685f5e900b813fd9eb7ff
TLSH
T141A002300EC1A8FAC824486D4BCA370284AEF442A390002212D5208AF024473CA208FA
MD5 SHA1 SHA512 TLSH

Submit Download

IZBODBD.exe.bat

Path C:\Windows\System\IZBODBD.exe.bat
Size 74B
SHA256 f56e1f9fa2e52d4e3fbd2084a3122c2c33fc1bba78abdc4c744ae1a4f0d80124
MD5 369ad2cf9554577b5c0b56906e802526
SHA1 7dec6a3860a5562dfee97bde11c186f30965ea82
SHA512 7064d1d009fa64361a816cf083fa0aba80f9bcf89bda12f900e446161a56ca969e7ec983e8360666bb1e39a6ec081c55820a401f7e8f1f44f34c23ca9acc42a0
TLSH
T1EBA0023A2EC1E0E288A4426D434B3700042EFC62831002301AD52082F00C463CB32EBE
MD5 SHA1 SHA512 TLSH

Submit Download

JUCPP.exe.bat

Path C:\Windows\System\JUCPP.exe.bat
Size 70B
SHA256 1b461b701ee088d73528230f581bd961b649485d2ba2551e8a07123573c83358
MD5 a0a1175adb732dcd8cab0a55dbfc8ff3
SHA1 57b1a37122fdaf94d2e610101c8ced4a943de520
SHA512 6f00fb06be0bf2d12b70833af163d5b6bc55c63ef63e609913c9c3088ca908bcb2cc3cc769ffdabdd15211cd7b9c53f1d98d0cc575cad663f5ae540ba94384e4
TLSH
T1F5A002B80EC120E3A826406D434B370A0CEEF44A0330002032B50082E00CC63CA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

JYWQ.exe.bat

Path C:\Windows\System\JYWQ.exe.bat
Size 68B
SHA256 68d921db45488a108fe05248115123873941da5c78009dac36e630537b19488d
MD5 e989d5b466198d2c780d548dbbdf256a
SHA1 24477b7e2701a093175fe9c4069d9bcb60440ec4
SHA512 367e69042e3300fc22ce09e3e621a0eb177bdb176a4ac779ddf6a7bd990e7903d1ad7684d222e704f8b882c1543c75d7c5b2a7b7c70b150558bbb0eb8b414b6c
TLSH
T165A002300EC128F28824406DC34A3708862EF4C2033000201AB5008AF00C4E38A20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

KIDGHWL.exe.bat

Path C:\Windows\System\KIDGHWL.exe.bat
Size 74B
SHA256 d40c8524660f21b7668152c8e8dfcc05e8b2f7dc10468aa977d5d9995be2e889
MD5 92ea1362a7844e47a1a48e27ce5b80e3
SHA1 f717eb450762419be339e3f5bf562775e6c559a7
SHA512 80bfbd6768de0b6b38045b4b66a86b4c1edf701f47d2dade00d2bc79022bfbb170da31c6dac0897d12ba26d0fb1ce60e1698cc8fafb627b71cc4554f3ef664e4
TLSH
T136A002328EC322E2A826C06D434AB70004AAF4EA83100022129DA082F0046638AA0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

KOCW.exe.bat

Path C:\Windows\System\KOCW.exe.bat
Size 68B
SHA256 fe93844a530c6701e3dff5a316661ec89d2fa6ced09c1ad988b7af9dd50c1923
MD5 02154f9b92429f2d3888f926a3feaa83
SHA1 99e5a7738b374d24f0eb04ef810862e350fa7b48
SHA512 0d3b069539d3395b44b9822187432e0574aa260e5f7b99cc6bdcf2f115d5918e34d62f1899e16c228ca476dddaed4ec3d89094320f73507b955b033cbff92491
TLSH
T14EA002380ECB22E2AA3448ED434A37C02C2AF462039000A092D780A2E0044F38A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

KQYSV.exe.bat

Path C:\Windows\System\KQYSV.exe.bat
Size 70B
SHA256 ece2fa3e55751db905920118a9b3b60461de47ccb15e1563265af07ee5e0812d
MD5 45f6a22c3746304edac152b317c775ff
SHA1 2ecd08b9e066e78c4fdbf6241e108e2b4e0a6b28
SHA512 c3b904ef8e6a51f878af02c6c258349630f0ebfb7863848555bfc4e90ba7216b0d5c497684861b472b0daffd891c1e15c31b52667529160cb569cb434a0a4285
TLSH
T1C3A002308EC123EA8A24406D6B4A370224AAF4630390002012958282E804C638E208BA
MD5 SHA1 SHA512 TLSH

Submit Download

KSCFT.exe.bat

Path C:\Windows\System\KSCFT.exe.bat
Size 70B
SHA256 66fd19f6ee9e34f876608783a90453e56f8b2322d5c8421316f221f7ba97ac3f
MD5 294c393cd75794d87b66c224235ca80c
SHA1 16d1d926f9f8b8591e59fba59e22e0b13d677586
SHA512 77953a1653d935e37890d6b526248de753e18200420983d18daf75eb37eaf5c65802713d2030f09a9eb419d532d49d9580ff60945edcf6fc3dba2bdd126bcd36
TLSH
T1D4A002B08EC122EA8824406D434A3F80042AF46223100A221AF78282E00C4E38A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

KWZYS.exe.bat

Path C:\Windows\System\KWZYS.exe.bat
Size 70B
SHA256 cc35298997fb1b1aedfc83c83005ac2883fc6148af9ae2719af9c5aedd2f659b
MD5 1ed7ddb78640c44d2cbeb8801a25c705
SHA1 f614a973eed8a559343dc79527c9dd024c319f22
SHA512 a0a8772809fe1415fe1391a019411827bfe98baeb378af4427650f3d5590faed15ee907462a8147dd1c4426f9728fc13fb69819ad11cc3cfb4e019357fdd1df7
TLSH
T124A002380EC122E2A824486D634A3700A42AF47A031000281295C08AE00CCE38EA08FA
MD5 SHA1 SHA512 TLSH

Submit Download

KYA.exe.bat

Path C:\Windows\System\KYA.exe.bat
Size 66B
SHA256 d7120ae02bcb7148687ba70e2bf5b77e9e63a7f144205e2f5c94769fc70b04e6
MD5 d990d7f4f6d60738019a9f8ae3e24dcd
SHA1 3521df7450bb1e61afce1c65afb182747b52cc55
SHA512 3a74d3fc41a833a8b3b5c8fea3de8770ff5dfcde16608c61b0a59c8328c08429b0bd3ca082cec9951784cec3ba81f9344dca48565a489e49d37a478d957cff82
TLSH
T1F8A002300EC12AE28C24406F434A37002E3AF46203100820129D82C2E8044E38A20BB8
MD5 SHA1 SHA512 TLSH

