3917add7e2f54ef7d5dd535efb83110be2f40935de77be1f037ddb16855501d9

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
Size 208KB
Sample260819-b8kpcavaqf
SHA256 3917add7e2f54ef7d5dd535efb83110be2f40935de77be1f037ddb16855501d9
MD5 565b6abb6c87527b35ef468acbc830cc
SHA1 660c3d5cd3d0e3991f5311d0ad5b99cf6e8ee90d
SHA512 b0b8dc1130240cf712712e8221f99118d029a349d65acdfed997a2026781a96cde3243bced8b5aa2a2017bf1cfdde452840900586fea770c56c59325919856e8
SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfB4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LOpkEj1
TLSH
T126247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1992	GCWHGF.exe
5472	JDZIXQ.exe
1100	BDB.exe
4288	ETHVM.exe
3712	FOLZSWI.exe
5876	WZWHAK.exe
4416	RKFGPN.exe
4236	MXJ.exe
1456	SSJ.exe
1956	OYTF.exe
5256	UTSOR.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\OYTF.exe	SSJ.exe
File created	C:\windows\SysWOW64\JDZIXQ.exe	GCWHGF.exe
File opened for modification	C:\windows\SysWOW64\JDZIXQ.exe	GCWHGF.exe
File opened for modification	C:\windows\SysWOW64\BDB.exe	JDZIXQ.exe
File created	C:\windows\SysWOW64\OYTF.exe.bat	SSJ.exe
File created	C:\windows\SysWOW64\JDZIXQ.exe.bat	GCWHGF.exe
File created	C:\windows\SysWOW64\BDB.exe	JDZIXQ.exe
File created	C:\windows\SysWOW64\BDB.exe.bat	JDZIXQ.exe
File created	C:\windows\SysWOW64\OYTF.exe	SSJ.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\windows\system\FOLZSWI.exe	ETHVM.exe
File opened for modification	C:\windows\MXJ.exe	RKFGPN.exe
File created	C:\windows\system\UTSOR.exe.bat	OYTF.exe
File opened for modification	C:\windows\system\GCWHGF.exe	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
File created	C:\windows\WZWHAK.exe	FOLZSWI.exe
File opened for modification	C:\windows\WZWHAK.exe	FOLZSWI.exe
File created	C:\windows\MXJ.exe.bat	RKFGPN.exe
File created	C:\windows\system\UTSOR.exe	OYTF.exe
File opened for modification	C:\windows\system\UTSOR.exe	OYTF.exe
File created	C:\windows\system\GCWHGF.exe	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
File created	C:\windows\system\ETHVM.exe	BDB.exe
File opened for modification	C:\windows\system\ETHVM.exe	BDB.exe
File created	C:\windows\system\FOLZSWI.exe.bat	ETHVM.exe
File created	C:\windows\MXJ.exe	RKFGPN.exe
File created	C:\windows\system\SSJ.exe	MXJ.exe
File opened for modification	C:\windows\system\SSJ.exe	MXJ.exe
File created	C:\windows\system\SSJ.exe.bat	MXJ.exe
File created	C:\windows\system\ETHVM.exe.bat	BDB.exe
File created	C:\windows\WZWHAK.exe.bat	FOLZSWI.exe
File created	C:\windows\RKFGPN.exe	WZWHAK.exe
File opened for modification	C:\windows\RKFGPN.exe	WZWHAK.exe
File created	C:\windows\RKFGPN.exe.bat	WZWHAK.exe
File created	C:\windows\system\GCWHGF.exe.bat	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
File created	C:\windows\system\FOLZSWI.exe	ETHVM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5696	cmd.exe
5896	cmd.exe
4524	cmd.exe
4500	cmd.exe
3196	cmd.exe
6060	cmd.exe
5384	cmd.exe
5920	cmd.exe
4112	cmd.exe
5080	cmd.exe
3288	cmd.exe
384	cmd.exe
4372	cmd.exe
4048	cmd.exe
5784	cmd.exe
5456	cmd.exe
2396	cmd.exe
1744	cmd.exe
5800	cmd.exe
2696	cmd.exe
2752	cmd.exe
1112	cmd.exe
3468	cmd.exe
2960	cmd.exe
5944	cmd.exe
3524	cmd.exe
2068	cmd.exe
4676	cmd.exe
4620	cmd.exe
2564	cmd.exe
4984	cmd.exe
1860	cmd.exe
5220	cmd.exe
1432	cmd.exe
5028	cmd.exe
464	cmd.exe
4304	cmd.exe
5600	cmd.exe
4476	cmd.exe
5804	cmd.exe
520	cmd.exe
5976	cmd.exe
3528	cmd.exe
784	cmd.exe
6008	cmd.exe
4848	cmd.exe
2748	cmd.exe
5332	cmd.exe
1060	cmd.exe
1340	cmd.exe
2740	cmd.exe
2520	cmd.exe
6084	cmd.exe
2524	cmd.exe
1880	cmd.exe
3224	cmd.exe
5620	cmd.exe
716	cmd.exe
5988	cmd.exe
2892	cmd.exe
1040	cmd.exe
4268	cmd.exe
3244	cmd.exe
3536	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1360	4900	WerFault.exe	87
3176	1992	WerFault.exe	93
1708	5472	WerFault.exe	99
4472	1100	WerFault.exe	104
3796	4288	WerFault.exe	109
2068	3712	WerFault.exe	114
4356	5876	WerFault.exe	119
5908	4416	WerFault.exe	124
4408	4236	WerFault.exe	129
1700	1456	WerFault.exe	134
5268	1956	WerFault.exe	139
2356	5256	WerFault.exe	144
6116	2272	WerFault.exe	149
792	1124	WerFault.exe	154
2472	2212	WerFault.exe	159
848	4800	WerFault.exe	164
2676	5624	WerFault.exe	169
2360	2204	WerFault.exe	174
3008	4992	WerFault.exe	179
1228	4104	WerFault.exe	184
4676	3192	WerFault.exe	189
3416	6068	WerFault.exe	194
3180	2972	WerFault.exe	199
1876	5444	WerFault.exe	204
5924	4516	WerFault.exe	209
5280	1184	WerFault.exe	214
4052	4736	WerFault.exe	219
5072	668	WerFault.exe	224
3264	3764	WerFault.exe	229
3420	5792	WerFault.exe	234
6112	4068	WerFault.exe	239
3152	5712	WerFault.exe	244
4464	3504	WerFault.exe	249
4180	5528	WerFault.exe	254
456	2776	WerFault.exe	259
1340	2080	WerFault.exe	264
2644	5280	WerFault.exe	269
1756	3428	WerFault.exe	274
4948	3068	WerFault.exe	279
2804	4412	WerFault.exe	285
5740	6136	WerFault.exe	290
3416	4512	WerFault.exe	294
3596	5832	WerFault.exe	300
1972	2988	WerFault.exe	305
2144	5984	WerFault.exe	310
3052	4324	WerFault.exe	315
3308	5716	WerFault.exe	320
3196	5160	WerFault.exe	325
1740	4884	WerFault.exe	330
2276	4944	WerFault.exe	335
3512	4044	WerFault.exe	340
4848	3348	WerFault.exe	345
4804	608	WerFault.exe	350
2196	2356	WerFault.exe	355
2820	5004	WerFault.exe	360
1968	3388	WerFault.exe	365
5236	2920	WerFault.exe	369
2156	5076	WerFault.exe	375
3856	1048	WerFault.exe	380
5740	6036	WerFault.exe	385
3924	1636	WerFault.exe	390
260	3588	WerFault.exe	395
2116	1876	WerFault.exe	400
4604	1872	WerFault.exe	405

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MXJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTSOR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCWHGF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FOLZSWI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JDZIXQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WZWHAK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RKFGPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OYTF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ETHVM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4900	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
4900	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
1992	GCWHGF.exe
1992	GCWHGF.exe
5472	JDZIXQ.exe
5472	JDZIXQ.exe
1100	BDB.exe
1100	BDB.exe
4288	ETHVM.exe
4288	ETHVM.exe
3712	FOLZSWI.exe
3712	FOLZSWI.exe
5876	WZWHAK.exe
5876	WZWHAK.exe
4416	RKFGPN.exe
4416	RKFGPN.exe
4236	MXJ.exe
4236	MXJ.exe
1456	SSJ.exe
1456	SSJ.exe
1956	OYTF.exe
1956	OYTF.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4900	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
4900	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
1992	GCWHGF.exe
1992	GCWHGF.exe
5472	JDZIXQ.exe
5472	JDZIXQ.exe
1100	BDB.exe
1100	BDB.exe
4288	ETHVM.exe
4288	ETHVM.exe
3712	FOLZSWI.exe
3712	FOLZSWI.exe
5876	WZWHAK.exe
5876	WZWHAK.exe
4416	RKFGPN.exe
4416	RKFGPN.exe
4236	MXJ.exe
4236	MXJ.exe
1456	SSJ.exe
1456	SSJ.exe
1956	OYTF.exe
1956	OYTF.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2564	4900	2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe	89
PID 2564 wrote to memory of 1992	2564	cmd.exe	93
PID 1992 wrote to memory of 5080	1992	GCWHGF.exe	95
PID 5080 wrote to memory of 5472	5080	cmd.exe	99
PID 5472 wrote to memory of 2936	5472	JDZIXQ.exe	100
PID 2936 wrote to memory of 1100	2936	cmd.exe	104
PID 1100 wrote to memory of 1744	1100	BDB.exe	105
PID 1744 wrote to memory of 4288	1744	cmd.exe	109
PID 4288 wrote to memory of 5172	4288	ETHVM.exe	110
PID 5172 wrote to memory of 3712	5172	cmd.exe	114
PID 3712 wrote to memory of 2656	3712	FOLZSWI.exe	115
PID 2656 wrote to memory of 5876	2656	cmd.exe	119
PID 5876 wrote to memory of 5800	5876	WZWHAK.exe	120
PID 5800 wrote to memory of 4416	5800	cmd.exe	124
PID 4416 wrote to memory of 1448	4416	RKFGPN.exe	125
PID 1448 wrote to memory of 4236	1448	cmd.exe	129
PID 4236 wrote to memory of 1040	4236	MXJ.exe	130
PID 1040 wrote to memory of 1456	1040	cmd.exe	134
PID 1456 wrote to memory of 3288	1456	SSJ.exe	135
PID 3288 wrote to memory of 1956	3288	cmd.exe	139
PID 1956 wrote to memory of 1568	1956	OYTF.exe	140
PID 1568 wrote to memory of 5256	1568	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_565b6abb6c87527b35ef468acbc830cc_elex_emotet_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\GCWHGF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\windows\system\GCWHGF.exe
    C:\windows\system\GCWHGF.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\windows\SysWOW64\JDZIXQ.exe
        
        C:\windows\system32\JDZIXQ.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5472
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\windows\SysWOW64\BDB.exe
        
        C:\windows\system32\BDB.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ETHVM.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\windows\system\ETHVM.exe
        
        C:\windows\system\ETHVM.exe
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FOLZSWI.exe.bat" "
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5172
        
        C:\windows\system\FOLZSWI.exe
        
        C:\windows\system\FOLZSWI.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WZWHAK.exe.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\windows\WZWHAK.exe
        
        C:\windows\WZWHAK.exe
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\windows\RKFGPN.exe
        
        C:\windows\RKFGPN.exe
        15⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\windows\MXJ.exe
        
        C:\windows\MXJ.exe
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\SSJ.exe.bat" "
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\windows\system\SSJ.exe
        
        C:\windows\system\SSJ.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYTF.exe.bat" "
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\windows\SysWOW64\OYTF.exe
        
        C:\windows\system32\OYTF.exe
        21⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\UTSOR.exe.bat" "
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\windows\system\UTSOR.exe
        
        C:\windows\system\UTSOR.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WRGI.exe.bat" "
        24⤵
        
        PID:4184
        
        C:\windows\WRGI.exe
        
        C:\windows\WRGI.exe
        25⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SUOZMHK.exe.bat" "
        26⤵
        Executes a command shell one-liner
        
        PID:3524
        
        C:\windows\SUOZMHK.exe
        
        C:\windows\SUOZMHK.exe
        27⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "
        28⤵
        
        PID:2168
        
        C:\windows\SysWOW64\USUTUPT.exe
        
        C:\windows\system32\USUTUPT.exe
        29⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAW.exe.bat" "
        30⤵
        
        PID:2256
        
        C:\windows\SysWOW64\LAW.exe
        
        C:\windows\system32\LAW.exe
        31⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SQXYEI.exe.bat" "
        32⤵
        
        PID:5184
        
        C:\windows\SQXYEI.exe
        
        C:\windows\SQXYEI.exe
        33⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OBNW.exe.bat" "
        34⤵
        
        PID:1796
        
        C:\windows\SysWOW64\OBNW.exe
        
        C:\windows\system32\OBNW.exe
        35⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWRSXB.exe.bat" "
        36⤵
        
        PID:992
        
        C:\windows\SysWOW64\GWRSXB.exe
        
        C:\windows\system32\GWRSXB.exe
        37⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "
        38⤵
        Executes a command shell one-liner
        
        PID:4268
        
        C:\windows\FHUIG.exe
        
        C:\windows\FHUIG.exe
        39⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "
        40⤵
        Executes a command shell one-liner
        
        PID:3244
        
        C:\windows\SysWOW64\UKD.exe
        
        C:\windows\system32\UKD.exe
        41⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "
        42⤵
        
        PID:4108
        
        C:\windows\JAMMYXB.exe
        
        C:\windows\JAMMYXB.exe
        43⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "
        44⤵
        
        PID:3012
        
        C:\windows\system\CVQH.exe
        
        C:\windows\system\CVQH.exe
        45⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVYVUP.exe.bat" "
        46⤵
        
        PID:3940
        
        C:\windows\SysWOW64\IVYVUP.exe
        
        C:\windows\system32\IVYVUP.exe
        47⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TOTOCXT.exe.bat" "
        48⤵
        Executes a command shell one-liner
        
        PID:5696
        
        C:\windows\system\TOTOCXT.exe
        
        C:\windows\system\TOTOCXT.exe
        49⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTYLKGV.exe.bat" "
        50⤵
        Executes a command shell one-liner
        
        PID:1880
        
        C:\windows\SysWOW64\QTYLKGV.exe
        
        C:\windows\system32\QTYLKGV.exe
        51⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZE.exe.bat" "
        52⤵
        
        PID:2708
        
        C:\windows\SysWOW64\MZE.exe
        
        C:\windows\system32\MZE.exe
        53⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJHYZWT.exe.bat" "
        54⤵
        
        PID:3440
        
        C:\windows\SysWOW64\DJHYZWT.exe
        
        C:\windows\system32\DJHYZWT.exe
        55⤵
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "
        56⤵
        Executes a command shell one-liner
        
        PID:4304
        
        C:\windows\SysWOW64\APNN.exe
        
        C:\windows\system32\APNN.exe
        57⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "
        58⤵
        
        PID:4144
        
        C:\windows\system\WVLK.exe
        
        C:\windows\system\WVLK.exe
        59⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "
        60⤵
        Executes a command shell one-liner
        
        PID:3536
        
        C:\windows\CVSYEK.exe
        
        C:\windows\CVSYEK.exe
        61⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "
        62⤵
        Executes a command shell one-liner
        
        PID:784
        
        C:\windows\HYWFJ.exe
        
        C:\windows\HYWFJ.exe
        63⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\JWPZQQ.exe.bat" "
        64⤵
        Executes a command shell one-liner
        
        PID:2524
        
        C:\windows\system\JWPZQQ.exe
        
        C:\windows\system\JWPZQQ.exe
        65⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBVWXAD.exe.bat" "
        66⤵
        
        PID:5816
        
        C:\windows\SysWOW64\GBVWXAD.exe
        
        C:\windows\system32\GBVWXAD.exe
        67⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OME.exe.bat" "
        68⤵
        Executes a command shell one-liner
        
        PID:4984
        
        C:\windows\OME.exe
        
        C:\windows\OME.exe
        69⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PJX.exe.bat" "
        70⤵
        Executes a command shell one-liner
        
        PID:6008
        
        C:\windows\system\PJX.exe
        
        C:\windows\system\PJX.exe
        71⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "
        72⤵
        Executes a command shell one-liner
        
        PID:5332
        
        C:\windows\SysWOW64\PUG.exe
        
        C:\windows\system32\PUG.exe
        73⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "
        74⤵
        
        PID:3500
        
        C:\windows\BNJMF.exe
        
        C:\windows\BNJMF.exe
        75⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "
        76⤵
        
        PID:5044
        
        C:\windows\SysWOW64\XSHB.exe
        
        C:\windows\system32\XSHB.exe
        77⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "
        78⤵
        
        PID:2924
        
        C:\windows\MYMYTG.exe
        
        C:\windows\MYMYTG.exe
        79⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "
        80⤵
        
        PID:2932
        
        C:\windows\SysWOW64\KJDWTA.exe
        
        C:\windows\system32\KJDWTA.exe
        81⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "
        82⤵
        
        PID:3788
        
        C:\windows\system\ZOJ.exe
        
        C:\windows\system\ZOJ.exe
        83⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "
        84⤵
        Executes a command shell one-liner
        
        PID:5600
        
        C:\windows\HZR.exe
        
        C:\windows\HZR.exe
        85⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "
        86⤵
        
        PID:3248
        
        C:\windows\SysWOW64\SRUF.exe
        
        C:\windows\system32\SRUF.exe
        87⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OXSC.exe.bat" "
        88⤵
        
        PID:2772
        
        C:\windows\system\OXSC.exe
        
        C:\windows\system\OXSC.exe
        89⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "
        90⤵
        
        PID:5380
        
        C:\windows\system\APVVL.exe
        
        C:\windows\system\APVVL.exe
        91⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "
        92⤵
        
        PID:2536
        
        C:\windows\SysWOW64\UDAEVVZ.exe
        
        C:\windows\system32\UDAEVVZ.exe
        93⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "
        94⤵
        
        PID:808
        
        C:\windows\system\ADHS.exe
        
        C:\windows\system\ADHS.exe
        95⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CBBML.exe.bat" "
        96⤵
        
        PID:5156
        
        C:\windows\CBBML.exe
        
        C:\windows\CBBML.exe
        97⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "
        98⤵
        
        PID:3008
        
        C:\windows\LOLET.exe
        
        C:\windows\LOLET.exe
        99⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "
        100⤵
        
        PID:2324
        
        C:\windows\CZJCSD.exe
        
        C:\windows\CZJCSD.exe
        101⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJKDGH.exe.bat" "
        102⤵
        