Submit Download

MAZXIUV.exe.bat

Path C:\Windows\System\MAZXIUV.exe.bat
Size 74B
SHA256 47adce1670a1be53f1cb5eaf3b2b02e1d52ddee180f9999f43c45ec7a145e47a
MD5 7b5dcd07847d34b5658b5fefd8d6eb70
SHA1 589e68518d45c034ded7c95ac09b7679bee2da21
SHA512 18893904efc66338887cc17d7641de1a073922773f048e8d99769995c812feee15ea5ea46e1b2e6afa61220fec35fbad5be933c0a8625863c0472d41e0c9812b
TLSH
T187A002308EC128EA8BB6606D4B6A3700042AF6420B12202092958882E206C6BCA208BA
MD5 SHA1 SHA512 TLSH

Submit Download

MBKO.exe.bat

Path C:\Windows\System\MBKO.exe.bat
Size 68B
SHA256 a92ed1f4227a292b6f2d064958302b0d0519b6e6fd568ac359c31371c6f97e28
MD5 adf108332001b79cc38b4e5f12852429
SHA1 076cc37ada9ae7fb0763483f9b6c1205196d81bb
SHA512 c288af3f56465b7610e0235f55a2b794e749a8b611703535b44bfee4ab5b5d6b7433c3ab8c2e54329c867282b37be0b89aedef9eb5cffa8a6df2f05c779d0d32
TLSH
T1A2A00238AEC122EA8824406D434ABF20042EF4428330802012950082F004463CAA08F8
MD5 SHA1 SHA512 TLSH

Submit Download

MCFM.exe.bat

Path C:\Windows\System\MCFM.exe.bat
Size 68B
SHA256 29aa8462599b25b08f6d923690e5f7e5d0fe3b5b979fccf42d41ba3dc1408da5
MD5 f2f98be7fbae5704567f679b527e4ade
SHA1 f0abd878a1596f27f045a839a3fe72d895ae2b45
SHA512 458ff6f6e6380885ccd86dd4f1ae612cf01af2634bf329f6ed767101e151bbc9ef7cdb448e9535a0df7dbde70ad00c49a37bad1555b08ce33fc90a92692a3030
TLSH
T1EDA00230CEC120EE8CA4406D434A370A04AEF4620310082013950082E00446B8A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

MDV.exe.bat

Path C:\Windows\System\MDV.exe.bat
Size 66B
SHA256 73c88bc3f713e5fef258092417034eab18c17fc003c9bf27c1be56cf8b42f4cf
MD5 5f524e17f1d65939594a6c4487d6d555
SHA1 070d93249f0228bf52a20fbabc46b16c5683fca6
SHA512 d2718458066273ff0eec2f4410e88f915f745c466b553b49be453b9c3e2daf7e6dd647b6081828921571652e2113e1e8ac9b96c4fa93b3bca022820e9a5238e1
TLSH
T1D3A002308EC128EA88A4406D4B4A3720042AFC4223102020329D0083E0064E3CA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

MGF.exe.bat

Path C:\Windows\System\MGF.exe.bat
Size 66B
SHA256 e1f5de4e0bbe4114a9090713823d5bae3277f09e3f38a58c8d108453d88f2efb
MD5 e34038e12c25f70784a57ebaa5708b6e
SHA1 6f2f0af855eab73594805718ecf65932f3593f01
SHA512 60374cb79c1c0aa05d65ef67506b0a23ce84ed9dda3b819d7e5687c37b49d9d229ef749973f80e15d976235b351eddb4b18b614833c6b6359124c40b08aebc19
TLSH
T19FA00232AEC130EA88A4406D434A372204AAF4430313002013B50083E0044738AA08F8
MD5 SHA1 SHA512 TLSH

Submit Download

NGEABL.exe.bat

Path C:\Windows\System\NGEABL.exe.bat
Size 72B
SHA256 5ec1f452f9fc40510001d180f75851d3d80fbd914c23c9b9f5ed9c3cc885fe21
MD5 1b29ff619774ab83512800b764e78a66
SHA1 eecad8edb8dd2fa088941e00f8dbbe1a37f7fa76
SHA512 6841301c6cff4ee780644d058569cadcbd296f3419288a8a4ff0e3366129131d38a7138292c4dfc072deb3a3d1d6278ae696a19b5cd8e2ebef61fb714cd3ab7e
TLSH
T193A002300FC9E0E28A24C06D63EA37A0042AF4C20312203012D52882E004C638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

OGVUAAV.exe.bat

Path C:\Windows\System\OGVUAAV.exe.bat
Size 74B
SHA256 b48cded1563592a29a0902fe8e2f7dc5e3d84910244baa860662bbb23ab37dc6
MD5 b1dc82e10a1d54f74cffe88299cfc54d
SHA1 f6cff086a95e3fdba0745bdd867292ba6efed692
SHA512 4ee0b13726541e28a97cfa55a676cdfe7f6a73cd72ba2b7ca752ad00a1be4fa384c3bd0cc3239a4153a93fc0b5d871fca6f50ef2a4f8c4aa270c75991f4457c1
TLSH
T172A002B00FC132E2EB2440ED4B4F37A8242AF4422332002092950882E2044638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

OXXC.exe.bat

Path C:\Windows\System\OXXC.exe.bat
Size 68B
SHA256 6a0636e2c29dd21fd992d71cbf3f9019861e4cad0dc128b0869b83a466172b9a
MD5 7f03d53a61a0dae51e1fd9838ae3d4f6
SHA1 8ee06aa4526b9455474cd7421d5bf26a516203bf
SHA512 14638640793a68551a2bdefc0af7f090ef246b6f574b871aebcb33b55298a93a129e26d8ef080aa8b525b11e47db7e6b126a0faa94450b6331dae29835e309bc
TLSH
T1E7A002B82FE320F3C834607D434A3708042AF4430B10022012952082F304C6B8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

PDOEZBL.exe.bat

Path C:\Windows\System\PDOEZBL.exe.bat
Size 74B
SHA256 6eabd30afcda2b30e19b17f6f9aadcde5bbb37286df45932447309377641aff3
MD5 ceeda88165bab68aa651c64d5ef5b01d
SHA1 f2a4b0687c8cbc2cdbab1c440434116cb669873d
SHA512 0f6d3ffc3bf5a402f4bc2083066759b7b8d9cd9c1c081269865641dc5f889d86b71e0e7f96f9a055e32d1f4a9bdd2c0760410635b269dd71ee735ca3b2742b21
TLSH
T13CA002380EC9A8E28E2CC06D436A3700042AFC4A033220F09AD508C2F2364F38A308BC
MD5 SHA1 SHA512 TLSH

Submit Download

PJX.exe.bat

Path C:\Windows\System\PJX.exe.bat
Size 66B
SHA256 71fbbd8e6c021bce7e8151bda700c6940eb07c6faaa8d1a015f80dc14204e791
MD5 a28113d3bb897a40b4b3c3c7f26b229a
SHA1 0669563fe9d97a8e9e929fce0ac38182042379cf
SHA512 e1eff483ca6132c7c3c8af8344b4e745d86845dbb051040df107de16cd0b67ac48ace5d982021e5f3585ccf9c5aabc3acc69c2b70504a023f689cdf4aa514a0c
TLSH
T109A002380EC120E28C34406F434A37008C2AFCC2031082E01A950082E0046638A20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

PUOCLYJ.exe.bat

Path C:\Windows\System\PUOCLYJ.exe.bat
Size 74B
SHA256 763f04889ef79390f71e00c9b353bcf63a8542cfa6a04b8f756fa40d788c174a
MD5 a9611d8074c2fe1daa4ab298b6208426
SHA1 6af8bf9d5da998a0606a6439680ac7c0e315b628
SHA512 08843a215e04fc4e9b87bcf73c2ec34ef04a4d502a972febc63cec76b21575b73f7b7e71a63371cf58ed0dad49704894430dc77440509f85984a14a05b523f1b
TLSH
T19EA002B28ECB2CE2A82448ED634A370024ABFC42831200F012950082E0044638AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

PVWCTO.exe.bat

Path C:\Windows\System\PVWCTO.exe.bat
Size 72B
SHA256 fef7451b8413a29562d9eb075769f459430da74274f7b6d2429bd370d1dc0d43
MD5 0cfe0f0006745c37f863ba221005a865
SHA1 876edc077110d715c044a958b719ffd0be08c3f1
SHA512 05b776210f9b835900bf4d0a585d8b5dad7afdf007a527fbe1c2bf34f7652d94119ecdf4fb795003d59b94cf20bdec18b9b65308e05322c384f020571e51641e
TLSH
T1C0A002380FC133E28CA4406D434AB720062FF462831000E012950082F0046638AA2ABC
MD5 SHA1 SHA512 TLSH

Submit Download

QBJUWK.exe.bat

Path C:\Windows\System\QBJUWK.exe.bat
Size 72B
SHA256 8ef1620299e40c480d58dbcbee93654959e682a7775da299f93e1c9aec1c83de
MD5 a696b2db0133f35722349adc6a501f92
SHA1 e2771ee033b2253b65fe6a6235a068c9e6b74491
SHA512 8a2232c50a4330629c83d272f7042a7112e8007ce5ac5c38721c0944f24ba5514af224945e0f61db81fd948b89d286804d66b182cd899e74445299373f8bfe62
TLSH
T124A002308EC122E38824C06D43CA3780043AF442031C00A092B700C2F20C4638AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

QGNGWP.exe.bat

Path C:\Windows\System\QGNGWP.exe.bat
Size 72B
SHA256 59dba4cfee4b0026d782f85ffdf7f78bc94c5fa0a6cf6bd2fabf752500793633
MD5 0c61329a56ad0a386969116247db7770
SHA1 79c0e8edf3f92dfe4f67fa882de72604e1c3d3af
SHA512 3a98b88a6804fd930eb286f42b7a7a1a215345bcef5cea3a9a8ef1baba75687538df3af307e6d39ff84baf07c4879ad3aa472645c9dd14b237ab3d0d1941f2c8
TLSH
T1BDA002380EC138E38824C06DE34A3720042AFC4E033A002032950083F084463CA208FC
MD5 SHA1 SHA512 TLSH

Submit Download

QMTZP.exe.bat

Path C:\Windows\System\QMTZP.exe.bat
Size 70B
SHA256 b339c8c00dd3646d0a6411fe41a552dcf9d4fb1ecee9781cd519c91db641955e
MD5 911c6fab66bdddf50a34662ad135ae6b
SHA1 e502243445b93b891d6b9818d4d3b7ac716c7db4
SHA512 b09bc81d6d64794ddd5bcef5949a6e33cdad0da5b0b1d1626e6dd8587f67266a6186c1314383f3929d8ae2cd28a909eb9a8b590f9342e222d282503bb72124e3
TLSH
T1F1A002388EC120F38824606D434A3700042AF44A2338083012BF0382E0044E3CE20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

SEYCBY.exe.bat

Path C:\Windows\System\SEYCBY.exe.bat
Size 72B
SHA256 7fa95054e5ae049f72afd25d7591b9c60bfcebd084f7b35a1294d000cb00bd10
MD5 0a8adae0c25e425b527e4da9e5a7da5e
SHA1 435f629030ea16f8af089fbc4ddfba000302191b
SHA512 739158462946729bd77373b8305c1fa8ab4def01513bc66950fca927bdd10c148867b9151218147aaa5245bdb3ff76f449b2c45224147f80718e76f836574387
TLSH
T110A002302EC1A0EAA82440ED434A37082E2EF442031808A012B50082E0AC463AAA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SPEGRG.exe.bat

Path C:\Windows\System\SPEGRG.exe.bat
Size 72B
SHA256 d594cb0b58cdefbfe2892990bca79744a5a44d598fa223286d0b125b3d27f647
MD5 684888a65bf7165671c79131eb83182a
SHA1 fb08005e66079a6a913f08409fe164f7f74d24ca
SHA512 d467f8c677070d921c703a390dd7b7f4ce313407eb079a24dea474a173bc5d99046dce8c18245ccbb56a1489840b55e97fd84ef92b8a5a29339afe48808c12d9
TLSH
T1ADA002300EC920E38C26407D434A37008CEBFC4283300A203BF50083F00CC738A2C8B8
MD5 SHA1 SHA512 TLSH

Submit Download

SRTCAF.exe.bat

Path C:\Windows\System\SRTCAF.exe.bat
Size 72B
SHA256 e20b9fe883b3f344297974b17953be20c48db3ad1017e42e0eb3e38fcf0f8c98
MD5 2cfdf01e20d00e1909171fb05a661069
SHA1 13a3626239733901c4e18cd72007049bd97f69e3
SHA512 2879cf66d2e5f64a0b03091ed3d40a02f639820e4f833cab225e88372f8c69fdef8c95349c16045eecbb6ca729c0f629d129891167cca71d34b65a24312032b4
TLSH
T1CFA002300FC133F2882440EDC34A37322C2AF44283320C2012B52082E0046638AA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

SWP.exe.bat

Path C:\Windows\System\SWP.exe.bat
Size 66B
SHA256 636a96e7710ab4973009cb9500e847ea60b9b0a15192686f8d5afee58ab795b7
MD5 200e67d88500328b7622fd021b9953f8
SHA1 3e66fe11c37de069729db736fdacb8122ed865b2
SHA512 626fd881ccef54137111caf4c2d41217452f4e9febf80622db50d3facc2d76bdfd143ec4e82e6bce9a4a5e87487f6e1f6de6d027742af3c3aba3152f4f3ddba4
TLSH
T109A002382EC320E3882440ED434A37020C2AF44A0B32082012B50082F004463CA288F8
MD5 SHA1 SHA512 TLSH