        PID:3384
        
        C:\windows\SysWOW64\KJKDGH.exe
        
        C:\windows\system32\KJKDGH.exe
        103⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GPQTNRQ.exe.bat" "
        104⤵
        
        PID:3416
        
        C:\windows\system\GPQTNRQ.exe
        
        C:\windows\system\GPQTNRQ.exe
        105⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BCVC.exe.bat" "
        106⤵
        
        PID:2796
        
        C:\windows\BCVC.exe
        
        C:\windows\BCVC.exe
        107⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "
        108⤵
        
        PID:3276
        
        C:\windows\system\DAOEE.exe
        
        C:\windows\system\DAOEE.exe
        109⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RGUBL.exe.bat" "
        110⤵
        Executes a command shell one-liner
        
        PID:2396
        
        C:\windows\system\RGUBL.exe
        
        C:\windows\system\RGUBL.exe
        111⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "
        112⤵
        
        PID:5924
        
        C:\windows\ZQCVYTD.exe
        
        C:\windows\ZQCVYTD.exe
        113⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWISFD.exe.bat" "
        114⤵
        
        PID:4176
        
        C:\windows\SysWOW64\WWISFD.exe
        
        C:\windows\system32\WWISFD.exe
        115⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "
        116⤵
        
        PID:5048
        
        C:\windows\SysWOW64\MHZQFYB.exe
        
        C:\windows\system32\MHZQFYB.exe
        117⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BME.exe.bat" "
        118⤵
        
        PID:2436
        
        C:\windows\system\BME.exe
        
        C:\windows\system\BME.exe
        119⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "
        120⤵
        
        PID:1240
        
        C:\windows\SysWOW64\SSPF.exe
        
        C:\windows\system32\SSPF.exe
        121⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DKKPK.exe.bat" "
        122⤵
        
        PID:4428
        
        C:\windows\DKKPK.exe
        
        C:\windows\DKKPK.exe
        123⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AQQNRVA.exe.bat" "
        124⤵
        
        PID:2200
        
        C:\windows\system\AQQNRVA.exe
        
        C:\windows\system\AQQNRVA.exe
        125⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "
        126⤵
        Executes a command shell one-liner
        
        PID:4476
        
        C:\windows\system\AVQ.exe
        
        C:\windows\system\AVQ.exe
        127⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "
        128⤵
        
        PID:6088
        
        C:\windows\system\RJA.exe
        
        C:\windows\system\RJA.exe
        129⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBVMR.exe.bat" "
        130⤵
        
        PID:3796
        
        C:\windows\SysWOW64\CBVMR.exe
        
        C:\windows\system32\CBVMR.exe
        131⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "
        132⤵
        Executes a command shell one-liner
        
        PID:3224
        
        C:\windows\SysWOW64\XOAVBM.exe
        
        C:\windows\system32\XOAVBM.exe
        133⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "
        134⤵
        
        PID:4212
        
        C:\windows\system\XCAKDZQ.exe
        
        C:\windows\system\XCAKDZQ.exe
        135⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\UAGH.exe.bat" "
        136⤵
        Executes a command shell one-liner
        
        PID:2696
        
        C:\windows\UAGH.exe
        
        C:\windows\UAGH.exe
        137⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QFE.exe.bat" "
        138⤵
        
        PID:1864
        
        C:\windows\QFE.exe
        
        C:\windows\QFE.exe
        139⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FLKTY.exe.bat" "
        140⤵
        
        PID:5476
        
        C:\windows\FLKTY.exe
        
        C:\windows\FLKTY.exe
        141⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "
        142⤵
        
        PID:936
        
        C:\windows\SysWOW64\QDNMGB.exe
        
        C:\windows\system32\QDNMGB.exe
        143⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HQXEWGZ.exe.bat" "
        144⤵
        Executes a command shell one-liner
        
        PID:1060
        
        C:\windows\system\HQXEWGZ.exe
        
        C:\windows\system\HQXEWGZ.exe
        145⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "
        146⤵
        
        PID:2736
        
        C:\windows\JGQ.exe
        
        C:\windows\JGQ.exe
        147⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZ.exe.bat" "
        148⤵
        
        PID:6080
        
        C:\windows\system\JZZ.exe
        
        C:\windows\system\JZZ.exe
        149⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKP.exe.bat" "
        150⤵
        
        PID:952
        
        C:\windows\SysWOW64\HKP.exe
        
        C:\windows\system32\HKP.exe
        151⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WPVUW.exe.bat" "
        152⤵
        
        PID:5908
        
        C:\windows\WPVUW.exe
        
        C:\windows\WPVUW.exe
        153⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\EAEOC.exe.bat" "
        154⤵
        Executes a command shell one-liner
        
        PID:2752
        
        C:\windows\system\EAEOC.exe
        
        C:\windows\system\EAEOC.exe
        155⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYXQJ.exe.bat" "
        156⤵
        
        PID:6032
        
        C:\windows\SysWOW64\GYXQJ.exe
        
        C:\windows\system32\GYXQJ.exe
        157⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "
        158⤵
        Executes a command shell one-liner
        
        PID:384
        
        C:\windows\system\UDDNQOS.exe
        
        C:\windows\system\UDDNQOS.exe
        159⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RBJCFYM.exe.bat" "
        160⤵
        Executes a command shell one-liner
        
        PID:5896
        
        C:\windows\system\RBJCFYM.exe
        
        C:\windows\system\RBJCFYM.exe
        161⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NGG.exe.bat" "
        162⤵
        
        PID:5632
        
        C:\windows\system\NGG.exe
        
        C:\windows\system\NGG.exe
        163⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMM.exe.bat" "
        164⤵
        
        PID:5748
        
        C:\windows\SysWOW64\KMM.exe
        
        C:\windows\system32\KMM.exe
        165⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MKNQ.exe.bat" "
        166⤵
        Executes a command shell one-liner
        
        PID:1340
        
        C:\windows\system\MKNQ.exe
        
        C:\windows\system\MKNQ.exe
        167⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKVEIA.exe.bat" "
        168⤵
        
        PID:888
        
        C:\windows\SysWOW64\KKVEIA.exe
        
        C:\windows\system32\KKVEIA.exe
        169⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GITBPK.exe.bat" "
        170⤵
        
        PID:2640
        
        C:\windows\SysWOW64\GITBPK.exe
        
        C:\windows\system32\GITBPK.exe
        171⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAWUXSR.exe.bat" "
        172⤵
        Executes a command shell one-liner
        
        PID:4112
        
        C:\windows\SysWOW64\SAWUXSR.exe
        
        C:\windows\system32\SAWUXSR.exe
        173⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "
        174⤵
        
        PID:2368
        
        C:\windows\DTZ.exe
        
        C:\windows\DTZ.exe
        175⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLA.exe.bat" "
        176⤵
        
        PID:5996
        
        C:\windows\SysWOW64\LLA.exe
        
        C:\windows\system32\LLA.exe
        177⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZRFDB.exe.bat" "
        178⤵
        
        PID:1736
        
        C:\windows\ZRFDB.exe
        
        C:\windows\ZRFDB.exe
        179⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOLBIXQ.exe.bat" "
        180⤵
        
        PID:5344
        
        C:\windows\SysWOW64\WOLBIXQ.exe
        
        C:\windows\system32\WOLBIXQ.exe
        181⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZCYH.exe.bat" "
        182⤵
        
        PID:4356
        
        C:\windows\SysWOW64\MZCYH.exe
        
        C:\windows\system32\MZCYH.exe
        183⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SAJMQTN.exe.bat" "
        184⤵
        
        PID:2036
        
        C:\windows\SAJMQTN.exe
        
        C:\windows\SAJMQTN.exe
        185⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ESM.exe.bat" "
        186⤵
        
        PID:4728
        
        C:\windows\ESM.exe
        
        C:\windows\ESM.exe
        187⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JSUTID.exe.bat" "
        188⤵
        
        PID:2572
        
        C:\windows\JSUTID.exe
        
        C:\windows\JSUTID.exe
        189⤵
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LQNNOS.exe.bat" "
        190⤵
        
        PID:4816
        
        C:\windows\system\LQNNOS.exe
        
        C:\windows\system\LQNNOS.exe
        191⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEXFEOI.exe.bat" "
        192⤵
        Executes a command shell one-liner
        
        PID:4048
        
        C:\windows\SysWOW64\DEXFEOI.exe
        
        C:\windows\system32\DEXFEOI.exe
        193⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OWA.exe.bat" "
        194⤵
        
        PID:2636
        
        C:\windows\OWA.exe
        
        C:\windows\OWA.exe
        195⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZPDQ.exe.bat" "
        196⤵
        Executes a command shell one-liner
        
        PID:5784
        
        C:\windows\SysWOW64\ZPDQ.exe
        
        C:\windows\system32\ZPDQ.exe
        197⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XPDEV.exe.bat" "
        198⤵
        Executes a command shell one-liner
        
        PID:2740
        
        C:\windows\XPDEV.exe
        
        C:\windows\XPDEV.exe
        199⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\IIGXEV.exe.bat" "
        200⤵
        Executes a command shell one-liner
        
        PID:1860
        
        C:\windows\system\IIGXEV.exe
        
        C:\windows\system\IIGXEV.exe
        201⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FNM.exe.bat" "
        202⤵
        
        PID:1852
        
        C:\windows\FNM.exe
        
        C:\windows\FNM.exe
        203⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QGPF.exe.bat" "
        204⤵
        
        PID:3664
        
        C:\windows\QGPF.exe
        
        C:\windows\QGPF.exe
        205⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LIXDHPA.exe.bat" "
        206⤵
        
        PID:4600
        
        C:\windows\LIXDHPA.exe
        
        C:\windows\LIXDHPA.exe
        207⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\TZYDO.exe.bat" "
        208⤵
        Executes a command shell one-liner
        
        PID:5456
        
        C:\windows\TZYDO.exe
        
        C:\windows\TZYDO.exe
        209⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OJH.exe.bat" "
        210⤵
        Executes a command shell one-liner
        
        PID:5384
        
        C:\windows\system\OJH.exe
        
        C:\windows\system\OJH.exe
        211⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MFGCZQ.exe.bat" "
        212⤵
        
        PID:6132
        
        C:\windows\system\MFGCZQ.exe
        
        C:\windows\system\MFGCZQ.exe
        213⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\KUZX.exe.bat" "
        214⤵
        Executes a command shell one-liner
        
        PID:2068
        
        C:\windows\KUZX.exe
        
        C:\windows\KUZX.exe
        215⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\NIEHWV.exe.bat" "
        216⤵
        Executes a command shell one-liner
        
        PID:4676
        
        C:\windows\NIEHWV.exe
        
        C:\windows\NIEHWV.exe
        217⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQGUHAZ.exe.bat" "
        218⤵
        
        PID:2384
        
        C:\windows\SysWOW64\WQGUHAZ.exe
        
        C:\windows\system32\WQGUHAZ.exe
        219⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WEZYXQX.exe.bat" "
        220⤵
        Executes a command shell one-liner
        
        PID:4848
        
        C:\windows\WEZYXQX.exe
        
        C:\windows\WEZYXQX.exe
        221⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FEBD.exe.bat" "
        222⤵
        
        PID:1940
        
        C:\windows\system\FEBD.exe
        
        C:\windows\system\FEBD.exe
        223⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\APJ.exe.bat" "
        224⤵
        
        PID:2140
        
        C:\windows\SysWOW64\APJ.exe
        
        C:\windows\system32\APJ.exe
        225⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TSNXC.exe.bat" "
        226⤵
        
        PID:712
        
        C:\windows\system\TSNXC.exe
        
        C:\windows\system\TSNXC.exe
        227⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\IIOW.exe.bat" "
        228⤵
        
        PID:2700
        
        C:\windows\system\IIOW.exe
        
        C:\windows\system\IIOW.exe
        229⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MQDWNU.exe.bat" "
        230⤵
        
        PID:3240
        
        C:\windows\system\MQDWNU.exe
        
        C:\windows\system\MQDWNU.exe
        231⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SQL.exe.bat" "
        232⤵
        
        PID:3152
        
        C:\windows\SQL.exe
        
        C:\windows\SQL.exe
        233⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEDZ.exe.bat" "
        234⤵
        Executes a command shell one-liner
        
        PID:1112
        
        C:\windows\SysWOW64\SEDZ.exe
        
        C:\windows\system32\SEDZ.exe
        235⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRIQPJ.exe.bat" "
        236⤵
        Executes a command shell one-liner
        
        PID:4524
        
        C:\windows\SysWOW64\NRIQPJ.exe
        
        C:\windows\system32\NRIQPJ.exe
        237⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZO.exe.bat" "
        238⤵
        
        PID:3840
        
        C:\windows\SysWOW64\ZZO.exe
        
        C:\windows\system32\ZZO.exe
        239⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FZWELV.exe.bat" "
        240⤵
        
        PID:768
        
        C:\windows\FZWELV.exe
        
        C:\windows\FZWELV.exe
        241⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FFWSMI.exe.bat" "
        242⤵
        
        PID:1136
        
        C:\windows\FFWSMI.exe
        
        C:\windows\FFWSMI.exe
        243⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QYZ.exe.bat" "
        244⤵
        
        PID:2276
        
        C:\windows\system\QYZ.exe
        
        C:\windows\system\QYZ.exe
        245⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WYZZD.exe.bat" "
        246⤵
        
        PID:4836
        
        C:\windows\system\WYZZD.exe
        
        C:\windows\system\WYZZD.exe
        247⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTDIOKX.exe.bat" "
        248⤵
        Executes a command shell one-liner
        
        PID:5804
        
        C:\windows\SysWOW64\QTDIOKX.exe
        
        C:\windows\system32\QTDIOKX.exe
        249⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CMGBOZ.exe.bat" "
        250⤵
        Executes a command shell one-liner
        
        PID:2520
        
        C:\windows\system\CMGBOZ.exe
        
        C:\windows\system\CMGBOZ.exe
        251⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRRT.exe.bat" "
        252⤵
        
        PID:5368
        
        C:\windows\SysWOW64\LRRT.exe
        
        C:\windows\system32\LRRT.exe
        253⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FMWCO.exe.bat" "
        254⤵
        
        PID:420
        
        C:\windows\FMWCO.exe
        
        C:\windows\FMWCO.exe
        255⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZFZVWDF.exe.bat" "
        256⤵
        
        PID:2024
        
        C:\windows\ZFZVWDF.exe
        
        C:\windows\ZFZVWDF.exe
        257⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKRKYQZ.exe.bat" "
        258⤵
        Executes a command shell one-liner
        
        PID:5220
        
        C:\windows\system\ZKRKYQZ.exe
        
        C:\windows\system\ZKRKYQZ.exe
        259⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\IYB.exe.bat" "
        260⤵
        
        PID:5272
        
        C:\windows\IYB.exe
        
        C:\windows\IYB.exe
        261⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QDBIPS.exe.bat" "
        262⤵
        Executes a command shell one-liner
        
        PID:5620
        
        C:\windows\QDBIPS.exe
        
        C:\windows\QDBIPS.exe
        263⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WEJEYU.exe.bat" "
        264⤵
        
        PID:5756
        
        C:\windows\WEJEYU.exe
        
        C:\windows\WEJEYU.exe
        265⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HWMPGBH.exe.bat" "
        266⤵
        
        PID:4168
        
        C:\windows\system\HWMPGBH.exe
        
        C:\windows\system\HWMPGBH.exe
        267⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\VCKM.exe.bat" "
        268⤵
        
        PID:6016
        
        C:\windows\system\VCKM.exe
        
        C:\windows\system\VCKM.exe
        269⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUNEW.exe.bat" "
        270⤵
        
        PID:924
        
        C:\windows\SysWOW64\HUNEW.exe
        
        C:\windows\system32\HUNEW.exe
        271⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NVVSF.exe.bat" "
        272⤵
        
        PID:6100
        
        C:\windows\system\NVVSF.exe
        
        C:\windows\system\NVVSF.exe
        273⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\SVC.exe.bat" "
        274⤵
        
        PID:5668
        
        C:\windows\system\SVC.exe
        
        C:\windows\system\SVC.exe
        275⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ULV.exe.bat" "
        276⤵
        
        PID:4408
        
        C:\windows\ULV.exe
        
        C:\windows\ULV.exe
        277⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RQB.exe.bat" "
        278⤵
        Executes a command shell one-liner
        
        PID:4620
        
        C:\windows\RQB.exe
        
        C:\windows\RQB.exe
        279⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WBXE.exe.bat" "
        280⤵
        
        PID:5856
        
        C:\windows\WBXE.exe
        
        C:\windows\WBXE.exe
        281⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HUAWP.exe.bat" "
        282⤵
        
        PID:4080
        
        C:\windows\HUAWP.exe
        
        C:\windows\HUAWP.exe
        283⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ERGMW.exe.bat" "
        284⤵
        
        PID:3928
        
        C:\windows\ERGMW.exe
        
        C:\windows\ERGMW.exe
        285⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AXMJLNR.exe.bat" "
        286⤵
        Executes a command shell one-liner
        
        PID:1432
        
        C:\windows\system\AXMJLNR.exe
        
        C:\windows\system\AXMJLNR.exe
        287⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXTW.exe.bat" "
        288⤵
        
        PID:3436
        
        C:\windows\SysWOW64\GXTW.exe
        
        C:\windows\system32\GXTW.exe
        289⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\VDRT.exe.bat" "
        290⤵
        Executes a command shell one-liner
        
        PID:3468
        
        C:\windows\system\VDRT.exe
        
        C:\windows\system\VDRT.exe
        291⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOQR.exe.bat" "
        292⤵
        Executes a command shell one-liner
        
        PID:4500
        
        C:\windows\SysWOW64\UOQR.exe
        
        C:\windows\system32\UOQR.exe
        293⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBAJQJ.exe.bat" "
        294⤵
        
        PID:3896
        
        C:\windows\SysWOW64\DBAJQJ.exe
        
        C:\windows\system32\DBAJQJ.exe
        295⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FRTEW.exe.bat" "
        296⤵
        Executes a command shell one-liner
        
        PID:2960
        
        C:\windows\system\FRTEW.exe
        
        C:\windows\system\FRTEW.exe
        297⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJCFCKI.exe.bat" "
        298⤵
        Executes a command shell one-liner
        
        PID:716
        
        C:\windows\SysWOW64\MJCFCKI.exe
        
        C:\windows\system32\MJCFCKI.exe
        299⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GHVZIY.exe.bat" "
        300⤵
        
        PID:2160
        
        C:\windows\SysWOW64\GHVZIY.exe
        
        C:\windows\system32\GHVZIY.exe
        301⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MHD.exe.bat" "
        302⤵
        