Submit Download

TDDJCFU.exe.bat

Path C:\Windows\System\TDDJCFU.exe.bat
Size 74B
SHA256 acc4ee5778a0a177e26c07725ea4fc16cf95e009a96e0827828d7217088af440
MD5 80fa55c856a13ea1da17fef1566ac40a
SHA1 d16e099666a1c719f24c92f189e5db9d574b7252
SHA512 9745e06965b20f06cc73f1cc10eed33a6911d716cc449fb9eaa01d62ebff0cc9a46e4082b812834492875ae31607065d60e7d84d95dd45e47e88ad205620b03b
TLSH
T1E8A002B88EE120EA882440FDC34EB720042AFCC203180820129508AAE806CE38FE0AF8
MD5 SHA1 SHA512 TLSH

Submit Download

TIULB.exe.bat

Path C:\Windows\System\TIULB.exe.bat
Size 70B
SHA256 1fd52fa9e9f7b01f597f3d16e49740056a144a27e6db3b3cf382bf7bb6057d62
MD5 1af02f27637dde166a210bad6f62baf4
SHA1 4c89b8cc233bb36d426c49519ad9f8e22d754ee2
SHA512 34617a84e9c1b702a6d66a462916637191e954ab428efc50c75829b5ccc4085fd82bc9eb971dada8236b6d07939bf51f12c8820bbb01d19428bcd80916f83511
TLSH
T18BA002308EC128E28824406D634E3708062EF4C28312082213950A82E8244638E20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TSXD.exe.bat

Path C:\Windows\System\TSXD.exe.bat
Size 68B
SHA256 279064afedd102010df5469ca98ea876ef30a4b36c266fce2253f5e9dd3aa385
MD5 aa8b345fff41f2e9d6efddef43a5e15f
SHA1 c1b314e9df6b91f701a7f4689a97ab9482053c05
SHA512 28eb5ac5efda0172bec1922b30d570f6e3c0d035674ea76e052769620791949b9f6f274e64568b11c7ef7e44bef134df879ed76035db45aa20905460eeea85a4
TLSH
T17AA002302EC1B0E28824406D436A3700042AFC428B12023012950282E8046638F30AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TWAWQDM.exe.bat

Path C:\Windows\System\TWAWQDM.exe.bat
Size 74B
SHA256 95f84ed74de53adec8691e871862166bced113548851a3c56d41e0e2d21f3523
MD5 d891ea65b235b57db8985a537f1fbdb4
SHA1 44232e5b7accd96fd1e5c5dc31106171f11c20a4
SHA512 a0630a722199ca2f4f0bd3279fdeeaa4412ba5469d3d5e37d97b92d5f643d206b1de98a99e3132ffd800c95c5472b546a9430e700992443a58e037b4f06a3d80
TLSH
T12CA002382EC1A8E28A26C06D434EB780062AF44A0B13082012950082E80746B8E20EF8
MD5 SHA1 SHA512 TLSH

Submit Download

UBI.exe.bat

Path C:\Windows\System\UBI.exe.bat
Size 66B
SHA256 8d7723ac93d632e5dc3ed39211229a3b38f4aa001cdc44adaca7167197e26dfa
MD5 14b4961d689588387a2cdf1df9c07152
SHA1 bfde63d6ceb32b039a6be152a836427681e91fde
SHA512 1f2eaf11ebf036b1bc99fc7c4d7c06fc4229c6495174d0ad3fae791919b2e31b055169b7af4cf29db19c437eeab8806df5c6deac906d09b7d7e99d91a800d635
TLSH
T1B7A002308EC1A0FA8824606D4B4E370004AEF4420B1200201A95088AE0044638AE88B8
MD5 SHA1 SHA512 TLSH

Submit Download

UIZ.exe.bat

Path C:\Windows\System\UIZ.exe.bat
Size 66B
SHA256 2fdb018673ee07563e8b6a2a875409a6714ce4aae60c3fdc305fd67069640bb4
MD5 61652d8751714669c48ceebc01a3b8ec
SHA1 7aca004059a4187282492d0befc00aa9e0332191
SHA512 faf837018e9bb507ae9b47f5d7070c92b15f26a983b6eae236de8d60ed4c07b8f0cbfbc8398c05f3fa397b165fc94cd5a92526a9f81a82f9624da936b032b09e
TLSH
T119A002328FC320F28824C06D434A3700042AF442831002A21295008BE0074638AB08B8
MD5 SHA1 SHA512 TLSH

Submit Download

ULAGCYT.exe.bat

Path C:\Windows\System\ULAGCYT.exe.bat
Size 74B
SHA256 03139ef4584adc1753791a9af357f6f4c701d92bcdfdebe9ec950fd43aaded4a
MD5 b6c7703d265fee09c954dbfebe26f8d7
SHA1 72ea2806fc0bedc222a84701212c5d3767c7cc74
SHA512 2989d2af53d75688c4f67bfad60489892efeba2cda65f837ca0084b4cbf9f7b534588e36b9ffd38e31c35fc1d3328c2b9380bd0494793d9e189fbffd5fc63995
TLSH
T1CEA0023A0ECD20F28824406D43CA3780242AF46303100B329B97008AE8C446BBAA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

VZSRC.exe.bat

Path C:\Windows\System\VZSRC.exe.bat
Size 70B
SHA256 7d532ac26544a764d851329f44bcf7eca9e421106d05929fb5981053d49e6797
MD5 3c03d80ad3771f2ff677bc664d5e4e64
SHA1 f537cb5b97a36910d98f321c8c52c8f727b6d3d4
SHA512 25b0907ae0a3220f9f037e86b9b9d8bb8e0d098081e9a072100d72b0e82409d812d66d3d644e0243002ea56d0867100cea49178ea6ce5e20ea95e755521ae3df
TLSH
T17AA002302EC1A0F28826606D434ABF000CBBFC42831003203A950082F2044638A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

WCSLS.exe.bat

Path C:\Windows\System\WCSLS.exe.bat
Size 70B
SHA256 c16dba0515d66f55ea0f8bacfcf57124a92feb2c4e889a3015e2639e685b545f
MD5 61daad0cf9c0412c2555adca0096721f
SHA1 07db1ad7bd15e2bc746f7a6c2750822f6e997e33
SHA512 9f79b76acae6efc20b4126d2c29a54875bcca90c597d61b324cee6cd7a591f5f1fb7cba23bc4c7baaa975c1c04367af98b50e66458eab92a583951e1ca0952a4
TLSH
T1ACA002322EC920F28824606D6B4A3F00242AF442031000201295C0C3E00C4638A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

WLFULL.exe.bat

Path C:\Windows\System\WLFULL.exe.bat
Size 72B
SHA256 6213289172e82210dd431024f1ce05c62ea5ce8bef06ad6e8935982f7388cd93
MD5 632a33b232c8b796fabd8ed6d6518b06
SHA1 633779bceb75cae7c997c39b524712a2e780a5b1
SHA512 c361c419f92b5cb8f83661dcc50cbb8636371153392296d4f8babfa7c96ca7da57a68ad101f270c0b8fbb81d55f12bd3b70dba270f603531e7df2fb852fd5c3c
TLSH
T1D6A00230AECB20E2A824E06D634AB700242AF443831A08201A9500C2E306463CA20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XIBKKAH.exe.bat

Path C:\Windows\System\XIBKKAH.exe.bat
Size 74B
SHA256 9f640ee38f2b7f2fff823070dd572ebc2bca41a0da488883f1ee45950e401a7c
MD5 4ead6f9df4fbe87e5b2a28c8dc3eabf6
SHA1 a5823a8d722ea74d9a32aba8533498c1398ac0c8
SHA512 64b3d19ef3c7269542c3ee75f37144f9a815fc774f6f2786760b206a811b7bd9064e39ce8504ec8ccf8435578bfe8ea6f2dfac2414a596c4683698d40b383375
TLSH
T11DA002300FE12AEE882CC06D437A37202C2AF4C203180032139D0282E3EC6738A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

XQY.exe.bat

Path C:\Windows\System\XQY.exe.bat
Size 66B
SHA256 54a583629ad767208efea5ec3348487587d09ce55cb7c56783625335bd0481bd
MD5 92da1ae460142d63fee0e1bad9cb066d
SHA1 e081215c5ab903aefd26b426bf1b1b96cb412ec8
SHA512 adfd04ce5c0d202fc47ab5a2f2c05aff7e048180917379a487f5dc3f5024df9ba0fbcb9e0fef9c668b00ef43bc5f5d6120e8fb698c76e775ddebeaefffc0d20e
TLSH
T186A002300EC128E2AA3C40ED4B4A370034BAF44203102030129500A2E22476B8AA0ABA
MD5 SHA1 SHA512 TLSH

Submit Download

XZSY.exe.bat

Path C:\Windows\System\XZSY.exe.bat
Size 68B
SHA256 16e01082998c0962117b51d8bd1b7daeedc5aa6b65dad2f3c00f58a995220b83
MD5 eedea6ca2a8edc63b57d3143237849bc
SHA1 ec73549514faf94b58e3958194ca49d4671b23d3
SHA512 31c4f504495af159db00f875e4f3a8ceddc235481e7ce7dcd2d1c057efe32d3e697ab2b8132c430d634e2c2b698f96d6ed99137022e2ff345ecf9b6767a5d250
TLSH
T11CA002380EC128FEC82C407D436A3F28242AF4420310083032950082F2246738BA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

YRJOG.exe.bat

Path C:\Windows\System\YRJOG.exe.bat
Size 70B
SHA256 9601622a3316fbe1a5ca10781dea995a84f3e7d04bb953432085b58f899cf3f7
MD5 4ad2e7a31cd22e8f1b092ddf1441951d
SHA1 4eda03bfa8935f6da362d5b4b41f5b138d7a34d8
SHA512 75da1372d27ff650472ec01fa054cf8f97f947792d41afae41efba16c0493d3f6af9621004c2dadf342648a44fd6e6bd972b6ee95a9cd5a410245a17246cd5b6
TLSH
T153A002300FFB20E28C2CC06DE34A3728242EF6CA03100020339708A3E0044638A2CCB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZEITAJ.exe.bat

Path C:\Windows\System\ZEITAJ.exe.bat
Size 72B
SHA256 c99f4229b979ec9e57714c676f89337a94685f6b6940885c082b0b5649dbe03f
MD5 ca965efb063a852d9a281a80c72949b6
SHA1 cfc99ceb652b8ed7b3ffb955104925223772c315
SHA512 574ef3b5ec71a433e846169df4197c747d04432377e72798b71e694b06ca194ca3eaba91e234dfab7721284f599b957a7f305e9bcdd441ae9502f54891a99691
TLSH
T184A002B00FE123E2B82440ED634A37800EABF6420318002012BD00C3E084463AAA8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZGG.exe.bat

Path C:\Windows\System\ZGG.exe.bat
Size 66B
SHA256 83157a2fa2375171d8b594bca01884a4c558e7d116815d977ec2ee2b5bf83c44
MD5 60edb9eeda60e5b423e3720b2f81022d
SHA1 be9dbba1f0104b8820ad7ea2b235966c3ce00e75
SHA512 3011b9bed889c1196b2f29ff61f464ec7dd38c56a2a14c8dbbdb239f46be8f3d49aa6bc2e761b285cc53336ab5bf19bd918a99dac6f656900748bd30ae53a40a
TLSH
T139A002380EC920E28C24406D434A372204AFF4420312002892950083E004463AA288B8
MD5 SHA1 SHA512 TLSH

Submit Download

ZXUXPR.exe.bat

Path C:\Windows\System\ZXUXPR.exe.bat
Size 72B
SHA256 161968309a81d9004c899b1869f05e656c2b5ed20802a323ae4d4dc5b70e4d95
MD5 13ded561d113c2d9b825db8660ac032f
SHA1 9fb850a02b95f26f14103c09dd65d4341c1e365a
SHA512 6c07b272c51802e762aac2612bbb27707f97d8b5151048ec8b819a12f6f0924e089065d512f98360b4627a1f8bceb8ec012fd06ea8ed5c4d9d2b8fbba0c8fd26
TLSH
T158A002B0BEC120E28CA4427D43CA3708042AF4420B10002093F58082E00CC6FAE32ABA
MD5 SHA1 SHA512 TLSH

Submit Download

TAJRP.exe.bat

Path C:\Windows\TAJRP.exe.bat
Size 56B
SHA256 e083a7112ff11c018d845dca7f36c538c683dd05c94ea329304c90955b64eb3f
MD5 274023b4c157c6fd28c581ab5cd4a3c8
SHA1 824e7d1e838b59b703fa2aa1a93a451887f1a37a
SHA512 2e65cecdaea8edaf95743440cb852573dfc793202e8b3ded55ba1e9421f793a43978258e6ef02435dcd3b22fa83c8bb33617816f0ac5e50872ad5db08ad3c6d5
MD5 SHA1 SHA512

Submit Download

TDVPG.exe.bat

Path C:\Windows\TDVPG.exe.bat
Size 56B
SHA256 8d36b84e2e6f89036075d2ab97ed652ee6465a1513517b5046513381abc67d43
MD5 fbe37b6513958a426f13f23b89c0c7aa
SHA1 30c34ebabe947ac7a2d8cdb027a5994ca1af212b
SHA512 b36543b674818d9dc84c8f898de1c48e59d4f0df7db16f75bec93e0ed8f533d4d246f0cf71b7af068b5ec6760072ea50dfba3eb71d7fb255915565a89f4a72fb
MD5 SHA1 SHA512