        PID:2616
        
        C:\windows\system\MHD.exe
        
        C:\windows\system\MHD.exe
        303⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JFJKH.exe.bat" "
        304⤵
        
        PID:2404
        
        C:\windows\SysWOW64\JFJKH.exe
        
        C:\windows\system32\JFJKH.exe
        305⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSJYIP.exe.bat" "
        306⤵
        
        PID:3532
        
        C:\windows\SysWOW64\JSJYIP.exe
        
        C:\windows\system32\JSJYIP.exe
        307⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PTI.exe.bat" "
        308⤵
        
        PID:4840
        
        C:\windows\system\PTI.exe
        
        C:\windows\system\PTI.exe
        309⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RJKOXH.exe.bat" "
        310⤵
        Executes a command shell one-liner
        
        PID:5028
        
        C:\windows\SysWOW64\RJKOXH.exe
        
        C:\windows\system32\RJKOXH.exe
        311⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XJRC.exe.bat" "
        312⤵
        Executes a command shell one-liner
        
        PID:520
        
        C:\windows\system\XJRC.exe
        
        C:\windows\system\XJRC.exe
        313⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\TOXRN.exe.bat" "
        314⤵
        Executes a command shell one-liner
        
        PID:2748
        
        C:\windows\TOXRN.exe
        
        C:\windows\TOXRN.exe
        315⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUVOV.exe.bat" "
        316⤵
        
        PID:3308
        
        C:\windows\SysWOW64\IUVOV.exe
        
        C:\windows\system32\IUVOV.exe
        317⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BNYHDK.exe.bat" "
        318⤵
        
        PID:4196
        
        C:\windows\system\BNYHDK.exe
        
        C:\windows\system\BNYHDK.exe
        319⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BXGIRO.exe.bat" "
        320⤵
        
        PID:3396
        
        C:\windows\system\BXGIRO.exe
        
        C:\windows\system\BXGIRO.exe
        321⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RIXYQIK.exe.bat" "
        322⤵
        
        PID:4724
        
        C:\windows\RIXYQIK.exe
        
        C:\windows\RIXYQIK.exe
        323⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OOD.exe.bat" "
        324⤵
        
        PID:4384
        
        C:\windows\OOD.exe
        
        C:\windows\OOD.exe
        325⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBHFH.exe.bat" "
        326⤵
        Executes a command shell one-liner
        
        PID:3196
        
        C:\windows\SysWOW64\JBHFH.exe
        
        C:\windows\system32\JBHFH.exe
        327⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AOSXXO.exe.bat" "
        328⤵
        
        PID:3132
        
        C:\windows\system\AOSXXO.exe
        
        C:\windows\system\AOSXXO.exe
        329⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMLZWD.exe.bat" "
        330⤵
        Executes a command shell one-liner
        
        PID:5988
        
        C:\windows\SysWOW64\CMLZWD.exe
        
        C:\windows\system32\CMLZWD.exe
        331⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\NFO.exe.bat" "
        332⤵
        
        PID:2432
        
        C:\windows\NFO.exe
        
        C:\windows\NFO.exe
        333⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NPX.exe.bat" "
        334⤵
        
        PID:4580
        
        C:\windows\system\NPX.exe
        
        C:\windows\system\NPX.exe
        335⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\YISE.exe.bat" "
        336⤵
        Executes a command shell one-liner
        
        PID:6060
        
        C:\windows\YISE.exe
        
        C:\windows\YISE.exe
        337⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAVXA.exe.bat" "
        338⤵
        
        PID:1716
        
        C:\windows\SysWOW64\JAVXA.exe
        
        C:\windows\system32\JAVXA.exe
        339⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANFPQQ.exe.bat" "
        340⤵
        
        PID:2556
        
        C:\windows\SysWOW64\ANFPQQ.exe
        
        C:\windows\system32\ANFPQQ.exe
        341⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MGIIYYB.exe.bat" "
        342⤵
        
        PID:2644
        
        C:\windows\MGIIYYB.exe
        
        C:\windows\MGIIYYB.exe
        343⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZD.exe.bat" "
        344⤵
        
        PID:2744
        
        C:\windows\SysWOW64\XZD.exe
        
        C:\windows\system32\XZD.exe
        345⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XRMU.exe.bat" "
        346⤵
        
        PID:4920
        
        C:\windows\system\XRMU.exe
        
        C:\windows\system\XRMU.exe
        347⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\IKPNV.exe.bat" "
        348⤵
        
        PID:5796
        
        C:\windows\system\IKPNV.exe
        
        C:\windows\system\IKPNV.exe
        349⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\TCKFDG.exe.bat" "
        350⤵
        Executes a command shell one-liner
        
        PID:4372
        
        C:\windows\TCKFDG.exe
        
        C:\windows\TCKFDG.exe
        351⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNYDNJ.exe.bat" "
        352⤵
        
        PID:1580
        
        C:\windows\SysWOW64\FVNYDNJ.exe
        
        C:\windows\system32\FVNYDNJ.exe
        353⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BSTV.exe.bat" "
        354⤵
        Executes a command shell one-liner
        
        PID:5976
        
        C:\windows\SysWOW64\BSTV.exe
        
        C:\windows\system32\BSTV.exe
        355⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YYY.exe.bat" "
        356⤵
        
        PID:1972
        
        C:\windows\system\YYY.exe
        
        C:\windows\system\YYY.exe
        357⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JRTDI.exe.bat" "
        358⤵
        
        PID:792
        
        C:\windows\JRTDI.exe
        
        C:\windows\JRTDI.exe
        359⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XWZAPY.exe.bat" "
        360⤵
        
        PID:4596
        
        C:\windows\system\XWZAPY.exe
        
        C:\windows\system\XWZAPY.exe
        361⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\UCFXWH.exe.bat" "
        362⤵
        
        PID:4456
        
        C:\windows\system\UCFXWH.exe
        
        C:\windows\system\UCFXWH.exe
        363⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PPK.exe.bat" "
        364⤵
        
        PID:5820
        
        C:\windows\system\PPK.exe
        
        C:\windows\system\PPK.exe
        365⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WALAM.exe.bat" "
        366⤵
        
        PID:4792
        
        C:\windows\SysWOW64\WALAM.exe
        
        C:\windows\system32\WALAM.exe
        367⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ISOT.exe.bat" "
        368⤵
        
        PID:5708
        
        C:\windows\ISOT.exe
        
        C:\windows\ISOT.exe
        369⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NDKZZ.exe.bat" "
        370⤵
        
        PID:4532
        
        C:\windows\SysWOW64\NDKZZ.exe
        
        C:\windows\system32\NDKZZ.exe
        371⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PBLTFH.exe.bat" "
        372⤵
        Executes a command shell one-liner
        
        PID:5920
        
        C:\windows\system\PBLTFH.exe
        
        C:\windows\system\PBLTFH.exe
        373⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\GGVMVEQ.exe.bat" "
        374⤵
        Executes a command shell one-liner
        
        PID:5944
        
        C:\windows\GGVMVEQ.exe
        
        C:\windows\GGVMVEQ.exe
        375⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUNAXJL.exe.bat" "
        376⤵
        
        PID:6072
        
        C:\windows\SysWOW64\GUNAXJL.exe
        
        C:\windows\system32\GUNAXJL.exe
        377⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XZYSN.exe.bat" "
        378⤵
        
        PID:2328
        
        C:\windows\XZYSN.exe
        
        C:\windows\XZYSN.exe
        379⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\IRBLNV.exe.bat" "
        380⤵
        Executes a command shell one-liner
        
        PID:3528
        
        C:\windows\system\IRBLNV.exe
        
        C:\windows\system\IRBLNV.exe
        381⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SAD.exe.bat" "
        382⤵
        
        PID:1920
        
        C:\windows\SAD.exe
        
        C:\windows\SAD.exe
        383⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXJNFCS.exe.bat" "
        384⤵
        
        PID:5636
        
        C:\windows\SysWOW64\OXJNFCS.exe
        
        C:\windows\system32\OXJNFCS.exe
        385⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\JTNW.exe.bat" "
        386⤵
        
        PID:3736
        
        C:\windows\system\JTNW.exe
        
        C:\windows\system\JTNW.exe
        387⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQLUXL.exe.bat" "
        388⤵
        
        PID:4668
        
        C:\windows\SysWOW64\FQLUXL.exe
        
        C:\windows\system32\FQLUXL.exe
        389⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CWR.exe.bat" "
        390⤵
        
        PID:5068
        
        C:\windows\system\CWR.exe
        
        C:\windows\system\CWR.exe
        391⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CBR.exe.bat" "
        392⤵
        
        PID:4860
        
        C:\windows\system\CBR.exe
        
        C:\windows\system\CBR.exe
        393⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LPCP.exe.bat" "
        394⤵
        
        PID:3580
        
        C:\windows\LPCP.exe
        
        C:\windows\LPCP.exe
        395⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCHHFX.exe.bat" "
        396⤵
        Executes a command shell one-liner
        
        PID:6084
        
        C:\windows\SysWOW64\OCHHFX.exe
        
        C:\windows\system32\OCHHFX.exe
        397⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CIE.exe.bat" "
        398⤵
        Executes a command shell one-liner
        
        PID:464
        
        C:\windows\SysWOW64\CIE.exe
        
        C:\windows\system32\CIE.exe
        399⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVJF.exe.bat" "
        400⤵
        
        PID:3844
        
        C:\windows\SysWOW64\XVJF.exe
        
        C:\windows\system32\XVJF.exe
        401⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WGID.exe.bat" "
        402⤵
        Executes a command shell one-liner
        
        PID:2892
        
        C:\windows\WGID.exe
        
        C:\windows\WGID.exe
        403⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGPRF.exe.bat" "
        404⤵
        
        PID:3356
        
        C:\windows\SysWOW64\TGPRF.exe
        
        C:\windows\system32\TGPRF.exe
        405⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WBUAPD.exe.bat" "
        406⤵
        
        PID:4092
        
        C:\windows\system\WBUAPD.exe
        
        C:\windows\system\WBUAPD.exe
        407⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 856
        406⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 1368
        404⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1016
        402⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 1336
        400⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1368
        398⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1020
        396⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1364
        394⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1352
        392⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 1376
        390⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1020
        388⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1016
        386⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 1012
        384⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1016
        382⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 1016
        380⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 1332
        378⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1360
        376⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 1020
        374⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 1336
        372⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 1020
        370⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1324
        368⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1020
        366⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 1368
        364⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 1344
        362⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1020
        360⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 1364
        358⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1008
        356⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 1012
        354⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 744
        352⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 1000
        350⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 1352
        348⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 980
        346⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 1020
        344⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1356
        342⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1328
        340⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1360
        338⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1028
        336⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 980
        334⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 988
        332⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1040
        330⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 784
        328⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1360
        326⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 784
        324⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 1352
        322⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 1376
        320⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 1344
        318⤵
        
        PID:556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 784
        316⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1020
        314⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 1000
        312⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1016
        310⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 744
        308⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 1360
        306⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1368
        304⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1016
        302⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1368
        300⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1340
        298⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1336
        296⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 1368
        294⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 1360
        292⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1368
        290⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1368
        288⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 988
        286⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 784
        284⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1000
        282⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1356
        280⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 1016
        278⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 1012
        276⤵
        
        PID:996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 1364
        274⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 1000
        272⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1000
        270⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 1380
        268⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 1336
        266⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1012
        264⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 888
        262⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1000
        260⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1376
        258⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1016
        256⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 980
        254⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 1016
        252⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1376
        250⤵
        
        PID:200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 1016
        248⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 744
        246⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1000
        244⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 1364
        242⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1316
        240⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1020
        238⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 992
        236⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 1356
        234⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1016
        232⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1012
        230⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1376
        228⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1336
        226⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1360
        224⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1336
        222⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1364
        220⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1344
        218⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1000
        216⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 1324
        214⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1344
        212⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 1336
        210⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1344
        208⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 984
        206⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 992
        204⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 1016
        202⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 988
        200⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1016
        198⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 980
        196⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 1324
        194⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 984
        192⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 1344
        190⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1020
        188⤵
        
        PID:464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 1364
        186⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 832
        184⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1000
        182⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 1372
        180⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 784
        178⤵
        
        PID:108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 1376
        176⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1348
        174⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 1340
        172⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 980
        170⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 1020
        168⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 980
        166⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1012
        164⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1016
        162⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 824
        160⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1016
        158⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 1016
        156⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1016
        154⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 984
        152⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1384
        150⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1012
        148⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 1316
        146⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 988
        144⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1000
        142⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 1348
        140⤵
        
        PID:556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 1364
        138⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 1332
        136⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1004
        134⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 980
        132⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1328
        130⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 1340
        128⤵
        Program crash
        
        PID:4604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 780
        126⤵
        Program crash
        
        PID:2116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1012
        124⤵
        Program crash
        
        PID:260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 1012
        122⤵
        Program crash
        
        PID:3924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 1020
        120⤵
        Program crash
        
        PID:5740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1336
        118⤵
        Program crash
        
        PID:3856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 1012
        116⤵
        Program crash
        
        PID:2156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1016
        114⤵
        Program crash
        
        PID:5236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1364
        112⤵
        Program crash
        
        PID:1968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 1344
        110⤵
        Program crash
        
        PID:2820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1016
        108⤵
        Program crash
        
        PID:2196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 876
        106⤵
        Program crash
        
        PID:4804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 980
        104⤵
        Program crash
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 1368
        102⤵
        Program crash
        
        PID:3512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1020
        100⤵
        Program crash
        
        PID:2276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 1020
        98⤵
        Program crash
        
        PID:1740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 1008
        96⤵
        Program crash
        
        PID:3196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 1328
        94⤵
        Program crash
        
        PID:3308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1012
        92⤵
        Program crash
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 1376
        90⤵
        Program crash
        
        PID:2144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 832
        88⤵
        Program crash
        
        PID:1972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1336
        86⤵
        Program crash
        
        PID:3596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1356
        84⤵
        Program crash
        
        PID:3416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 1380
        82⤵
        Program crash
        
        PID:5740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 992
        80⤵
        Program crash
        
        PID:2804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1016
        78⤵
        Program crash
        
        PID:4948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 980
        76⤵
        Program crash
        
        PID:1756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 1008
        74⤵
        Program crash
        
        PID:2644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 980
        72⤵
        Program crash
        
        PID:1340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 1368
        70⤵
        Program crash
        
        PID:456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 1324
        68⤵
        Program crash
        
        PID:4180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 1328
        66⤵
        Program crash
        
        PID:4464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 980
        64⤵
        Program crash
        
        PID:3152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1320
        62⤵
        Program crash
        
        PID:6112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 1364
        60⤵
        Program crash
        
        PID:3420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1336
        58⤵
        Program crash
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1020
        56⤵
        Program crash
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 784
        54⤵
        Program crash
        
        PID:4052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 1340
        52⤵
        Program crash
        
        PID:5280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1020
        50⤵
        Program crash
        
        PID:5924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 1012
        48⤵
        Program crash
        
        PID:1876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 1348
        46⤵
        Program crash
        
        PID:3180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 1020
        44⤵
        Program crash
        
        PID:3416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1020
        42⤵
        Program crash
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1364
        40⤵
        Program crash
        
        PID:1228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 980
        38⤵
        Program crash
        
        PID:3008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1348
        36⤵
        Program crash
        
        PID:2360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1000
        34⤵
        Program crash
        
        PID:2676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1016
        32⤵
        Program crash
        
        PID:848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 980
        30⤵
        Program crash
        
        PID:2472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1020
        28⤵
        Program crash
        
        PID:792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1028
        26⤵
        Program crash
        
        PID:6116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1016
        24⤵
        Program crash
        
        PID:2356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 992
        22⤵
        Program crash
        
        PID:5268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1016
        20⤵
        Program crash
        
        PID:1700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1020
        18⤵
        Program crash
        
        PID:4408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 1016
        16⤵
        Program crash
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 1016
        14⤵
        Program crash
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1016
        12⤵
        Program crash
        
        PID:2068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 988
        10⤵
        Program crash
        
        PID:3796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1016
        8⤵
        Program crash
        
        PID:4472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 996
        6⤵
        Program crash
        