Submit Download

TIAABK.exe.bat

Path C:\Windows\TIAABK.exe.bat
Size 58B
SHA256 d7b69444e226faf736f7736c82ca5c91cc52e76c6b2de953120ad4736c62a386
MD5 826a346c9a96eada28eddaf72809729d
SHA1 855b2859b1d63fab2ad40a683e2d757b9c40002e
SHA512 ba07ea0ec47563afbfdfead7e9761c246d804b2ede75ce28654b897ea08fce07c2338e4e53ef3f117a3f6acf596ef662f5865be79e838db88012ad4305a5aac0
MD5 SHA1 SHA512

Submit Download

TLKZQ.exe.bat

Path C:\Windows\TLKZQ.exe.bat
Size 56B
SHA256 afa9e75f8242547e45de7f39f04f9ba4e6bd484ca3a74a145f211dfeb75f8e68
MD5 9b2f8548877b8e1407d66f98c19c9cc3
SHA1 8e8e17af656fd5ac4cdadfc865665c13ec1b2c04
SHA512 e1d5cc301d5ed13d561828a54486b3834a19fb1c246da0b285fb1d402394674fa6585a90b57d750a5a87879abb7fe76f9832b94116f07887f791163c992d3042
MD5 SHA1 SHA512

Submit Download

UFU.exe.bat

Path C:\Windows\UFU.exe.bat
Size 52B
SHA256 588ff449e6fd712892da978eaa45ca0283c2b616ad158fedc5d1b141ec1c9bcd
MD5 19bdf6834814fb8b70b69a24d510df63
SHA1 05fd6b75ef9150ba456a08878e3cbb3fc1944fa7
SHA512 994566725398de5e586938359bd480346e3230fc14425c3449ca7b7233c6362fc1d79e56ac8bbf5dcee3f89ec488e883b5e373e84f124cb31f117bae48186abb
MD5 SHA1 SHA512

Submit Download

VABXAI.exe.bat

Path C:\Windows\VABXAI.exe.bat
Size 58B
SHA256 144907fba271940fe6cc6e734b7caa8886e8e9f76f1e6151e94df2ed73e66fde
MD5 ef742ac7786560b70adf441517cf453a
SHA1 58dd2774c79e2309b7505120f0abafb817aeda89
SHA512 e1ac34e6e21a9ceec5ca4302f57c0567e2bbf3f23f283b263051def59a5f2f4b5e9343ff0e090bc925aa95256acd96bbcc1da37e86c946c15404d71df5e3cd5e
TLSH
T193A002328AE322C0882C40496B4A3702068AFCC082100082B2150A80600444B88088F0
MD5 SHA1 SHA512 TLSH

Submit Download

VBK.exe.bat

Path C:\Windows\VBK.exe.bat
Size 52B
SHA256 3c64fa4cc683d630d87d8dc863a50b25addf72f42aafb068a88a7c8af22469d9
MD5 eeb6b753414cd46d7319f91783cdaf5d
SHA1 f634e4c021a725789720682f3556303b2961ed5f
SHA512 62645933a3fbf921a35a40e5d894603b5cdbe70e9d7115486d31049d7989b4aa0af70ed9b6bfe5954197c963ef5a837320bc0c1abe802e3119ef888923f4680b
MD5 SHA1 SHA512

Submit Download

VSL.exe.bat

Path C:\Windows\VSL.exe.bat
Size 52B
SHA256 dcc909e6aec1d898621bed36f86be64839ce59e09ae08b6bd0a3036553405e52
MD5 69ac9e9c778c42ac30882ab80e91e499
SHA1 18b403618ff834a241a2f9b720e606633d526acb
SHA512 22c53f3129daf8b10c39e7994f5c939b0fa7f43d04955946fbc3776cea188b825bc5bdbf35e31e6a61fd067db156d07f8bad6b7859cc6c7f07f2fa63d431ef4d
MD5 SHA1 SHA512

Submit Download

WDOPXI.exe.bat

Path C:\Windows\WDOPXI.exe.bat
Size 58B
SHA256 8f394223f271b9bd3eb41e2079710e4a4bf2ef4fd98d1e9e750f9f73bebd0d7e
MD5 8fb6bf3c3be48b247e5f616664030269
SHA1 9691719d7e439616e558c405891c6460234780df
SHA512 32baa9b02ef9b2ddeb29cf87402f57f9e76a858cf9180843233367c2443617c4e36a612cbb0730c565d472e3955b5b92483d12a28a226a05103a01144876464f
MD5 SHA1 SHA512

Submit Download

WPDFHGW.exe.bat

Path C:\Windows\WPDFHGW.exe.bat
Size 60B
SHA256 53dc67a8b56e16ac7f113a70c8c03305c32554e39f6a448b82e0557a81373b1c
MD5 414b1c3b8527e5405b101ec0766447e3
SHA1 ab3244832ab3ed5827f663a9d514a187299683e5
SHA512 a72f9f73fed3ca9ad92308db56bb4f5cee73552767d45c9b0114925ca7b303c2aab49a972e9a14f3fb6fc86113ca6396324e1dd7f56de42f91ab487833e0b041
MD5 SHA1 SHA512

Submit Download

WRRD.exe.bat

Path C:\Windows\WRRD.exe.bat
Size 54B
SHA256 9703f257592750ca0ca3e55b91946a4e6f52bc98649c689d20e6bf4ec995c8f0
MD5 a22c83cd2aabed27c37c2c9a7a8ad8b3
SHA1 1b7a4142a0f6dc7a109950a02807c2a4ea47e5ac
SHA512 68f13d83964f99200313fd06d2a05bab4f498303fd63a9d10b2e135157a31f019b3ff8b008c9507ac5e5fa78443b06d4cb292536bf2ea0f66112375d4dcb663f
MD5 SHA1 SHA512

Submit Download

YGJ.exe.bat

Path C:\Windows\YGJ.exe.bat
Size 52B
SHA256 212d41ea13011e41f6b224175063557c3ea2f8ed722993dfa733cc31d1d652a7
MD5 7638978c20d7f8691c747e9a2680cad3
SHA1 fb8b5d7a473c3df039f7ba39908fd4ba2e719d41
SHA512 539c03b45b553ab6c48b6a58ea95a302356d61edc584ca84006efca0f4681c1f8d7e273292845b21673068226c326d6dee6b57b846d1f72cd802459b351e4573
MD5 SHA1 SHA512

Submit Download

YLU.exe.bat

Path C:\Windows\YLU.exe.bat
Size 52B
SHA256 d14f2c2cd56fb8e1f9974e8ddf18feb216b89d277ba15c425db47daa4862b957
MD5 685fefb83c89bc53f08a1f53ce2f7e82
SHA1 62e9cc79ebad036f63fcdce398404a4fdb659c7a
SHA512 d1994036855243a7c24919e1ea123d3fe0f586b5eb203768a5f21d63c2d7d3b544c0d506d648b094e298353f043751b10572c85f159fff77f8dff40b59e0b6c8
MD5 SHA1 SHA512