        PID:1708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1340
      4⤵
      Program crash
      PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1348
  2⤵
  - Program crash
  PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4900 -ip 4900
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1992 -ip 1992
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5472 -ip 5472
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1100 -ip 1100
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4288 -ip 4288
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3712 -ip 3712
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5876 -ip 5876
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4416 -ip 4416
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4236 -ip 4236
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1456 -ip 1456
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1956 -ip 1956
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5256 -ip 5256
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2272 -ip 2272
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1124 -ip 1124
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2212 -ip 2212
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4800 -ip 4800
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5624 -ip 5624
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2204 -ip 2204
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4992 -ip 4992
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4104 -ip 4104
1⤵
PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3192 -ip 3192
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6068 -ip 6068
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2972 -ip 2972
1⤵
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5444 -ip 5444
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4516 -ip 4516
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1184 -ip 1184
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4736 -ip 4736
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 668 -ip 668
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3764 -ip 3764
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5792 -ip 5792
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4068 -ip 4068
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5712 -ip 5712
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3504 -ip 3504
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5528 -ip 5528
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2776 -ip 2776
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2080 -ip 2080
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5280 -ip 5280
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3428 -ip 3428
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3068 -ip 3068
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4412 -ip 4412
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6136 -ip 6136
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4512 -ip 4512
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5832 -ip 5832
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2988 -ip 2988
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5984 -ip 5984
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4324 -ip 4324
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5716 -ip 5716
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5160 -ip 5160
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4884 -ip 4884
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4944 -ip 4944
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4044 -ip 4044
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3348 -ip 3348
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 608 -ip 608
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2356 -ip 2356
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5004 -ip 5004
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3388 -ip 3388
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2920 -ip 2920
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5076 -ip 5076
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1048 -ip 1048
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6036 -ip 6036
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1636 -ip 1636
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3588 -ip 3588
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1876 -ip 1876
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1872 -ip 1872
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3316 -ip 3316
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1968 -ip 1968
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4672 -ip 4672
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2856 -ip 2856
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5860 -ip 5860
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4252 -ip 4252
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5276 -ip 5276
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3108 -ip 3108
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2184 -ip 2184
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4204 -ip 4204
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2756 -ip 2756
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5904 -ip 5904
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2528 -ip 2528
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5740 -ip 5740
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4548 -ip 4548
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2764 -ip 2764
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4484 -ip 4484
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2800 -ip 2800
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1452 -ip 1452
1⤵
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5236 -ip 5236
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2444 -ip 2444
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1156 -ip 1156
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3544 -ip 3544
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5936 -ip 5936
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4472 -ip 4472
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2956 -ip 2956
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4780 -ip 4780
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4820 -ip 4820
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5180 -ip 5180
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4496 -ip 4496
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 548 -ip 548
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1712 -ip 1712
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5780 -ip 5780
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2868 -ip 2868
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3936 -ip 3936
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5948 -ip 5948
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5992 -ip 5992
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1964 -ip 1964
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3460 -ip 3460
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4344 -ip 4344
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5732 -ip 5732
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4136 -ip 4136
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5608 -ip 5608
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1624 -ip 1624
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2788 -ip 2788
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5964 -ip 5964
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4560 -ip 4560
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 624 -ip 624
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2820 -ip 2820
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2460 -ip 2460
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2428 -ip 2428
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4696 -ip 4696
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5628 -ip 5628
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5720 -ip 5720
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4128 -ip 4128
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2316 -ip 2316
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3320 -ip 3320
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4440 -ip 4440
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3932 -ip 3932
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2220 -ip 2220
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4604 -ip 4604
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5284 -ip 5284
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3920 -ip 3920
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2096 -ip 2096
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4652 -ip 4652
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5288 -ip 5288
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2812 -ip 2812
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1660 -ip 1660
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1440 -ip 1440
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5200 -ip 5200
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4788 -ip 4788
1⤵
PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4256 -ip 4256
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2944 -ip 2944
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5260 -ip 5260
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5364 -ip 5364
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4700 -ip 4700
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2996 -ip 2996
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2476 -ip 2476
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5568 -ip 5568
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3400 -ip 3400
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1368 -ip 1368
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2468 -ip 2468
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5968 -ip 5968
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1888 -ip 1888
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5072 -ip 5072
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2560 -ip 2560
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 848 -ip 848
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2728 -ip 2728
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2900 -ip 2900
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3212 -ip 3212
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4852 -ip 4852
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3540 -ip 3540
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2672 -ip 2672
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2028 -ip 2028
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4056 -ip 4056
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5772 -ip 5772
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3116 -ip 3116
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6064 -ip 6064
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3016 -ip 3016
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3052 -ip 3052
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3404 -ip 3404
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4420 -ip 4420
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2992 -ip 2992
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1336 -ip 1336
1⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4452 -ip 4452
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4312 -ip 4312
1⤵
PID:5636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2040 -ip 2040
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3672 -ip 3672
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6124 -ip 6124
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2760 -ip 2760
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5588 -ip 5588
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5112 -ip 5112
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3656 -ip 3656
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2156 -ip 2156
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5960 -ip 5960
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4320 -ip 4320
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 5560 -ip 5560
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5564 -ip 5564
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 2420 -ip 2420
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5356 -ip 5356
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2308 -ip 2308
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 1616 -ip 1616
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4220 -ip 4220
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3412 -ip 3412
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5892 -ip 5892
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1960 -ip 1960
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1608 -ip 1608
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3360 -ip 3360
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1228 -ip 1228
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4368 -ip 4368
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4172 -ip 4172
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5824 -ip 5824
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1764 -ip 1764
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 2692 -ip 2692
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5460 -ip 5460
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 2908 -ip 2908
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3908 -ip 3908
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 6024 -ip 6024
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 1056 -ip 1056
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1216 -ip 1216
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCVC.exe.bat

Path C:\Windows\BCVC.exe.bat
Size 54B
SHA256 2cbe19d7d33bc0b3979281444d6723da5cc31abcccc8a9a114b75eed7e2a0fcd
MD5 9b77849851a0dd8bde91a2266664b55a
SHA1 12692a28d4482a6c75a4a0e1f33dcf3ebde73042
SHA512 38323c66c2a256202e071bb6fd2b558595d77a4bc479aecda2c39571ed446df8218d11aba59f619b87151d7ed8ce24b0917369f64893a0f63e38d025a0b50475
MD5 SHA1 SHA512

Submit Download

BNJMF.exe.bat

Path C:\Windows\BNJMF.exe.bat
Size 56B
SHA256 445851e91f305dcfbdad3144faf245cb6ebe52b59cb1e976dfb5adf05223cfc3
MD5 fdb68f4feb0bcadadb9750a03a83d6ab
SHA1 a93a951c6a66533feef451e5ffec8ff9d07b30f0
SHA512 31ba0582f67fa3fd812d56bc4d485ec4c00685217e2f3f82cff7fb48b1e651a718ade36c1524c95068dd32492bf98f36c40e5867003ce49eed734c17a0e5981a
MD5 SHA1 SHA512

Submit Download

CBBML.exe.bat

Path C:\Windows\CBBML.exe.bat
Size 56B
SHA256 d5e1e38bd6cf2f23ac5ec5748341c73a71266e6dee17e6af6332c7bbdbac6849
MD5 adbb39257b29eb474f82ffc1232d79e0
SHA1 1fa19e5c9a237434b1c4c5e029a75e594ae21fa4
SHA512 ae472a1ee029b778783a709a7785f432ec5bebf0d7a5ee4b939406e094535b843b2bf61c36236add7b93f0f41d27306fc7356619986bbe65d065603aa87213dd
MD5 SHA1 SHA512

Submit Download

CVSYEK.exe.bat

Path C:\Windows\CVSYEK.exe.bat
Size 58B
SHA256 781eaa35f921ec40a0815f453ef391f7f88b08cc6df6728f84eb3c5d2ae85307
MD5 311770095e943d753520be2ab70431be
SHA1 a6d0d2176d34b31dc761c6763fd0c34ac1b3b829
SHA512 f3d63486df681dc1944a014c9d2e38f9fc11e955b1d3c536253f8c1604f7b16d958bc58271b01f259e67fdc413850354e1cc1c5bc81a8cd228d15c168dfaaf89
MD5 SHA1 SHA512

Submit Download

CZJCSD.exe.bat

Path C:\Windows\CZJCSD.exe.bat
Size 58B
SHA256 3b225dc547187654648482e35814afe7e0c8d80d2f09a9b34ffe24161b413e35
MD5 e2fcb9b02ad441e8dc2d6e9d4801baa8
SHA1 b3a78fb75de147c72565bac3174e244c830f6b3d
SHA512 a7dda8caa3b5304540740f805a766f0fb68756a2cc66b0fddb8ff13046f5d901079cab9c3f00cf85911d9d32584b7644e91daca1a85b1e20e1b34cc5854f4575
MD5 SHA1 SHA512

Submit Download

DKKPK.exe.bat

Path C:\Windows\DKKPK.exe.bat
Size 56B
SHA256 38dd322bea81635adccb4173fd73b4a801bccc46895887d6a5ab2bf6bb2287ac
MD5 33aad193aad6e52ca8b38f12962393ed
SHA1 e99ac36dbd89db8f169079f55a28ede8d31d3684
SHA512 3b632de01d2bd52a7ed77352324418964f50f84264400d34b7dbf4090c8be800cd7fd4862ec53c80d19b9500ee6e479f917d468476066369a58831fb90dd6679
MD5 SHA1 SHA512

Submit Download

DTZ.exe.bat

Path C:\Windows\DTZ.exe.bat
Size 52B
SHA256 3694760db436b324bff908f087db17414ba8c8f7f27d3d9bc34822abbeed11cb
MD5 1d56abef9ea06041a780706a18d27bb6
SHA1 e8d984f4e67787fb3fe7afd849be764933b271f3
SHA512 576d5f951098961c84363b871111bb88033fb03d7ff5ea7b228b346391200cbbb10ba05bdaa8402e4e2578cd823b35887ed8fb878794629a114780c8610e7ff4
MD5 SHA1 SHA512

Submit Download

ERGMW.exe.bat

Path C:\Windows\ERGMW.exe.bat
Size 56B
SHA256 682c6b252d15c5a30d1758dab768fd6c28c37bbc39d2f26592f18061debc69aa
MD5 1427418eb8aded4cda598c380b1e0a2c
SHA1 7ceccd96f533c847404cf2fffe1999bfec2a5fc7
SHA512 7be9186d1f40ed47d3a0a2752564aad0f467d0138a98da11c6a22fddb21bd68f4a7dd39370130f260a500c0ff243311d99185bb164e9ebda57a15b0d88651a0b
MD5 SHA1 SHA512

Submit Download

ESM.exe.bat

Path C:\Windows\ESM.exe.bat
Size 52B
SHA256 47cdd87f34e666a41ddecd66044f1853ada7c8b91993541c039c18e9eeb91d7d
MD5 87cca921d17a0db29aebafbb078f4882
SHA1 64a611581bbade7c79be270e8934ebf6ded7418a
SHA512 c634802fbc58c50d5fca8b2e4716c36fb443cb87bc8f8b2971cee585565b4dd8babdf981d7bc64d17e85fa85d6d427477ed9e8da93ec093086ae867e40b38a2e
MD5 SHA1 SHA512

Submit Download

FFWSMI.exe.bat

Path C:\Windows\FFWSMI.exe.bat
Size 58B
SHA256 729f58dc19ff19ad4ed904ab4c6b0dbc9e34eb9b6ce06ad4f55eb75f7df693a5
MD5 ee904cf3d2ac549cbe07fe9db69ee403
SHA1 589436edc4f99f5405461cb6d1b6572e415d5532
SHA512 ae22bed0063e6e39f0411323a926997049960ee5250a5e50a53ed2f97ec4864f51a82aac4062d7b0e86e7bc2d1ae9d1ca923d16c48c338154d292a89ff1dc77c
MD5 SHA1 SHA512

Submit Download

FHUIG.exe.bat

Path C:\Windows\FHUIG.exe.bat
Size 56B
SHA256 ae05c8760502391488498a20b110ce5f6e752765ef35c58960223f62c3aab80e
MD5 2f71cc4e1b1c63d3a79a5bfcaa983e45
SHA1 0704b0893e79e0909fd9a6e6365f915068ced288
SHA512 ed82bd1724ca4fdbb5647ba33c600240b7655e9ef379c9f724eefd4f310e14a1f3960a46859e5d9d562e3d261c02a6949c008d1f976a87743df399778e811380
MD5 SHA1 SHA512

Submit Download

FLKTY.exe.bat

Path C:\Windows\FLKTY.exe.bat
Size 56B
SHA256 d924f3aef82ba107cc01a0ded4f73aa36fc894d395f9da105e89226b410ba57f
MD5 46c4fd80b58286fbe79148a7ff0a0316
SHA1 c1b1ac6fded16f0532d93594d15fe04491dd68bc
SHA512 28db108c10f2d86bc20f246d571b58a874cc78559bd632374520952a79eed7af6fd181d99133e55b20cda7a8fe36da3533a610762cc2d2cea91b9f59bdd5ee64
MD5 SHA1 SHA512

Submit Download

FMWCO.exe.bat

Path C:\Windows\FMWCO.exe.bat
Size 56B
SHA256 19eb154f775210edc727ac999d982b1ca48345be31216f97755ebae0cb07d07b
MD5 10e17bbae1056177d56fe8739edce48f
SHA1 821ea4f066317d68102796efe6dd2c1f33de25fe
SHA512 01ef4f1a5704f1787540bf9bbe32f0fa808979304c4e7734855f3b67adfb9599d1d3eaf2a632958d7fbaf3d57c2ff3fea0dbe72f9a9448c56fe55462a4f7e98a
MD5 SHA1 SHA512

Submit Download

FNM.exe.bat

Path C:\Windows\FNM.exe.bat
Size 52B
SHA256 71db1610990940063f842de2ecb0225c3514020c7dfcb2d9f775237e0f3e9c79
MD5 27b26dbd3cbff650d17a2d9cf0629a29
SHA1 70a6b5e0e71b05fc69cd8b882fba9185496b21b3
SHA512 01fa9b312287b6a70ff768b72883fc82e4e5469c4cedac0dbfaec4bd7e68b8ef90f98c6fd4d53ce5191614152986517980b84099b7a4c0c6e4cb48d75e98c56e
MD5 SHA1 SHA512

Submit Download

FZWELV.exe.bat

Path C:\Windows\FZWELV.exe.bat
Size 58B
SHA256 d0e903c0fc67edacc6cd151e3130453417e7cbb047b50180115181fb4ce6b943
MD5 e002c54127ff443be18433b4e4b40bc6
SHA1 b437e4a4baff9078925ccc972627545bc278be2d
SHA512 5d9b3ed066ec0f5798ab49f7e1ae8b8055dde5e6f920fb49fb7621cb8adadbe4755c7a0c86827c86dd41d068c3115dcee12dbace94ae078de509adb85dcb8bf7
MD5 SHA1 SHA512

Submit Download

GGVMVEQ.exe.bat

Path C:\Windows\GGVMVEQ.exe.bat
Size 60B
SHA256 5ca19ac5335d98a2415d5851a045f1418b782b76b7c8092b711398d7dbff5a35
MD5 4a42b9356616cdc48d1b18dd906fb121
SHA1 aae6f6c14711205fb001a8a61f869a38ca09a2f6
SHA512 04b39bca97112ac1e65faad8ff20715be93c3a12c8a7865fcf7d4b10a3469db00d321da92bea38760ab942d9ac11d6981ccb78bbe7044b857f671c52984543dc
MD5 SHA1 SHA512

Submit Download

HUAWP.exe.bat

Path C:\Windows\HUAWP.exe.bat
Size 56B
SHA256 e7ba0432a50d05b50d35141cc1f860e2e99413393d4544223ae37e18c2a44328
MD5 81d2978bd8163ffa0cdff85731bb2017
SHA1 d83cd4dad7bede10d5fbc8ad3267782c2eb066c8
SHA512 6024e143f2daa6a559be870843d8b0cc544c7b59a91a4bac930bd8c06786c5cc1b717331b2208ff2f1455b0354355e9cc495a0597ad2504b45c09c2f5c1a39c0
MD5 SHA1 SHA512

Submit Download

HYWFJ.exe.bat

Path C:\Windows\HYWFJ.exe.bat
Size 56B
SHA256 2f3e59344f45c167ee35562383d35a6a20b412e380ac071d55d6222f12e034b4
MD5 319d1da7bd7eefb22983f317d5e2db76
SHA1 6d6fe6748208f8ac1948560680d081d2297f41ba
SHA512 eb0407e30bd800c5246fe2aa44f46f30653b58ee5f7dadcf1a0a675dedd5cd6ecdc23f5f5ff0ebd094585e0dfe717454a333ba2dce77a0534f3eb22b5db6323f
MD5 SHA1 SHA512

Submit Download

HZR.exe.bat

Path C:\Windows\HZR.exe.bat
Size 52B
SHA256 96b877a0716df412dba2cc567314275b0db36a3aadcad3c09b7bf6e66d96fb28
MD5 a7eb469f68bc6aad41e3fccd03d45550
SHA1 d4dbba8faaa264f93bb8d09f5d494ae1cfb6f339
SHA512 3f79bdb40d035cf125e65153f566cd3ebbff5d7f5d6d41dfc976c69c6e75755f15ba7c8ab32dc27fd91aba9a15d1b63e2148b73e81a682d02e9394cffdc04df8
MD5 SHA1 SHA512

Submit Download

ISOT.exe.bat

Path C:\Windows\ISOT.exe.bat
Size 54B
SHA256 696964774164262c3206382db1bc79c21f76c08319d1abf670935ff096d721a9
MD5 4045c868ad3da9e6246364b3e440f7e5
SHA1 25f8d693bb4114f6367c394fc89a227f618c0d80
SHA512 641b2ad0309991618e5b9615d93aa032ad55268d41ce42b631533fb0dca3f6329ecb18a56501ca1cb48a33154e26aff7d257a39387393b18baa203b2ac0bcc9e
MD5 SHA1 SHA512

Submit Download

IYB.exe.bat

Path C:\Windows\IYB.exe.bat
Size 52B
SHA256 eaa19ae0083b1a865b2731e0dc60289c4752d8725ff9884bde2c6b2099584ebd
MD5 30a1ea0e556d07c3ca8b5bbd2b5536f8
SHA1 8638b5b93baffbcb406a376a3f7211454bf967a3
SHA512 9394483ff549185849e8c81e18aaf564c41de5151bfba80d5cb2c08068d40457bcf18541c26574ce6560722265a1947fec8985d91325b4e641a84e43721842f0
MD5 SHA1 SHA512

Submit Download

JAMMYXB.exe.bat

Path C:\Windows\JAMMYXB.exe.bat
Size 60B
SHA256 28ee8f37c1efdf36097bc5d17acb4b842570042b2d0c7a6ed17db427dd2ca33a
MD5 ab32c9a56a8a803f9c6de1f35436ff74
SHA1 5061b3e00f345bf8d4e13e693fd7902a950a0802
SHA512 afc6bcf52b24fac83fceb1acde7bea6e68b32e4ce80a059d9a0efa92528519229c7ec2643ca326493d250661c2eb7ec996eb72fb610f33885c53ba7a7a957fba
MD5 SHA1 SHA512

Submit Download

JGQ.exe.bat

Path C:\Windows\JGQ.exe.bat
Size 52B
SHA256 f029b64bf2d47a02636be332d9194f578f5a8ec96c2a1ee6958dc55f69ab4fa7
MD5 9901aa5345a6ce97eb0ae9b606867950
SHA1 c6cb25938b829ae114f21871d4b55b53b556f7a4
SHA512 9c6e4938245d0809d3ba1070f815bce019254d41821761c6414bee4cddfc0dea5f5b75bf10c216e0d861b18dbf80bb270dcffbe5a094213cc6a2224a83c3f736
MD5 SHA1 SHA512

Submit Download

JRTDI.exe.bat

Path C:\Windows\JRTDI.exe.bat
Size 56B
SHA256 7ecc55adb8ffaac8e92bb6a518dc6bafe93232daf0c2fb48f007c75ceb555806
MD5 c55730790157fbeb9b67c50afcf46c83
SHA1 8cacc3a0472d0ab34dd58a91c6e63d996e3f7deb
SHA512 cec0b157b918226992548ff8b66092a13e1139a87cd9acd330b228994a4a603d1381d30951424305684adaaefeb4a52281fec45e49f47cdbae2e4352a73decad
MD5 SHA1 SHA512

Submit Download

JSUTID.exe.bat

Path C:\Windows\JSUTID.exe.bat
Size 58B
SHA256 96b4795c2c9ce0927db27ea3182e658975f7624999bc80ebdda46ae05fcc672c
MD5 d5cf8db677129d9cee7c00cfb028d5fc
SHA1 418f38e2aa54b106b36c2fb3f167835093e4555f
SHA512 a2834b377480188caeeb25d10ed4c4de08e10844aa5b2da0339c3d890a1ce5864dd3f5e5a5a82fec19cb5e532c92c9f7b940ef90d8e70d20e8d4a8130a224c8e
TLSH
T152A002F208C1A0C0882E4049434E3FA804AAFC408A100020933F208A60C4C438B280B0
MD5 SHA1 SHA512 TLSH

Submit Download

KUZX.exe.bat

Path C:\Windows\KUZX.exe.bat
Size 54B
SHA256 07753657b9c914261cb641b020a026afe4b4e1ec3d3170b76823737d48f56dd0
MD5 8249343ee654c5065802a78b053ef8e8
SHA1 12fe5f275cd5f59b8e604a8f9287d515d80c1d87
SHA512 7738367f58ce88984e9d9e92f2cad29af1ea36db22254577eca4aeaf0f5ac87cdf4924724720461cc634e654cc157615b3a50e8b126cae7b75fe7cae9220f09b
MD5 SHA1 SHA512

Submit Download

LIXDHPA.exe.bat

Path C:\Windows\LIXDHPA.exe.bat
Size 60B
SHA256 4588a07ee0951dcd55d8d29b650ec2b8f6503d5f3cfe062e01f30a89511554c1
MD5 eed55fc5c52232ad9f348ec891a65f19
SHA1 7d131d259c3221a4fe6e4ce735b9823516e88b6d
SHA512 487b1ef3f5db5cc5449a3aaa69a31d64aabfc3088ad865d3a1a7201b911a591cf8cf1eaee457495544350f262cc5b3f034187d93219601e2e848a54699432af1
MD5 SHA1 SHA512

Submit Download

LOLET.exe.bat

Path C:\Windows\LOLET.exe.bat
Size 56B
SHA256 7979415c40f41de7710a609a4e47d1bbb169a1437afdf62bb84d95eafbf70d9a
MD5 54de17c7e9d25a5af3c8a712d23f2c10
SHA1 2f5413667e253ecd22dbd30ec1ffdbf57f0a8abb
SHA512 353652556d0a9e1da61a9d7a6188d43a4d7ceec09ee645970c06881407fdddfe1d7602e3b174095bcf04e2efe5187bcfa4353c1cc824cfa9708670cebca544b3
MD5 SHA1 SHA512

Submit Download

LPCP.exe.bat

Path C:\Windows\LPCP.exe.bat
Size 54B
SHA256 8572ce5fe468e288345a8f620a1a3ec55b2942c134dd59d7cd83778e1ed0a58d
MD5 06bb479bddd53aeb401afa6a416b1f91
SHA1 8bf3d8aca15e2a465f899bd6caba9a87285eeee9
SHA512 7a08a00820f3390e4e1146c5a8fcc13f8e1635b5f24d673d08195a864caa5ee052675e82fde578c84c6f034cee56033cb25266c865774a8d146b6b9b90a20499
MD5 SHA1 SHA512

Submit Download

MGIIYYB.exe.bat

Path C:\Windows\MGIIYYB.exe.bat
Size 60B
SHA256 8cefba444e0bd12f71a4d161af0fd1c6b9398aa0e6b0ce43d44c359b429373f7
MD5 9b9a2581b28deaa63e623d019fe7baea
SHA1 a92bb8aa773f8b8b9535c9d602fae23d3cc65aaa
SHA512 32d77ad876f984510db2f1b58cff204b0e9f5f7ac7c5c461131e45d46ca85c706d03fa998c2b9f1226d54234617a6d50de6a696dee42266a955feba16040a119
MD5 SHA1 SHA512

Submit Download

MXJ.exe.bat

Path C:\Windows\MXJ.exe.bat
Size 52B
SHA256 fdfcf8363b0e5c25486f68be4c5cd1b4aca33f1903596c3cd997e42e543510bd
MD5 26ed8e86eb9eae84ae26071682d2697d
SHA1 bc6f1eaa2ac38e579c4f9180b412a676ae3be117
SHA512 9cca3307051b5923c50fb4440c8081cf16c74ec51f8e08636a1ca99e936b939dc4c256d58a387571be02aee3cfa8073f7fa8fa85c1040d0f6d7dbbee1a266a22
MD5 SHA1 SHA512

Submit Download

MYMYTG.exe.bat

Path C:\Windows\MYMYTG.exe.bat
Size 58B
SHA256 893eae4c6d6cbe2e7829e17250a92170e3dd63aef575611b278a17d2f0453962
MD5 5ad5ac07dc53a8473d3ea7d561d5e0db
SHA1 2d38b2263b04cc7b5360ad9843f5b92a08269b05
SHA512 c7707919dd77af181e78c6cecfde3db68ebbe7f39b18fe67901688438e7e00df1b3b1e994e741d21d83a98501473db1d2baf8069eddc879722143e1867ce8c33
MD5 SHA1 SHA512

Submit Download

NFO.exe.bat

Path C:\Windows\NFO.exe.bat
Size 52B
SHA256 d8b6da13fe5355705b6ae0fe870f266486418fa3771044d8b4891213f794212e
MD5 d33519a9dfd49e43055367ee29eea70f
SHA1 ec80322f671b9ea9ded9be121331d3846521ba0d
SHA512 c7ef722dfe4c2d786efa14ff9beec617b7cb85f65781450fb656101081d5e8a6478f4c165ea2d5061f1be4123241bc14857ae06fb72a9f77d4abb848eeac5e9e
MD5 SHA1 SHA512

Submit Download

NIEHWV.exe.bat

Path C:\Windows\NIEHWV.exe.bat
Size 58B
SHA256 b8e0e25c666c1594e36964cefaf3b39d0754803b3860047f02b6ed4292b3d746
MD5 d33ba2fa0256e69412b06b1135be69f2
SHA1 9307339c17a6c6ca4a1119c843dc171556cc550c
SHA512 d1294001750ae0a1aab97f5365fd6092c775cfc0204b1418e1602764598304fe30c73180597fd052972795dd58edd0463dce504c2ff9df8c2a7d92c152133c55
MD5 SHA1 SHA512

Submit Download

OME.exe.bat

Path C:\Windows\OME.exe.bat
Size 52B
SHA256 48c8bdb20dd29b09002766fba3f12e4ef197cc32ae612d742ad99cb5e158b101
MD5 487b74ca2318e82f305b8c295ced3979
SHA1 5076b968938e5677441e60d90964034e25fd0bc6
SHA512 2d38924194ab8002a4e75d8b4bc1cfebad56398b2c01ff4bfdd017208b371f9302f243ff9a312e1b426cc603085697e16ef068728595668a26cb3ae53f5d18fd
MD5 SHA1 SHA512

Submit Download

OOD.exe.bat

Path C:\Windows\OOD.exe.bat
Size 52B
SHA256 4ba5ff3aae3dd1dd66e9816bc860a2e4ba22139c887ce4fffb5cfa43907f9b19
MD5 8f8edc038c537939eeee6f5c80222de1
SHA1 c36ea574dc76446395dea72a6afe8073915250ea
SHA512 c7b792f5e3bf8316afbb658c4843e667a391459372bc45191f73889aaf9c19840b2db15892fddb3bc559103c0d7302634ef4e1a666f2302a4a565577a5337313
MD5 SHA1 SHA512

Submit Download

OWA.exe.bat

Path C:\Windows\OWA.exe.bat
Size 52B
SHA256 25de298e73604cff9168ebbe760ac528239f10f78b088e97f723e529f98ad9a7
MD5 0eac110ae738ded2e33b02d8fd03d22b
SHA1 47a38c1da75ef22d5b170adae62c18f55a9d3e29
SHA512 8b0e98dd024449d6f84483ad40263986020c4cba931e0de40fa3904fa784c4e07cdd118b1a7e50b21fe905b3ddc70ee4cbab82e2bac75343c869d9a86b7d7346
MD5 SHA1 SHA512

Submit Download

QDBIPS.exe.bat

Path C:\Windows\QDBIPS.exe.bat
Size 58B
SHA256 86ef99b08a13cda353e6efac52f6ea3ba662a65c665debadc1ae52f8a3f27239
MD5 189371e3321d28215e4e3a8d7d7c3d96
SHA1 4ce88b016bd632e842bf002d72c3f8e601829fad
SHA512 d60f8a3db83f42d479aa7428a086810fd81d31c0e7914f7fa93a224ff4625497189b12a5478cc0b9b0461265870e1ad08d50e2d18e68fca97265250eb1f2a7f6
MD5 SHA1 SHA512

Submit Download

QFE.exe.bat

Path C:\Windows\QFE.exe.bat
Size 52B
SHA256 f6acf9226ce0e8a1541fa9db71dd75e6af47c8268966588760da8ba607f5166e
MD5 7a973f48f37a3fc646b73893874d1010
SHA1 9d1163d64f5111e7ccfc11595eaeac5430771280
SHA512 745dc7ce6d220d22011e3edcb26816a5cfec5fd45103c11c803f449e56d82226aca98bfa8e602ce0ac83c36a8c061bb44ec608bcf275a1f57340aaada836d059
MD5 SHA1 SHA512

Submit Download

QGPF.exe.bat

Path C:\Windows\QGPF.exe.bat
Size 54B
SHA256 1b5fb5f174a3c58df9285b3db57f6fcfcc82ce4f6a869d6aabd7101568f91b67
MD5 83d1b872e0bb75f9e73a92350e260968
SHA1 ffc19217c1d42d41ebbe29bae3f7b8ac74818b7e
SHA512 96ce45197ed8a22a3ddca83815fcb0a17d4bffd2812d8966c83483acde1d834bfafb7d9a4cc6d2f9823e08bab804d84e72aa2fcc4ee873b1ab4c11d1d17676f0
MD5 SHA1 SHA512

Submit Download

RIXYQIK.exe.bat

Path C:\Windows\RIXYQIK.exe.bat
Size 60B
SHA256 1ae2508e5505b65127b3688abd6cdc2e2b4442d5e6703f5f295821c3fbeb1bdc
MD5 dea7d3808be084d0238405b7c0e23bbd
SHA1 a9dd409d2edeab02a1862d8b91cd7e9c242cedb1
SHA512 91221e8bbe94387f09818a6101dac759e66a39250954f4e90fc4c0df893bb716747d4c35bbe2e8a04541551e7ea9e1d72f7b481d82a7888661f00b408f9bb9cd
MD5 SHA1 SHA512

Submit Download

RKFGPN.exe.bat

Path C:\Windows\RKFGPN.exe.bat
Size 58B
SHA256 2efa852fa3b4e25582b5956d81be5f2f166fd0b15aa63fe6abfee9998bc66f04
MD5 d15a3593564d1d2d40dab7e449d3e9ad
SHA1 fc31bf8cf3c0959ca7a4d9f56319785404f66193
SHA512 46efc556bb64f23c07fbc1ea13927a6f186b36ac5e6055f79ffbabd91c9258c3f438f6ea2f6e06c1c126e91a4872a3b02965bc379855ae223930f72ba7c7a1ff
MD5 SHA1 SHA512

Submit Download

RQB.exe.bat

Path C:\Windows\RQB.exe.bat
Size 52B
SHA256 25bad68dad3f19c8249ecaac26701451def236490e7b0e19ab90af887ea26087
MD5 f0cad16e5aebd692a8cdad2ee81c6eec
SHA1 3b54659ca1f3d15eed227d89e2b94a38066ff880
SHA512 68567bd3cad97731fd12f2c55e34f85172aa2c01c3b5cfa4e488c7bb6f7c3c90816cc66b1bc9ad034871873609002e5debf0c58069c58380accb166981066878
MD5 SHA1 SHA512

Submit Download

SAD.exe.bat

Path C:\Windows\SAD.exe.bat
Size 52B
SHA256 1dc3766ee9871fe229f084b9554c9f0541fdb893f47e1b09db5a0ac43adcbd56
MD5 0da8b035cbc242141ec5c8eafed2cc8a
SHA1 100046dbab2ee7576f8b7c762ef3a4296d61755f
SHA512 dbb5e8fe41532daa840476f5c385d98f20b14749d5de570b7c6c7a9cd4617691f146239864eef70b7b32c04c54f6cb9b5714ca0cd22ba93c2fc48cf3676561b1
MD5 SHA1 SHA512

Submit Download

SAJMQTN.exe.bat

Path C:\Windows\SAJMQTN.exe.bat
Size 60B
SHA256 5da38c960dafb4b2f3ea280726af73151858e64eba9e5bed36da74f485533c59
MD5 121d0c12946183b5adeb78ac307a7c24
SHA1 864a625b22aa8aba70f982e8cb9796f4e7741b5e
SHA512 0000b3aa3c0eb2cca7bc89eb3cdd21a7d02b4f94c53e6210b3dd3cdbae0c6948a16e8c9dd1496b25d86e15a0ff2efac611af44f3f6d58324fcfdf4bb7dc0399d
TLSH
T175A002B00BC932C88A244069434A3700840EF44002D08A20931D88E06004443E2082B0
MD5 SHA1 SHA512 TLSH

Submit Download

SQL.exe.bat

Path C:\Windows\SQL.exe.bat
Size 52B
SHA256 fe0825f9af368a665ca45431985864714cdb976529bd38bfe72a5438c2e5281b
MD5 be531c6c73cf424180469f3f29652d37
SHA1 6241d217c627c3d461d28d506936da6421452e92
SHA512 fda11843993c8460259a2a3084beda8a4856c1e65277853c54491bdfcac483931d78480b9e3721633536ad5968ba259d9cd727d4eb0fcc4c83aece5abe1e266d
MD5 SHA1 SHA512

Submit Download

SQXYEI.exe.bat

Path C:\Windows\SQXYEI.exe.bat
Size 58B
SHA256 45acb3086beecc61a6bdf85d0d528ea1ce8bf9e1da024a841a84663ac9860280
MD5 07209b519389285aac2abe2d1ecd5f30
SHA1 c5582cdeab2d3331ba8c706a125335f1b7ebb047
SHA512 3571a85eda77ab9bf043d70780d559314172ff5f668c53475f537e9727489f70f4aa1caf18964bcd74a6980bf81863a41b7780b23c58dcbab7ce505c2f3a0884
TLSH
T125A002B008C130C0882648C96F6A370084AAF4603218003012150080720444380A82B2
MD5 SHA1 SHA512 TLSH

Submit Download

SUOZMHK.exe.bat

Path C:\Windows\SUOZMHK.exe.bat
Size 60B
SHA256 5f1ba8062f5b60bc4f146879827aa147ea67d8fa60f45a338ccbb9e65e90cf35
MD5 a4fefb05869f27aa9aecab892399254b
SHA1 c68dd1de6e2ea2ffd6771a519460d7ee9a2a1b47
SHA512 15401044f8237024e86057b1d0c32929e94cc629b1f702495a3a4347de82b820431c32dd9ba9259d45a09bc707f7e34a02905d363ddbeb41e9d76101d256159a
MD5 SHA1 SHA512

Submit Download

ANFPQQ.exe.bat

Path C:\Windows\SysWOW64\ANFPQQ.exe.bat
Size 76B
SHA256 cd9a748ebe5417b26fb6f3a0fd84938a14119fc6c5a373a96a073d69f7a08aaf
MD5 f14ab18a82b964a1d1d76f6fc1b4247e
SHA1 b78dc22335e15a22da37708500b7af7a8646f45c
SHA512 6cb31c936284e736583d1c2a7290246224fdd38e0e22e60ee986af34f3dcb30e39581896721e2e95ab22c8d7beb348ce18e3a20d074fe7460c42e548b45deddb
TLSH
T102A002382AC128F08824406FC3CA3720043EF44A039000201A9530EAF80446FAE22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

APJ.exe.bat

Path C:\Windows\SysWOW64\APJ.exe.bat
Size 70B
SHA256 6e598aad30856a52b2999f259b51d444d0e31e61742b53a315219432163c93b1
MD5 0f7a42ca9b44642d8c0feaba4f713cbd
SHA1 cbbb1c925f29646285c06cbc55c8552775d54364
SHA512 a351488dae84c42a2da634e21ba59cf0bc823e9dcfce23280de14e1ebe9824848d222e4e92195e793d32e29431c17ec69fd25fc739d9654bbc4580e273679e9e
TLSH
T112A002300AC128F0882C40EDE34A37200C2BF44E03300020929520C2E00446BCE22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

APNN.exe.bat

Path C:\Windows\SysWOW64\APNN.exe.bat
Size 72B
SHA256 0c6191ef42ce69607aa1951df4a4e6f8725234d74c3ed905b78621193051b4a2
MD5 579bc2aa5cf35216fc26ece0df4561c3
SHA1 a4506dd633f67b0336e341cde28ff0594004602d
SHA512 b08df0e38b00780402b6e74867861cff2bd432820835080da1723cbd836451e9fdfe835a1f06063a036967e77239967b79dc68442096890581edda399877abc4
TLSH
T117A002308AC120F88B24406DC34A3732042EFC4A03B08030929528C2E08646B8F22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BDB.exe.bat

Path C:\Windows\SysWOW64\BDB.exe.bat
Size 70B
SHA256 35e25e9331c2e3fc8bb8d0584896f947b20f252a17ebfe66638585717ad167d9
MD5 60f937234c5a862a470a3a852c5824ff
SHA1 6387ac747148b6b975402d8180e6a35ff17b0555
SHA512 08e37cb739054e8faf802673e57fba186017218df147ce11748ffe223b6be31bf04923f5e51e8cfc34b8ff912f3b7183f37e2dd7a9ebc783427a1e75eb61d4f0
TLSH
T108A002308AC928F08824406FC34A3720042AF64B03300020129528C2F00444B8E30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BSTV.exe.bat

Path C:\Windows\SysWOW64\BSTV.exe.bat
Size 72B
SHA256 edc8767d1442d2f5b61cc2f5b70ab436e47ce90d0e08d5d02942e06443c7d018
MD5 0ba5b098d5e7fea9bfe85c5d5ddf0a14
SHA1 5550b64d296a5b1a53ebdc8e2e3ed0905351cdfc
SHA512 dbf045c1dc8a492534b4f28402ca11ea00f150b228d70ec69bc54816cdd3fcc05c638db4a584ddce6d473c66d9b9209492173b18634b09888294e70cbd76fdd7
TLSH
T12AA002B00BC122E08824426DCB4A3720042EF4CB0330082032B732C2E22444B8B32EB8
MD5 SHA1 SHA512 TLSH