Submit Download

YNAYQT.exe.bat

Path C:\Windows\YNAYQT.exe.bat
Size 58B
SHA256 b9a5491b235ed6c78d1373c5887fbc145578ee7d5977860adb77f0c84398546c
MD5 fbbe68aa3e211514e309638685853191
SHA1 e54eff4618a73b88890e66ae8eb2587660d3550c
SHA512 34abcb3734019d575efc06a85d263a7555e4422f325583f9475279550dacdb760beeb4b90156821537dd00f04f8734d2e6280aa33f653805e25f76016e108805
MD5 SHA1 SHA512

Submit Download

ZCIYA.exe.bat

Path C:\Windows\ZCIYA.exe.bat
Size 56B
SHA256 d6d7997860152ba874571d41613e2175573c2022c0f642a8331fa66eb402961b
MD5 c004906ba04e176abdaf945a59d6bab1
SHA1 42bbe41dce1c3dd892e85d1e730e7e8b6370383b
SHA512 da43eb6cb50b8fb42eb70b2fe5779a1831ce3cfd2dd534d2a03c2f8701574fe5bea28edbb1a1945d73d714464dc9e6d69dae3ef60883463b31553c2016be98f4
MD5 SHA1 SHA512

Submit Download

ZCLZYNV.exe.bat

Path C:\Windows\ZCLZYNV.exe.bat
Size 60B
SHA256 3ed47b0e5f7551e5eddf74f97b2912bbe51160c589ff433d2cb23709f31af3d4
MD5 13c7f88aebfbb7d834db90d6cba86125
SHA1 51726c4a5b038b1ab1c20902a5f1f125bf98385b
SHA512 4c566208941678302deaa6f88a96e177f8a77ed1be32127bc997837b623f586884adeac6e0d707b80daec6cec4779f77a8edeaac21441408f88edbeaed944e6a
MD5 SHA1 SHA512

Submit Download

ZJRXQKE.exe.bat

Path C:\Windows\ZJRXQKE.exe.bat
Size 60B
SHA256 b076d0d97e658c0a76254991892cb1b03db8b5a62d88420318c7542be9b1cf5a
MD5 8f118e4510a63a2efdeb9c92a20b4d9c
SHA1 909518a20b67ee3d7444d246899bc9946292c342
SHA512 52f09ec0b8a1ee5edac189c80da11c95a3c83bfd317c771388d4c648c55a857fc753639c5e7253ff7e2d424b394a1fc61ee1c6ee41c234e4a577772723f77ec9
TLSH
T176A0023008C328C0EAAE6849434A3702040FF6C002B2C00012152082700464380022FA
MD5 SHA1 SHA512 TLSH

Submit Download

HIWHLW.exe

Path C:\windows\HIWHLW.exe
Size 208KB
SHA256 a525fc3fff1a3236ec09df6964ce88d51ab3e0e765b289293a1d25276f0f85b2
MD5 110f0a3cf3df5bde928a62285a4d5dda
SHA1 f5375f781b00b9daf19f30cd9b3152773e5dcf17
SHA512 797d2af37ad5a31d3145d0326b095069f5136e84ba892d6041060dfe2da09f4656e3085cc9fc40adda440dd1232445dcfc4d357c4b3045660fa5295cb2989033
SSDEEP 3072:KCHNyUOoBuCWonsUX1P2sV0ASQj5V4j/PmzF3yxtli4Zmv4pLthEjQT6j:ngU7BrWyphj52jQzkEj1
TLSH
T151246D43B64DC277E1D796718DE5C274AA7BBC00AEF1830F60853B5D58BD6288CA1BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRESCLQ.exe

Path C:\windows\IRESCLQ.exe
Size 208KB
SHA256 f7da41951d1495118781c6db363b6ddc4898861d131fb07491f7afe3bf6aaa22
MD5 a292a229297ea405c5265cb6ed9c266b
SHA1 082c854874214574180efe253c58cb1e25df9574
SHA512 2ccea2743052fd48038e6570cd0f03fff3ec927635b0490cf020b2f54fb8cbfbf685b1257435f58dbb87e1b2a7ebf65a3ff847111d0844d16bbcb827d6c50d55
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+cOfZ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+cORkEj1
TLSH
T156247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWRB.exe

Path C:\windows\SysWOW64\OWRB.exe
Size 208KB
SHA256 b36c9bb0ef9e2fc57c9daba706ad64127e1b5e7572835ce07c0e8f6f74063252
MD5 d65ae8809165c7724912dda79832d0ad
SHA1 e0a8c462e7b3da9880f5f3bdd1ee65bb445669d2
SHA512 7c8c667942ecf0bf767b68905912d32262866058928f0d6126b0fd380462cd89bf84d2f5e21c1724f09fc90f6ecd3d11c6ef3f89674535a8a88415154a0c11bd
SSDEEP 3072:3DP7lqCFo5R22jeLvqvuepaT9ce6DYujI5eX4pLthEjQT6j:TP7lPmmepK/NfeXkEj1
TLSH
T159246C873580D943D166C67F98E1EAE55EB9BC239F75CA0B387E332E79322C54442A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STTRIMS.exe

Path C:\windows\SysWOW64\STTRIMS.exe
Size 208KB
SHA256 c7cd8e6d877de4831bea240a1e451255a5632bcf4e3a454d9cd94cd235abad62
MD5 5a4029cc17939bc7b6203074a3dcb77f
SHA1 c0475da19a4620f11535901771ac00f755b6c84d
SHA512 dda22001e10638d334457d97855ce77feb8f6e157a25d6eeba19b386b06bc67dc1a2f1af26b14a34e7a4102f2a3d99c3ae06ba2ea7f9d25cd75d420d7832992e
SSDEEP 3072:6iIuNWebqqzhCGP/WhaRFj4NPf75clb9KqT6h7SazauCk4pLthEjQT6j:bIyNqqFCQ/W0V4NH9clbMlznlkEj1
TLSH
T1B0247C126981ED51E07386719FE4CA5B6AB2FC22EFF9C62FB488778D1A351401F39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VABXAI.exe

Path C:\windows\VABXAI.exe
Size 208KB
SHA256 3cc42e15b0d0b21ddc83722587e952a2fd136ab7ce0ce090f9fd4abde317c606
MD5 bddac923f6b2e09ac46d45099fb6db5a
SHA1 716dc9d66dab1d5f3eff919ede4c3001cc366674
SHA512 7ceb829c6a3599eeeb6e7952642508657c6ffe1586f27c16277afe3b013386cd5975a988e93f3ae751e1b52ac1d345cd139b0d9f41f7e7791df1fa0fc6da6753
SSDEEP 3072:UDCA2F5k/XWTTOMzSCIfq0HhxkrBAVwYvj0Tc1zT4pLthEjQT6j:UDCA2jk/XWTzDf0HsrBUbYYJkEj1
TLSH
T12B247C4676E7C406F177927088EDC5A15DA2BCA33BA5426B7544F32CB871E768832B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZCLZYNV.exe