Submit Download

CBVMR.exe.bat

Path C:\Windows\SysWOW64\CBVMR.exe.bat
Size 74B
SHA256 1f0322120a057e1c6dc3acdcad461058fd6a9cfb031e2723141f6812d9e8e5a5
MD5 969318fc1cdabe09a018be02bbf267a7
SHA1 9f69e034e55100d4b162b37618ee2617358c3dc2
SHA512 0a5c799a494ab2d2974f720a600595e7361d725a060fe41c541792884c19c536e616344630a3956c5412bb3b3570ff448ec82534abedce5f520e7af8a7b346f5
TLSH
T137A002300EC130F08834706DC3CA3F20A42AF44A0B1800201A95F0C2E80444FEA30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CIE.exe.bat

Path C:\Windows\SysWOW64\CIE.exe.bat
Size 70B
SHA256 1ca6c2187fbdb4c7b771f965b5b19cd89c80a3ad063da4d6de28210a0e8c7f56
MD5 2ca408c57406195f99baea989d240bde
SHA1 c3304def91ee29cca965c64870b0902b1fbae29e
SHA512 64577b2cc3366ff227dcc74967f3bdbf0d6d796a22dfecdf6dddd5dac70ddbb0b911b0d30fb7103750eefc99bc0cbd4a636fc7249ca22bdcad9b3b52b4f4ee63
TLSH
T1F3A002B00AC330E288A4406DC34A37200C3EF44A831280209A9DA0C3E80444B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CMLZWD.exe.bat

Path C:\Windows\SysWOW64\CMLZWD.exe.bat
Size 76B
SHA256 324165ea305a012e914079280587a1d8d229f2f3f38fefcc994532364af5661b
MD5 2d0d73342c13d36c14931b1a27eb7e5f
SHA1 16db83a96b2ea3a301710f640e139b526d61c437
SHA512 9c0c91a25ee11133e99a772e570cda3f24e141ad4a502e3eda197e87748617d5b5c5f8df3138cac2223485d0b64c59d102716813a62910e9a3ced9dee68c200a
TLSH
T10AA002380AC1BCE0AC2CC0EDC34A3720242BFC4A033000301A95A0C2F0044EB8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DBAJQJ.exe.bat

Path C:\Windows\SysWOW64\DBAJQJ.exe.bat
Size 76B
SHA256 5ae1ab1b62195fdbb4e81b8085e39513181cce0e63538489976be228b0c0fa94
MD5 c3affb9f545bfc5bffd79f653a96d5fa
SHA1 cadb0fda761dfaec8e97f0d0be9369dfbd3681d2
SHA512 3c5a1337fd504043f87a1709ed8065b6a5895db958f76d1be8ea6703e04277e2ff347c9fc6590301094858010c666a7bc561766ce407d8ea2f36835611b4281f
TLSH
T19CA0043005D114D1451440DFD3553710051FFC5D4310031111F714D1D0044C7F510C74
MD5 SHA1 SHA512 TLSH

Submit Download

DEXFEOI.exe.bat

Path C:\Windows\SysWOW64\DEXFEOI.exe.bat
Size 78B
SHA256 8f635cff2cab6d993ba8485c450c903f2f1f822705db12ef7f2ee4f445fc7597
MD5 0425978bb47985669340b2885f20564e
SHA1 e17f6df58ead95779955d36d3eb621867abcc24c
SHA512 f55cae5aaf7628053292f4ffc486481143053a658d04fd8dbe553895013d505326a9824229d23552e464f595072be21b5b7f0d7bfbd55bf4c0db5d561ea9a2c9
TLSH
T135A002B00AC1A2E08C24426DCB4A37B00CAEF44AA3100A201A9F20C2F88444B8A20CFC
MD5 SHA1 SHA512 TLSH

Submit Download

DJHYZWT.exe.bat

Path C:\Windows\SysWOW64\DJHYZWT.exe.bat
Size 78B
SHA256 a126439cbb53752952b18f77bcfdfcab0544a9a7fefda5dc1bc9c278b0440978
MD5 a8459c2d106a628564b6ee94a10b581d
SHA1 50e428be3821f1dded40600621424d9a3292c3cc
SHA512 98c1a50dfd5ef6b6ad740e5029810b0acdb3e0e3ed6be80953935fb6f0c621ae26580e1a2272f16d3705a11cfb639e9ec183ccbc72c22d320c143f5870f6a239
TLSH
T1D9A002380AC120F8AA2440EDC34B37A0042EFC4A8310032012DF22C2F20446BCE33CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FQLUXL.exe.bat

Path C:\Windows\SysWOW64\FQLUXL.exe.bat
Size 76B
SHA256 78bfc419ca8117ea575ea30993fd0442b77804a2901ac7fb862c918f654180af
MD5 7167b00a677efa69829a97452dd8b4a0
SHA1 2a9e6977ca39642fc63c693a0d9b96d747811caa
SHA512 4bf19ca4f23866de4cade7fbdf41634a495a4f13acbb8249aff031cdca1f487e2ddb3aecd5d8e4abf172e9ee9a67b49e610454351cfc379cb4a3b7c1daa3d314
TLSH
T1FCA002308BC128F08824C26DE3CA3728842EFC4A0F3020A01A9D20C2E00444B8A30CBA
MD5 SHA1 SHA512 TLSH

Submit Download

FVNYDNJ.exe.bat

Path C:\Windows\SysWOW64\FVNYDNJ.exe.bat
Size 78B
SHA256 1713fc29513d25e626e6bc045e4cbab0594844583d001a5277aecdd673d9cf72
MD5 53071bf36fcf08e4ca1b5354856c397c
SHA1 64a19fb652435ce4b9ebbf8ec3fae2bb38bce841
SHA512 d5524075a543c5b29ee29892b0705534395d727258b807dbf3fa0b2a778fa077437d1ee305f7a37e551c461d877e66fe3a363c459c89d0288318d799078db7ae
TLSH
T1A3A0043405C714F4441450DDF3573715041FFC4503315074115550C3F054C474510C74
MD5 SHA1 SHA512 TLSH

Submit Download

GBVWXAD.exe.bat

Path C:\Windows\SysWOW64\GBVWXAD.exe.bat
Size 78B
SHA256 50b9ead4c6c2981708444b930bd240dd6a0741a3e9044a5ce5dae783a93304ea
MD5 55f45b9de7c392f2d214aed626f57f60
SHA1 058c06b2c52031cc90315fb1f9e32cbcde08b7d1
SHA512 8d353b34e5dc31dc8afc1734625616ebe0497929bcd648ac7adc364b242638163e1c6dc9f862dc4ca86775eabccd82b46e16f8cdef83d4e55280d28c8b1a6710
TLSH
T1E8A002300BC1A2E0883C406FC34A37A0ACBAFC6A03380030129FA2CAE00444FCB28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GHVZIY.exe.bat

Path C:\Windows\SysWOW64\GHVZIY.exe.bat
Size 76B
SHA256 bc8cde6b554dca46e6dc0e682d8e4398a93fb376c8c9bd2b3d017c2d394afed4
MD5 8ce9315c5892f1dee6687544c1eb5aa9
SHA1 c6f735529154c0e7b82dadd80bd34164276930ea
SHA512 7e66bca2d31403c17c90ab00fde0de528b9801a01673ff1763b97ab43fc25fe44e3f14a9e7eb1e574f984adcf06dbffa2d024810351e63231da42c7d1838da8f
TLSH
T1B7A002380BC120E0C834406FC3CA3720C6BAF44A831000201AD5A0E3E00646B8AB0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

GITBPK.exe.bat

Path C:\Windows\SysWOW64\GITBPK.exe.bat
Size 76B
SHA256 5f3dc4cc49a336e7aab0e62952a19b276a25d29f925e21da5b0e7d7965961d63
MD5 4c5dc6002c36c581c8cf54982f7ad5e9
SHA1 1583b6bf25711829890f1fc66302188ed30bd54e
SHA512 b2f6dcf5d92e8072144453ed29700b9ea5de675eaaba974901903e930905dab63f9fa0350c6360a4509d7dd1d147a6cd515d0380102b57cc630f61550f788118
TLSH
T19DA002B00FC120E08824406FC34BB7A0A6AEF64F033A00201295E0C2E00446B8A30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

GUNAXJL.exe.bat

Path C:\Windows\SysWOW64\GUNAXJL.exe.bat
Size 78B
SHA256 efda60a511c77fb29c99dabbdf4149c639fa5ee8baa35e3cd0cf5b182f523fa5
MD5 af0c36d2fe22e97d0c2430f2ce1906aa
SHA1 67d2b0d8df40571adb8d1bdd5f9d04a121650b47
SHA512 c1d8d326d62c7a88662e230e7889b1c44cf11f3d47032101e70af7f131560a155024de15426d3be8281abd32bc41c36c503ca46b75437718e655a4c8725c25bc
TLSH
T188A002320BC120F0A824C0EFC34A372204BEFC4A231000301A95A0C2EA0466F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GWRSXB.exe.bat

Path C:\Windows\SysWOW64\GWRSXB.exe.bat
Size 76B
SHA256 fe79f963738d7e967616dead75e69790a25fcaac24742c72825ae7ce72a02c13
MD5 2fee9f1edb331c1b4965ac6d9e37cc8d
SHA1 e2fbbcd16001890b729410762dc507d766745d9e
SHA512 cec10951a91675015e13b6f2c81acdb2ffefa1385c4c67d3880afeb75b903bc3b091bc36fb8d3a68445c6f2cd8373c6b2c76aa899f5d66fbf87f23f0dcde81c5
TLSH
T100A002300BC1F8E08826406FCB4BB73024AAF44A031008A032B5A0C2EA0466F8E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GXTW.exe.bat

Path C:\Windows\SysWOW64\GXTW.exe.bat
Size 72B
SHA256 26791bda6d540f187be4daaccd1f39e48e6e7f49d6f37e0c6c7ba667b4f03ed0
MD5 b9c052759487a07af895a4c4a75d12dc
SHA1 562355db09fdc966220b2bd44df452c5dce38c17
SHA512 b5dba1930977974d25a4abb8a66b992f1e27874119092b035bd341e2b8e1120dfcdb83931ad12556ab8ad2aec881d457e6bc8d7972da34695bfd396e04dce21c
TLSH
T1C2A002B00BC122E08824407FC34AB72024EAF46A8318002012DDA8E2E20446F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GYXQJ.exe.bat

Path C:\Windows\SysWOW64\GYXQJ.exe.bat
Size 74B
SHA256 01526946e9df58bd458def89efe71736ef35fa4827442d1ae78b02fa57baa1e3
MD5 792fd6d3aec27e0c0fee989123240210
SHA1 dfce190e374f3c2e531b6046cfd478de95dc0ea9
SHA512 91a51959b7898358c41ecbc9377d8871fe5e80a0c15c13f0734fe04d38d9ec64dfbc4be1ad4b57cf05a9c61470171242d6f97b5a4f5f9004fc264c6c0324dc39
TLSH
T103A002380BC128E08C2442EFE34A372004EFF44E0310002812D5A0E2E88444F8A28FB8
MD5 SHA1 SHA512 TLSH

Submit Download

HKP.exe.bat

Path C:\Windows\SysWOW64\HKP.exe.bat
Size 70B
SHA256 cf07e21fef11d4655c768818e52c92ea9bb561fc318394fe8a5d9d2f6906dd5f
MD5 fd177006606dddf18e2b9e362730d23a
SHA1 b1feb619a82a7fafede5c30e876326764c5335a4
SHA512 5a60c77237505b678ef6cfe42d38e9584c3340359b3b9c71d87b32a22d5d5cd32b54198882050af593cde91d5f0db4d57b7a8f54c7ba8f01a303465910c87036
TLSH
T1BFA002380AC130EACC3648EDC34A3720042AFC4E033080203A9520C2E00644BCA22CBC
MD5 SHA1 SHA512 TLSH

Submit Download

HUNEW.exe.bat

Path C:\Windows\SysWOW64\HUNEW.exe.bat
Size 74B
SHA256 398c2a43f5f1ef1bbc0501de5cbf647f44c6beedfb5792ca3b3f1df1442bfde1
MD5 6b5ea238d8609b4a0b5a6574b5799939
SHA1 53aed14c32bc99c86dde7828865687b3092369e6
SHA512 c6dfcd59cf509252cda38cffede68e04b30e8c3f5c8326ca22a8d9e1ab6ad54f84df1a9f90187621af2d9ed2abf1dbae92f3ebbcd2a7049d928793c73d7904fb
TLSH
T12BA002300AC120F0882448EDC3CA37B2042AFC6E03100AB0B2D528E2E08446B8A22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IUVOV.exe.bat

Path C:\Windows\SysWOW64\IUVOV.exe.bat
Size 74B
SHA256 3399fb22ce0cb99fc7a6269d0cfea6f9de05685d1a2ede93e1dc9b986dbaf1c2
MD5 b2b8e02edadae86631347ccb7512cf76
SHA1 2f5790fbf005a1a1550e4d2b949c46b6dc15e5b2
SHA512 6e8db414df314a51fa623b456e2e1b1903bb1d1fcff8bf42136dc45facb479cbd8850ae86aab69781a068e8679a542aa0d128e73d75f1c1a4a77594f6ceb13a4
TLSH
T1E8A002320AC1B0F08A2440FDCBCE3728842AF44B23100028129728C2E804C4BAA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IVYVUP.exe.bat

Path C:\Windows\SysWOW64\IVYVUP.exe.bat
Size 76B
SHA256 b478f755ca4971b54bc9cbbf5c19b6f7137a30d960ad61e8d63080c3f2408966
MD5 b3f45ec855dc90be6eb4aeedac4bf2f0
SHA1 12f14fc563541e4319612b5c009910a5dbfdac9e
SHA512 e192aabfa69a71427cc98be9b1a7f2e1f1d9607fbf76ada3fc58e8021bce85546f997e9d8d950f5a11dc10a911a912736797c3492191e019c95de2de93e10aee
TLSH
T176A0023C0ACB22E28824406DC34A3720042EF44F8330082092B5AAC2E0A444BCA20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

JAVXA.exe.bat

Path C:\Windows\SysWOW64\JAVXA.exe.bat
Size 74B
SHA256 f128fd346f4f510d9b30d405fcfc3bd7f533a5551f7385ec13551d676f0905a7
MD5 cdb0cd6701d0c913cbb2c55f8f98440d
SHA1 6bc64730caf1e839b65f1e02ac0cd678fffa816d
SHA512 aa22015b02e17cd03fcc02a10c1f82a23b8fabfd538eb6ad2abbd0c03d7c0b10cc2e9e65dc5f6d80ddc2698a378dbe70e67f76a7f56b0d50e731a4f899e399da
TLSH
T19FA002B00AC320E0C826406FC34A37228C3BF44E23102020929D28C3E00444BCA20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

JBHFH.exe.bat

Path C:\Windows\SysWOW64\JBHFH.exe.bat
Size 74B
SHA256 c2a7057be86d7777c4c855bb997f14f6525974def200a6fd21c1fea46816d9b7
MD5 f4f6327ae143fa494edb60fc19c54876
SHA1 d33b442d37980cb89de3aaeaf74e8b74bf6115e8
SHA512 e01d9873f37eb4bcd8456849ac03fe5c3f25e2fea4c1433d7df84a18b7abef58237c50ba453ab516a0bd630b2196cdfe04393c8abc84aaade03c1df8355bb888
TLSH
T104A002300AC320ECC824406DC34A37B8062AF44A8312002013B522C2E084C6BCA22CFC
MD5 SHA1 SHA512 TLSH

Submit Download

JDZIXQ.exe

Path C:\Windows\SysWOW64\JDZIXQ.exe
Size 208KB
SHA256 2ad2636dd315933496d0fb5c99408380d328ab76344d2381896b6e90ffdb6335
MD5 982f4a2cac96b84e2949bf0c77977d6f
SHA1 173591d9c8451fab582d88a309611e34bd3e9ac5
SHA512 427413f64e0d58f5b9c904c68066af655a6fe7ec2e2c8347d3a671d3d9eefa12673db82a1d06b16ed753dfc2a2d0797c975b71a39ae06defd48599a81cadef65
SSDEEP 3072:7aGgJLjbtg7vHf/eT2wHfSTrwLqqv0QNLa2cVyJQUE4pLthEjQT6j:7azJTGEdHfSw2qc2EyckEj1
TLSH
T1C3247C867BE0C263E6634A344BE5F1DC2BA5FED5DBF1D26B7360731D26312A05809B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JDZIXQ.exe.bat

Path C:\Windows\SysWOW64\JDZIXQ.exe.bat
Size 76B
SHA256 4f75bd4366fbad005f770d0241498757cdf57b3c315530e0264ba8477e790032
MD5 8cd5a2f568176e0a5f407f99eecafbdc
SHA1 bf10256bed43147a91a5d7ad856df8b2cb70df15
SHA512 621bc26082a65fbb3441c1764a29d82a22bee09bad6bc6ec1ece6e88777e9a98eb8f83b0df89f11821023ae6b69680276cb2b037102f25ac371d4b790b5257b6
TLSH
T173A002303AE120E0EC2C40EDC34A3F20A42EF64A039000201A9532CAF0A4C4B8A2ACBC
MD5 SHA1 SHA512 TLSH

Submit Download

JFJKH.exe.bat

Path C:\Windows\SysWOW64\JFJKH.exe.bat
Size 74B
SHA256 f39a1dc426573b04e04737e55e12d0e0077f4accedfc8f07593c716cd6890772
MD5 c64671c5b787aa5a6590ce0aff351016
SHA1 0ff3b2f0fffec6d077765ef9c9d14c953e21f5dd
SHA512 9dc916a4f613e0cb914a397089c84d4effa69c3648a9ca53f7bd49676ef88e24d3821cf0e1d4cf2fa964787837476df28277b4dfb79d8482f3b0cac1c2427adc
TLSH
T171A002300AF1A0ECCA24626DE3CA3732042AF44A033080201395A0C2F0846EB8AB0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

JSJYIP.exe.bat

Path C:\Windows\SysWOW64\JSJYIP.exe.bat
Size 76B
SHA256 4190dbfad2b39502dfcc25ffa4f602de4dbbcd6fc6e16a13edf667c72ac2f886
MD5 070f65779b79d5655ecc9e5e541f5b60
SHA1 52b458de38f2fe18b9482260993aa0f8a2e6d3a7
SHA512 369330c549c7c6af52098e529eb323c1d753bd2f7d4ed8e70f9279cf386123ce7cfb3df94ef7db90413d71e08c5854d7597396c2f27d3939f18d95ed70e1688a
TLSH
T109A002380AC1A0E2C82C436DC34BB720042AF44E833220201297A0C3E00444BCA30CBC
MD5 SHA1 SHA512 TLSH

Submit Download

KJDWTA.exe.bat

Path C:\Windows\SysWOW64\KJDWTA.exe.bat
Size 76B
SHA256 ffc6a4544b94cc31f2761772ac86a96afaaf4dee8ac635b80d6a1321357dee56
MD5 3c9155c4107cdb4263b8386e0d7d9b5a
SHA1 26f0deb1fd73d7e4ee319bdcb8af9ca23e769ac4
SHA512 dadf21ade0a8dc232377164c81f16b65a3059e695940c5a2071e81bd440cafc4699517cad4fa0f8d95ddf7a6278b7e98b7591f6c4326137f861888b87626c24a
TLSH
T18EA002320FC122E08824486FE34A37280C3EF44E0310003292BD2AC2E88C44B8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

KJKDGH.exe.bat

Path C:\Windows\SysWOW64\KJKDGH.exe.bat
Size 76B
SHA256 48598bb85c14d9c0b273a7bebcd73c9cab85fce4c3f83948afe17f72a92b2f1d
MD5 f053e0d43175d9d02f10216579ad77d9
SHA1 b4a294181e69664c3a91bef668716eea7f83214b
SHA512 df6844d6330dc3d69a81a1da5d425d46c549b71d58cf6a560c44de833c85b5019f366f9f146933480c6bbc55a4157059bfed483c11e7e99bfb66a3990293f2fc
TLSH
T184A002300AC1A8ECA824C06DEB4A3F3004BEF44A03100830139528C2E0AC66BCA3ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

KKVEIA.exe.bat

Path C:\Windows\SysWOW64\KKVEIA.exe.bat
Size 76B
SHA256 4cc67c985f0ae2b1652c8f544b814e49f72cd1026cad21aad120dce267117d02
MD5 718fc40d9a2b20968c4c4d1acf42624e
SHA1 eff960a90c313c6cfe8c8d9f26e8053fe903fea4
SHA512 07d505cf5289cbe46e74367345cd4fb001aee25a4d4ca8b086c352dc8e8a0313b4d4e57cd5a2b4c399c5ba6ac9a38cf6cfbdd07adf4ec3d31111a6769091dce6
TLSH
T1F7A002300AC130F888A4486FEB4A37208C3BF46A83108020929D28CBE00C46BBA30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

KMM.exe.bat

Path C:\Windows\SysWOW64\KMM.exe.bat
Size 70B
SHA256 319bda331031bc57f49dc6abfc592f56dc65ea8b41373af7271334294ab7d468
MD5 12c1db4103544ab04db638bfba274857
SHA1 1018ca1d3f3e83444edabbb499e9ebfb3a061aa8
SHA512 87af314c8f29cf6916bbae1f7d3210f8beb86c9754fc9fd49a3e7d8d5353cbfff5fa05fef199d20eb82a781f152b2bb3f8852b3791475f12dadbbf8bd87f0d2c
TLSH
T1F9A002300AC120F08824406DE34A37202C3AF44A83180020129528C2E00C44F8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LAW.exe.bat

Path C:\Windows\SysWOW64\LAW.exe.bat
Size 70B
SHA256 b72bb6cd98193c66c2a830d293e1f9384904bccc7f793c8c81e6455460bb555a
MD5 973017ef6194ffad31347b29f0faf2ca
SHA1 9d84bc40622c94dde94784a137b513be8b98d7da
SHA512 11843025fca41f6817fb2b3eb37f62d14ca71a225f5057e4dc675fde2f3b0684b8acb54b139197ba83bb3f3a0e8ecb442fa82a89491ca2c243363d58af3a416e
TLSH
T116A002300FC122F08826426DC34A3720042BF44A031000A812DD2BFAE00447B8AA8CBE
MD5 SHA1 SHA512 TLSH

Submit Download

LLA.exe.bat

Path C:\Windows\SysWOW64\LLA.exe.bat
Size 70B
SHA256 c3f3b0b9edb39fdfce610d2eea6d5fbf9bcf5802ec93980452de3f239ddfb1d4
MD5 8fd9e59eccac11439c014fc39cb15bcb
SHA1 49dbe7e854012148f336ad0a14cf10987f87d248
SHA512 670fea3ee8e2f0639df7e716b9b3181753599d5e7c6e0872db183786e2730d438dbb77769a1e649a708b931bc04e4f67cc4f267434528f2a5dcce4ca4e995437
TLSH
T1A4A002388AC120F2883E426FE34A37200C2AF44A23100022129D2AEEE00C44B8AA0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

LRRT.exe.bat

Path C:\Windows\SysWOW64\LRRT.exe.bat
Size 72B
SHA256 5499bf898131c90a1302b4411325ab8176f245b785a4a86c5b3b31f1aacc9127
MD5 d768276ee6564397035ef86948683aa3
SHA1 1d3049ac19b45f0c61d099fdb97eba3e2852db2d
SHA512 99e8c15ca98d17600a39454c5f1009071c906d117c6e8c62351cc5109c78f0c539daaf706610ec5b29c69264f2b702d899f797ddd485f9affe24c3e9c2bf48db
TLSH
T171A002300EC122E08C24426DCB4A37B204AAF44B031003B012972AFAE80464B8A22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MHZQFYB.exe.bat

Path C:\Windows\SysWOW64\MHZQFYB.exe.bat
Size 78B
SHA256 a86e214b985f39bb5528f6be87e5a98d8e3259470141d4d05a44f76baa6a8287
MD5 21796e9581efb0943388969845a8c577
SHA1 c772782f63fdf2bb7840e9ad956638b20d0c12ca
SHA512 04133f3acad524c10cd9f8656887673e1b3d0cc76e719b1bc64be630d85f9d54ec1766187a7ec4fdbaccee1a23333874936764d38c8553d366b8261e0d2259e1
TLSH
T194A002BA0AC128E0C824C0EDC37A3720A42AF44A033080A21B9520F2E88E44F8E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MJCFCKI.exe.bat

Path C:\Windows\SysWOW64\MJCFCKI.exe.bat
Size 78B
SHA256 25a6f242b5a7c4abd39a69f4606244b90e3a29a16d5da7a29922212d48a1e58c
MD5 9914f588f0b73a1c5ca2bd8c92ba9c97
SHA1 82eb2e300d64ebe5ad156746114678b0072238e3
SHA512 3e25cd86c5d059190592a2d167f1423cbb3cf1131e89a43aa69eb9c73fe550c5262502f1da5b1e04e23e589871b9c2927f916bf8556f73a522592126d0e58f0c
TLSH
T143A0043415C111D1441440DDC75D3F544455F5CD0330C010115D11C3D4054474530C75
MD5 SHA1 SHA512 TLSH

Submit Download

MZCYH.exe.bat

Path C:\Windows\SysWOW64\MZCYH.exe.bat
Size 74B
SHA256 72f58b238d34f991e2b6126cf3e68cf2906706e21a239110c999193ea362e93c
MD5 5ed4e0fac79b9d15e48d44c893dccaf2
SHA1 09815a60876dadf92605014adb838cab11e3788c
SHA512 549ba26b8562516996f7cf5654cc0755ad22cfb80b2fc44a842ea5ee2f17a9ca9956e240ae821db2a9e2fa1d238680857ef6516e71a6bc986c885a7a987e71f1
TLSH
T17AA002300AC120E8882442EDC36F3732242AFC4A2310A820939520C3E8864EBAA20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

MZE.exe.bat

Path C:\Windows\SysWOW64\MZE.exe.bat
Size 70B
SHA256 9efb5b477ee2ac28740d2d1ad4e25bc8433078aab95ca74c9b4232d76efb25bc
MD5 857f5e42f79a1cbbb8f9b7bc8a11fdd6
SHA1 53557cc4151b7ceb204ef27c8f47e91ae4da97c9
SHA512 b7a2578f6b2e7f5f0819ab2135d972f99abcde35799df61319fac149f499c4a39f3bbfc682d4e019f4c2416b903bcb8d12c9ca42e1bcf68c6c62231dfabc76b4
TLSH
T1E7A002308AC320E08824626DE34B37202C2AFC4A0312C020139720C3EC0644B8A20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

NDKZZ.exe.bat

Path C:\Windows\SysWOW64\NDKZZ.exe.bat
Size 74B
SHA256 f25e0fa00740cb82696559d3f31ee60f70ec4575d1b936851b19389bb0ee367d
MD5 d2d8e24d2603500257d9b88b26da4cbf
SHA1 b2e1a65af2db818f2e2b300753e3ca1cf74b685f
SHA512 fb89f5ae65b7d587c06c4ae3b0c4bce1d6d2e4949a84aca23c1c40efe5442c7276f3571f59fac483399f4d94fdd7d921a9af8f6ec93828af0025a6a2098455b6
TLSH
T1AFA002BA0BC320E08AAC406FC34A37200E3BF44E03900032129720C2F00444BCAA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NRIQPJ.exe.bat

Path C:\Windows\SysWOW64\NRIQPJ.exe.bat
Size 76B
SHA256 2c3db2e4a5dc87e967b28e01d13ad5c123c6db33c95bbb9fe6b6f7c344f7ccae
MD5 f22f728df52a0737974a9b9a12e95a2c
SHA1 6a73266a7505099d50be927a1fe55d1c7ce35005
SHA512 76b595a93d929a738133749d7916b5beee9766c3a36abe727e93e43851287ce3a75c65104cbdca18c9c551d6f48e47411b6a880544083a94a8b944598cbae69c
TLSH
T19EA002302BC320E08824C0EDE34A3722043BF4CA03120020129530C2E0044CBEAA0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

OBNW.exe.bat

Path C:\Windows\SysWOW64\OBNW.exe.bat
Size 72B
SHA256 ac86aa97894b4973c8917322b4a1a50e8236e90d648eff1c60489d1e75befc2c
MD5 4d4477fc7afdd15fb9894338ada61047
SHA1 86f55bf0fbfa0a8e493f1cfd51ba1402256b50cf
SHA512 57ab0c7de713d3d2c80e006d79deafb02a3b0c5eff1e0bbcb03679803e66b690d7f6bb135d83532e11c5dc152c23c0757a16667d5db5838e430df57371de6745
TLSH
T192A002300AE1A0EA88A4406DC34B372A042AF44A0310002012D520E2F08646FCA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

OCHHFX.exe.bat

Path C:\Windows\SysWOW64\OCHHFX.exe.bat
Size 76B
SHA256 faa47b0b0afd3d123e20c7293d33b8355d827980bcf9f3abbfe13f16bdf35505
MD5 86e4a4435f95ec06223b836b9c78b700
SHA1 ff881705177373ec61b6fdbd380a3f7e1de6fe21
SHA512 a793ac1fb7e9a105135bf77ade10432af58c843989a8498fee44d64cc7e58712d923598276126d3424fd9cd2e4b303aa114d1292712a5aefbed2b0028d63ad91
TLSH
T131A002B00AE120E8AC2460EFCB4AB7A8842EF4EE031000A0929520C2E0044CF8A30CFC
MD5 SHA1 SHA512 TLSH

Submit Download

OXJNFCS.exe.bat

Path C:\Windows\SysWOW64\OXJNFCS.exe.bat
Size 78B
SHA256 9cde796530d267b77f387add197a0f8ff5e43fb409fffeaae028a68871393872
MD5 d436bdd1450dfa0d48ca76556dbc1ffb
SHA1 6a20289329015596bce5bedd0ae0dd945fcabf14
SHA512 e501711484074a88d6f9f6a04ddfb292e54538f653cbd2dfdc86e8ca58abac439d91c23c9d25f9416d58ab662d015bf1f89bafb69c78bc88c92042de6fc5ca11
TLSH
T16DA002302AE120E08A36606DE3CA3F28063AF44A039002E01295B0C2F20E4CF8B20CFA
MD5 SHA1 SHA512 TLSH

Submit Download

OYTF.exe.bat

Path C:\Windows\SysWOW64\OYTF.exe.bat
Size 72B
SHA256 2f6309f3cb4f87f759fb8fe40c425888da9ee9a9ddc5f75fb043e1b8940313b5
MD5 14c280d09f558172515da098586367d7
SHA1 15b73da9f4f353ce01dcebbcd849beb296db1af6
SHA512 25dff309053077dd0e1dd1c2cfc9bb2375ca83cae4582c78dc88c515abb2886101ed02c7aa95c6fe180c37ba0ae44bfae14d8b449aac45e12d9ac264810d46e0
TLSH
T1DCA002300FE33AE88824406DE34A373A042AF46A0B1000201295A2C3E80444FCAACEB8
MD5 SHA1 SHA512 TLSH

Submit Download

PUG.exe.bat

Path C:\Windows\SysWOW64\PUG.exe.bat
Size 70B
SHA256 102c89c1a0a1d66e746f30edca2c99ffa1678cf5a8c915b6c27bab7a159168a6
MD5 638cf307b78d00886ab98b0e7e3f348e
SHA1 0545ca4f7ee2b102ba3e68afae6917457025cfbb
SHA512 a6dda04836b1e2235e9fc8442a70ca88e2b16bbb1fe6c2743c5b94713dfac9345c0a1951144664ea127ba1f85193ac2a01ed4d2ce6706cce73e89e91830653df
TLSH
T141A002300ACB20F08C24406DC34A3730042EF4CE0B100220D295A0C3E00444B8EAACB8
MD5 SHA1 SHA512 TLSH

Submit Download

QDNMGB.exe.bat

Path C:\Windows\SysWOW64\QDNMGB.exe.bat
Size 76B
SHA256 b9d3b98473e759c036238f20568b19258268cb67c7c89d5cffca6d4f96fc9d04
MD5 dd1902338363685b6db4886c3943f024
SHA1 d935db5cd17cfe7c8b81f7e4c7849643aa8f7aac
SHA512 8c95cb3995b4264c85dfd5609dcb10ec09a30b18050c510cbe4f2eb557f889d060abe822734c6966632dc133f98c5cf68361ca086c7462839daaa6f0beab2594
TLSH
T1CEA002320AC120E08824407FC34E372204ABFC4E231A002812B520C2E00444B8E22CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QTDIOKX.exe.bat

Path C:\Windows\SysWOW64\QTDIOKX.exe.bat
Size 78B
SHA256 2aaeaad38ea029a130fbcb90255c3fd20a99861be9e089d0f34e33f5a0a18111
MD5 06934a773cbf4b9989304dedc0455c4a
SHA1 58edf7ae0c6d55dc8228813c36980e21e81dea1c
SHA512 85c8e066cd77ed3d363745fea244eb3c250216da6c971c05cb078cfa8752b2300201056d03a5cdfae10f95e716395fd3c85571c4b50aec2211002ef422c40fa5
TLSH
T148A002300EC330E0ECA448EDC34A3F208CABF4CA033880A01297A0CAE00C46F8A20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QTYLKGV.exe.bat

Path C:\Windows\SysWOW64\QTYLKGV.exe.bat
Size 78B
SHA256 5ac05be8c483fb639a996e64d55c19e8d6d153d3ac77a2ed4fb6fb88e32890d4
MD5 b4634787386e2d573583e8e136b92498
SHA1 dd308fcf5c45657964e604c2ed78994cc1fdf0e0
SHA512 98ec550ccfc252a1285cf4b5066a4cfba7f8a626d2d3759794a1a8ee8075732899f28e2cfab3eca45275500e74911c836f49d71410d62c53532b50cd832dde23
TLSH
T1AEA0047055C570D04454405DC7453F100C55F45503540014115511C1D50C4474550CF5
MD5 SHA1 SHA512 TLSH

Submit Download

RJKOXH.exe.bat

Path C:\Windows\SysWOW64\RJKOXH.exe.bat
Size 76B
SHA256 eb19c9c099f3d4027a8b91a93eee377fde471c4dd5c7da5dd81ae1b4301b5a3b
MD5 01f5bee8845d23cc38f7653078195a95
SHA1 67b05758d1ae1e0db8a2cfa37ab99a988be200e0
SHA512 6c6633296e2dc414d4a3726a1e7b77a9b1bc28bfacd29c19acee2ab38f62e66471815ccb4649926825b34919775ab5621da3476255ad9c0222757735f3018025
TLSH
T1E4A002380AC3A8F888244C6DC34A3730043AFC4A239308201397B0C2E08446B8E30CBA
MD5 SHA1 SHA512 TLSH

Submit Download

SAWUXSR.exe.bat

Path C:\Windows\SysWOW64\SAWUXSR.exe.bat
Size 78B
SHA256 1445062db83c27db10c2d3c738eef21506f3f7038effe5735729ed6ec1b31b4b
MD5 66778c8c5fbf913096a4e45308ad25fd
SHA1 c769d8ad8f3a654182f543cdecc20dd558eb1358
SHA512 fc24e720a024c7a9bf301b82e2d40975202079ae5008f2200124ec5b325370769afb4ab2790b54418687c9d42f51535a500938969116aaa444e454a5a1682644
TLSH
T160A002308AC120E8A826C06DC34EB720042FF64A8310802A13D522C2E00464F8E30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SEDZ.exe.bat

Path C:\Windows\SysWOW64\SEDZ.exe.bat
Size 72B
SHA256 62a068591896d7f2e412984ff8589f9048edc8e8e245967c6091236d7a218aa4
MD5 4f76d2c56b91c90219b3bd1b2d235648
SHA1 9c5c6591cddf82fbc23b924e8886a5773f35b0fa
SHA512 f3b702369489f123af691088044d7994994ef31bf0b1b22012061c3cd83a9b35af3c67ce96400cfc98be250216dc84b3c5ba5fe51c656164ac1fe637c25710e6
TLSH
T1D1A002320FCBA8E08826486FCB4E37A0842AF44A03100028929530C2E80444B8A20CFC
MD5 SHA1 SHA512 TLSH

Submit Download

SRUF.exe.bat

Path C:\Windows\SysWOW64\SRUF.exe.bat
Size 72B
SHA256 026daf3b1250e4ce8a7bc1773756bf28e8aace7b05b1748db28aa4b04fec9427
MD5 9e780d2c705b2ee9e8a4912e30a6dfd7
SHA1 a1f81c1547eca43bc949d41febb2b4afef1125e2
SHA512 710a6cd35421f97746f7b68e463a566b31be1143cc04994c935a81d3c52cc088fc090a54ac78aa92af12855cb56c572f9a70a682fefe03c873bcbe5cd24a132b
TLSH
T112A002300EC930E0CC2C406DC34E372304AAFCEA031008209295A8C2E02444F8AB0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SSPF.exe.bat