Path C:\windows\ZCLZYNV.exe
Size 208KB
SHA256 566c237b6794bc8097cbefdfac14b857330f4bdce50935a96fa09ff4823a13de
MD5 d5f1dbad0d45d12362d9d0aa7536479e
SHA1 895d04b75aceb5e43561f83f83bb5b47d52689dc
SHA512 ae05a364d0070622e5ff4152839712ee319b33487d928d459bad9886029728d52b7a027a4b47d3ca228e2db381b684d5fddb64368ed91d153e61c170d9fae5fe
SSDEEP 3072:+8F38PTzDGtZLT4Q5R0Uu+qGv4DC74h4mN4pLthEjQT6j:+M8PTzDGwQ5R0UuvGv4DvkEj1
TLSH
T115249D9071D89097E11F07B48CF8D6582ED9FC2A8F7A417B32A0375E5E32266CC76B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BSUDLMZ.exe

Path C:\windows\system\BSUDLMZ.exe
Size 208KB
SHA256 68d72b9add24dcf0dffabbead622cdbff5059a6be4324387018c64b7d57c26aa
MD5 038108985eded87dbbd9927fd7c08027
SHA1 14b64c5f27e05640ad97b54482682645da605432
SHA512 c87199077204e6acd68998a2e5e41c853f15fa0f1060395d7f2b12a9c962f7d1e2b6f8c75bed507e92f85ea84e125ce0db1a75d845dfdf6be9c96e1549303d37
SSDEEP 3072:c1H1BHaLuiAXlvaFNaVTX6/X3EwIT6t4us6ieKr7Kg1MoQa4pLthEjQT6j:gH1BHRYNaN6vB44OrtdhkEj1
TLSH
T1F3247ECA39D6D929D0A7423D0EE2D3B80A737D63D776822F7690374F68312974B087A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HKNJF.exe

Path C:\windows\system\HKNJF.exe
Size 208KB
SHA256 9383abecaf82cae3612501d8f8f7d32b8c5127d0220a1ea201b63e11162c27c0
MD5 a04c51a706ceff71d39c0b46c81631cc
SHA1 808e3d44f31d46d245996c1f9536c472beb092d0
SHA512 336a52ec0f86a54ce4130d232de637a1a11fed539c0a9178d635407d26a4e2932afc1e66e09b21de93b434553e7964b343d12540bd61b143488cbd1c7931866f
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+cOfr4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+cOTkEj1
TLSH
T110247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MCFM.exe

Path C:\windows\system\MCFM.exe
Size 208KB
SHA256 d176cf17aeb4df12f989b50dc02564d8fa3a9089c6c0a438a333380189816fcd
MD5 f4379719be4ef170de925f0dbc50393c
SHA1 8777e874eb66dbcf56876309478439d795d6b54f
SHA512 1c4f1a68eeb9f26a20dd6bf8c648e48202cd0ab536effe3da178666a49ba058645e65af27f8bb590b6478674d5a9e47b9fa0b5f198dcbc1755e51574f11a3694
SSDEEP 3072:gW9CO41zW5pZJ5p50uvq2WKW9FYx+zASasdjr2zMYeCoZ3X8G4pLthEjQT6j:giyz+vqftY8BaeH2QYepZ3sGkEj1
TLSH
T104248E197569C416E0A742744CCACB3C2D79BCA17791CB6F3E48B38D28B1398CAB6753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PVWCTO.exe

Path C:\windows\system\PVWCTO.exe
Size 208KB
SHA256 84b76ac9a0f74b0122a0d8df00b950f503fb170ad98c6c1711100ef8fbc3213e
MD5 6461ccc1106c9874bad1d3849bccbc6c
SHA1 c62a6063daa7389002c26eda84db23027b554214
SHA512 4dc87d226031556f6fc909623f16f60e39cfdf03e744ef51529955c31dab66f776e30de52e24f2f5ec7c80113328a648f236e2a651d30d314e287448338f0bda
SSDEEP 3072:LhP17L761j5Zv+AlKGB+Q3YaFIRBkPzbN/AX/v6jt3ymrib0X/u5upB4pLthEjQS:L117fgVlORBKzbWn6jo0m5upBkEj1
TLSH
T1C3249D47B2D9C716DCB7063048F96BA41A66FC217FA94317368433AE1DFDAA4CD02762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UBI.exe

Path C:\windows\system\UBI.exe
Size 208KB
SHA256 caa816f3ef20bb935c066e7ed341c0ecdf69c9595b03c938f96ed98ee8c6b9d7
MD5 ee614230243c8d91d976531e5d7109e4
SHA1 84710b214705117b843b8b6f96ac3364806d712b
SHA512 bb0f05e9c596d7ce1d242a9747e91e11a9d60d61ab5ec404d2161fbc2472be9ffd89c632daa4bf03fe648b73b7df312065b4fd40f0247316f3f2967ebb702daa
SSDEEP 3072:+UYQSHtxyKTLKwjxdLfpYHjZeopKWxkgJos4Rl+e4pLthEjQT6j:+ULsxyKTuwNdL2HjZUwtosWXkEj1
TLSH
T1EC247C823394C04EE39B5339E5D596A0167ABCE25FB22257BA84736E0C393C059DB7F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-61-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/556-436-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/632-438-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/632-401-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/808-72-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/808-90-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1280-151-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1280-111-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1468-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1468-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1520-358-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1520-331-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1532-152-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1532-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1876-280-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1876-307-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2004-332-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2004-361-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2060-435-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2288-88-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2288-112-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2372-335-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2372-306-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2448-225-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2448-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2540-334-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2584-245-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2584-219-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2684-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2684-80-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2692-226-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2692-192-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2732-164-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2732-176-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2816-260-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2940-265-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3128-333-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3128-362-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3316-173-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3316-150-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3380-115-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3380-89-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3456-79-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3456-101-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3732-377-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3732-404-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4256-81-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4256-56-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-371-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-349-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4292-25-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-167-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-177-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4420-161-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4420-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4532-168-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4532-144-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4592-437-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4624-402-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4624-439-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4680-379-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4692-62-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4692-29-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4732-223-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4732-259-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4800-100-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4800-130-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4840-378-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4840-403-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4880-282-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4880-308-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5076-195-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5076-175-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5128-360-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5128-375-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5208-54-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5208-75-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5320-178-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5320-172-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5520-374-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5520-380-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5620-283-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5620-262-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5900-319-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5900-305-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5968-264-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5968-251-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6052-359-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6052-376-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6064-263-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6064-253-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6128-270-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6128-258-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6140-336-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6140-328-0x0000000000400000-0x0000000000438000-memory.dmp

Download