Path C:\Windows\SysWOW64\SSPF.exe.bat
Size 72B
SHA256 17bde0ee8ff6f8c98e4f10e47c53f5f534801ec3dfe750dffef6464fd3ea5078
MD5 dbf9f66231d35a71d716d34d89d86806
SHA1 e92a4332fbae7ff0ff2717db63c24f90cb8a49f3
SHA512 fc0072a9d1679426fe9304619856977a0030e686280f79763917f5ed39939ccaeaa18505d1885bef010d4589dcc8a818aa69c80bd80a0dc2973c5ce7e5593ff0
TLSH
T1B4A002300AC130E08C24426DC36E3722042AF44A0B10002012B520C2E0A444B8BA0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

TGPRF.exe.bat

Path C:\Windows\SysWOW64\TGPRF.exe.bat
Size 74B
SHA256 e3b6588d1e22136fc7a63424d7e7c7dc888202967fe336f9428424c892e9ba42
MD5 7850fb3b1d1f5fefc983408fc5f356a7
SHA1 be74871a67309fe941b4e626b210f8c85b7fb494
SHA512 bcd6a4820898eb16eac6115af15f89ef174a54ba89fda9a9c6c6f607345fc851a10884feb37ad4fad764ea496390da1ad601d56dec65177f44b47991c3387363
TLSH
T129A002300AE932E08C3C48EDC34A372204AAFC4B03102228929520C2E00444B8EA0CBE
MD5 SHA1 SHA512 TLSH

Submit Download

UDAEVVZ.exe.bat

Path C:\Windows\SysWOW64\UDAEVVZ.exe.bat
Size 78B
SHA256 260d7622c5885dc394c254c5f2278e76252183bab04ac91b29f8ca45fa0565ce
MD5 d3e98476409ea0b669d641e761777a7b
SHA1 373f65916cd1029997fbe105b643056d254e0fd6
SHA512 8176eca98c623cb9d9153b2c366d6ce7e6914f90ec9a32beac68098dee8c4d1cf796269abdfe5902853c244cde5555843e0c89c4887541e538929301c638a0a0
TLSH
T1F9A0023A8BCB22F088B4406DC34A37200C2AF4CE0330A2E0B29520E2E00444B8A28CBC
MD5 SHA1 SHA512 TLSH

Submit Download

UKD.exe.bat

Path C:\Windows\SysWOW64\UKD.exe.bat
Size 70B
SHA256 9405c66a75a1f2b1c4b3af6847b43eea631f9358dab59bc33d56d085c49b2f84
MD5 833bc6934542803d08049a05f2e70909
SHA1 b7af9aafe9e61b80d853f286e17b090eda16f9ec
SHA512 1b00f0975aea051cba0bc1f54c9c84b5a39ace202b1b05775c192e0903ead803cbf48bd3b4c11382a63450e52274555b461ed73169c57a34edc0fa8283c6f489
TLSH
T103A00230AEC1B0E08834486DC34A3728042BFCCA0B38A03012D520CAE00C44B8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

UOQR.exe.bat

Path C:\Windows\SysWOW64\UOQR.exe.bat
Size 72B
SHA256 13007b44e1b953cb42591abf311d32d2f9e2ef9d97f16e654e81ef952bcd2bb6
MD5 8e539cfbb15b1ae6f1c33edaf000da86
SHA1 d263fa111bd37bdcfdc506d7b7d1684454e75756
SHA512 aaef482634d0d50d10ed35678d043e2f0f38238deb5a9c53b6d3a6c4c79ba7acdfba674be50f6ff8d46e778b28788bc59122b14f89a5bbe42a8d00706f9eacf7
TLSH
T1FAA002300AC328F0882C407DC34E372004AAF4CE03122020329528E2E00444F8E30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

USUTUPT.exe.bat

Path C:\Windows\SysWOW64\USUTUPT.exe.bat
Size 78B
SHA256 70a82ee044f0a8624a1c0c8f2981a6d46b76d7f2bd1e5387aef69ec4d96e1f2b
MD5 00f1aa3a6d64e2c51eef22b50af441de
SHA1 453bfe0f4d25f58038226b2c410d2f95b7ca9a18
SHA512 eb5bd61cc8afbfcd7439d208ea636133fa6ba04373a35ed8af9eede6f55446b9865241009438fe8a80b94a984d89e115c2fc836804b157f959e7667a8bbd282f
TLSH
T17AA002308FC1A0E08824436DC34B37E804AAF7CA2330232032F720C2E08444FCA22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WALAM.exe.bat

Path C:\Windows\SysWOW64\WALAM.exe.bat
Size 74B
SHA256 9581724646e0ff4e62062fc434a5f8b69c56c96742db6205f4e76d84be5199f2
MD5 426da0eee83ca941d7e6cac577b1580a
SHA1 1c6de184a84ba26beae78286957308287358750e
SHA512 a9500dd40307462465b0c14c4b02137ec1a150eb419d14580515cdb2a74f376c119ae46597fac7d654f5d4c8fbb9dba48e34faa3bf151bfe218015440faf3041
TLSH
T15FA002320BC123F0C8A4406DC34AB7200C2BF44A03302820129D20C2E00444F8BA8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WOLBIXQ.exe.bat

Path C:\Windows\SysWOW64\WOLBIXQ.exe.bat
Size 78B
SHA256 c297d0c5542fc8daebaae7b1d79a0baedddd222474630332c0bb8a2a3d069a15
MD5 01c216f69f388bb019940dfb97cf0559
SHA1 670c75a56b2089407ecc37d58e7cacb619792f13
SHA512 998a19ba6206bbaa5af053090a3c2bfff1339ea78b43c4b57c85eb7f9f345caec74d09b6f5ac833b88096a3f768716086552df0f15a118930f81a7b74c0c534b
TLSH
T1C0A0043515C110D1C45C405DC3C57753C41FF5CF03310030155510C5F0145474537C7C
MD5 SHA1 SHA512 TLSH

Submit Download

WQGUHAZ.exe.bat

Path C:\Windows\SysWOW64\WQGUHAZ.exe.bat
Size 78B
SHA256 1610e92dbbffa6252e9d4c8ba36f38ac67bd4221e53d86e95cf1c755b4480509
MD5 4106be12671f2c9c4dd9835f429c5ae3
SHA1 fad5f7cf8dfde5ffbf6679470402bad78449619d
SHA512 0d1235a75cc6957e5e9b9a844b3c7ac1983a70d93e81b4c93a752dda89d40113349f95084e482217c7994ce7bb6067bc375ef8441d9e689a6be29d60c0ea81b3
TLSH
T192A002330BE3A2E0C8A4406DC3CE37320CBFF4CA031020201A9520C2E00446B8B28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WWISFD.exe.bat

Path C:\Windows\SysWOW64\WWISFD.exe.bat
Size 76B
SHA256 4b80d9726ba018990d8d0fd8c7096bf68131bbe2f4e0a5296cb00cacfa009dc3
MD5 7ba0b6acfc31400282ca7db5b55a6f22
SHA1 2a169d6ebf5728e2b14dc7da22e425fbfe094fdd
SHA512 bf0a9e6f378be7ea6e5ee22dac2a46fa6f3d786c3ebefa834392b81fe06f50f4356b2554846cc195139b7cca4195ddbc7772c48a80d9623cb2127073be7c70bb
TLSH
T103A002B30AC1A0E8C8B4406FC34A372004ABFC4A0392003032D530C2F80446B8B20EFC
MD5 SHA1 SHA512 TLSH

Submit Download

XOAVBM.exe.bat

Path C:\Windows\SysWOW64\XOAVBM.exe.bat
Size 76B
SHA256 76b28c47ce6288efe29861eb41800aa9101a2915323834e96f27f24ad3b60cd4
MD5 57f5d0f25b98fd3808d05124c5d7a891
SHA1 42ba7d344956b74102eed91592ce8716368fcf39
SHA512 400aca8b2043c1289795128f55245a40f03099ced101ce77efc8d6fec1769a8aad48123013c5b45feb0f7ed4a271ea0f26a954d28b439ee961f261951fe00c11
TLSH
T1A5A002300BC3A0E08826607DE3CE3FA804AAF64E23100020329520C2E0346CF8A30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XSHB.exe.bat

Path C:\Windows\SysWOW64\XSHB.exe.bat
Size 72B
SHA256 ab09066077c3eabb3f6548660ad7ef1f5bc7476bcd83e5166f926a0e3988827c
MD5 025c57e63e4ef5d974d8a4a1f6f0eb21
SHA1 df460c31b4b96f86a725093076cf5b78d28c4b23
SHA512 1c5986bbf753ec94910e7a007964f134bef0308f2b62e123040e25f3cdd0bb41f9388f0068bf7bfa7207d459a16e5e9fae4467401d8844ec6f0fd96a17468fc0
TLSH
T182A002300AC120E08824427DC34E37A2042AF44E03922A20329528C2F0044CBAE20CFC
MD5 SHA1 SHA512 TLSH

Submit Download

XVJF.exe.bat

Path C:\Windows\SysWOW64\XVJF.exe.bat
Size 72B
SHA256 330de39bffe9632f8fb5e9dddbeef17d04ce58e04a9d14c5c88b8f8618951597
MD5 e169cc0f59b2a7b7aa5b95fba07d7432
SHA1 b60e7ebc149e303822d661bfd244addad9654132
SHA512 ab16548f4897cd182223a3842f163e3b347b9a6c7b0997a0096a6d65af557974f7569f558b12dc025520582b94193c332b74a338f374d14d1841911d05588b57
TLSH
T1EEA002300AC330E0CC24486DC34E37E3043AFC6A0B1000201A9538C2E0044CB8AA8CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XZD.exe.bat

Path C:\Windows\SysWOW64\XZD.exe.bat
Size 70B
SHA256 af68bf4ab152e83d132c6d6c130b8bb9c97f86d96bf0d6c02f708aa11b6a6153
MD5 7beaa565391859bc28573f0dd5c2ba7f
SHA1 29deb1c5082a5b4c78871c262fe32dc32e648533
SHA512 4bf5b702f25e12b440878c9f960a3efb7f233199f12ec3b279de50ed87d1273810ecea00b8f9c0d7f50f0c126505b16ed9d6f316729aa6f3b6db0fc53607ad0d
TLSH
T13EA002300EC1A0E28824C06DEB4E37A2042AFC4A03100030339720C2E0044EF8B20CF8
MD5 SHA1 SHA512 TLSH

Submit Download

ZPDQ.exe.bat

Path C:\Windows\SysWOW64\ZPDQ.exe.bat
Size 72B
SHA256 36888fd4e386ae91a7740200001b44a18706f321a111f3a16e407490e4b7722d
MD5 ede59bd462e6acbe9a5ce611dbc21e35
SHA1 5b4f614f3cf23ee790483f74483c5015be1b34e4
SHA512 c90f74d403b3b4f14da1ba273d547e388ed2a45f5cb9660b9fce7e74f003e2a26d24b8d15b003c3a2c576797c322d11d03526eaf4c6843513c0c3b99fca0bc08
TLSH
T13BA002320EC12AE088A4406DC3CA3730043EF44A0B3000201A9520CEFA0444F8B30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZZO.exe.bat

Path C:\Windows\SysWOW64\ZZO.exe.bat
Size 70B
SHA256 be1dd6d3496851ca5818aa622a97883df2e4e05d68faec0f8d71b37368c4e5a3
MD5 91dcacb6ba244a1b5b5b31f840d9e3c2
SHA1 46927870bf312a1d5318c11114815deaf01342c3
SHA512 6e20e4c8185033a3259feedec27d2e238966322246a4ee74871db708825b012fee00d261267a10ca724ea85c6016ad29f42047bfcd8309128e78c6e8c9fd6956
TLSH
T163A0023E8AC123E08824486DE34AB720043AFC4A83120330139720C3EA0464B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ADHS.exe.bat

Path C:\Windows\System\ADHS.exe.bat
Size 68B
SHA256 d51cc96127b96ab623ec785e204fcec14f9eef28a774e05321888a240771f40d
MD5 46d0470db1442623d5414b878239e69c
SHA1 52936bc573bc750d9e7b96386929b74e77592223
SHA512 65302b0f3ffbbc78d3998bb9ce9965f526a8e5baabb131fa9da8b6819d47f5dd7c765e5a628847031c51f2a897f9a2d545dd2964795e07793d3fd1875d6f57e8
TLSH
T117A002300EC3A8E28826406DC34AB7000C2EFC420398002812D7A082E00E4E38B288B8
MD5 SHA1 SHA512 TLSH

Submit Download

AOSXXO.exe.bat

Path C:\Windows\System\AOSXXO.exe.bat
Size 72B
SHA256 495210c60fe764aec0df8295cff802b02372460abfdb2a9d6cab131d5288a7bc
MD5 917c64c2af45059a0ff7f998767eaf24
SHA1 4d4b714e5e459a0c5ec9073565394431c2530327
SHA512 16584421e6bca125e847ea024adc90dedcc725d1eaf75ede090f505bfec839e7a87493af333aa6f2ea301e510c652353ce22d49d8503a1b64f8facc9ef0d8294
TLSH
T1C8A002380EC322F28834427DC34AB700042EFC428B10202812BFE082E00446B8B208F8
MD5 SHA1 SHA512 TLSH

Submit Download

APVVL.exe.bat

Path C:\Windows\System\APVVL.exe.bat
Size 70B
SHA256 36a4b7abac9bfe34430e37ba13b92cc91057b5c75c99bd7857723706e985ffda
MD5 c0c5e04f550baeb5ef8250adadaa392e
SHA1 9f8461ec80a9c013deb3420355b39686621c0140
SHA512 635c7732b983eb9cc58620723d15a813a6dcc139999d1ceaa6bc2b7c12a538ebbabea361084aa7e9f4023dbd08e498c3bdb5b9eb6ab20d42fdac4d4f441a87ff
TLSH
T199A002B88FCB20E28824C06D434A3720062AFC4A033200E812950082E00C4638BA08BA
MD5 SHA1 SHA512 TLSH

Submit Download

AQQNRVA.exe.bat

Path C:\Windows\System\AQQNRVA.exe.bat
Size 74B
SHA256 5138d03a4660c2b7ec9a510b3e6ac39a39ba578e6cb65c47ce12f92904b865c3
MD5 cd640c78aa6174c4039845ec78d5e02b
SHA1 48704593a09fb0251194db446fb5ca19d02194c9
SHA512 00b6b968d938733c1e4299fdd17884b832976a227bd695128ef1581f43149a8cf5f17988f6807fca445e4c8ab2deb017752d7d0ea48b29633f6cc83b5f9f7e08
TLSH
T197A0043D0DC314D14D54445F43453F104C1FFCC503300054115D1051D105C534750475
MD5 SHA1 SHA512 TLSH

Submit Download

AVQ.exe.bat

Path C:\Windows\System\AVQ.exe.bat
Size 66B
SHA256 b3ce207e5c27e86c1ddee1f2b687ba038c06d97a41b97f250a61ce03ad963fde
MD5 31127275605c969c5d1e4fecf9cc95a0
SHA1 abb5deaaa812f39358453bdbf98488a5eec1f270
SHA512 6760a03265c4a9214a3da2c8b63ab5ff37075bf111782f610c79c65692aac5da85e9bea1947d06867c71787077810306440e803f05d05aeaef4337000b2b2b50
TLSH
T1BFA0023A0EC328E28824406DC34A3F20042EFC4B031000A89A95008AF0044638B208B8
MD5 SHA1 SHA512 TLSH

Submit Download

AXMJLNR.exe.bat

Path C:\Windows\System\AXMJLNR.exe.bat
Size 74B
SHA256 6ceee0245b3959ad5bc2196bff4b232f110e4d33f5a240f9f5abc9a853bc7ea6
MD5 a980ff2fb1d679398abe652dfabcd071
SHA1 64d61869155a920f5bddd8cf6c0d91c73d7345eb
SHA512 089b58d548b1fbca05e5e40cdbf23461555ec4c2930edd3af60c931c98ac0db87e026609c5502bfe6844597af79f9e7a7bde9859933ab18107ff47f4588b0c88
TLSH
T137A002B00EC320E28C2440ED434E370824AAFE42231000B8129D808AE28447BCBB0ABE
MD5 SHA1 SHA512 TLSH

Submit Download

BME.exe.bat

Path C:\Windows\System\BME.exe.bat
Size 66B
SHA256 a8effbe9d729263b8f9fe12751948a886f834a4a47a1a361fbab0dbedf3d2ef1
MD5 899e5b6e55b1f689becac1c35b6dfacd
SHA1 2bc1ac02f0be43d86ffff7ba381810c1b3c14ad4
SHA512 f83c7ac190e85873533e44ae7a05e284537932c65f8cdbf0134b2614b931f400a0b44ff1af314e023e17d952223d9e8e4ef838099323b32492f982818fd95031
TLSH
T10CA002308FE320E28A24406D434A3700042AF442031A802012950082E0844638A20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

BNYHDK.exe.bat

Path C:\Windows\System\BNYHDK.exe.bat
Size 72B
SHA256 a2fb7fc7d412f7c525edbde3bd6075f520bd7b41c84f7fb384ba93f7b8dc97fb
MD5 026ca26a0fa8ef78f622ccdb2ac23e07
SHA1 7f87e19379281fb5d6ea6215aee3b26a531e04f0
SHA512 e8a5ed01836c6957809c800456e101758303a5f87c9f6c5c1489cbea791314e7b5b574b1087a7da3e7561b2131ec960b9c99b3517ac6d7c3cdd509ca4442d26f
TLSH
T17FA002320EC128E28C24406DC34ABF88262AF462231C0020129D0883E00C4638E20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

BXGIRO.exe.bat

Path C:\Windows\System\BXGIRO.exe.bat
Size 72B
SHA256 fca7865dd996a2478076980d66f91e5458859197349f60285ea0419d8c1284d7
MD5 2ea4fc5b0683a56911dd73a3e16a3909
SHA1 63a3633d2a5887d05c1ccda19ad067c411b02e6f
SHA512 9b8cde97804e44b1063ed272eb3925e4c99bebc8af2970a7071a3b57774d7d9b247806df253f6281f28f30f36550a480d5f23f91c0b73b4c5f97dc556ec09ee7
TLSH
T1AFA002388EC122E28C24407D6B4AB70B0CAAF4428B100228129D0BC3EC0C4738B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CBR.exe.bat

Path C:\Windows\System\CBR.exe.bat
Size 66B
SHA256 9a75e49e7655e4175f9e292bcfe50cfff27c5af54c64afd9a65ea8993165b86f
MD5 7ce1e03e74bebc02f7fa458c6d106b93
SHA1 8d77ab0dddaf15a6bcf91ae80d6def7072352718
SHA512 c09f3a9698897e4430b89ca075ace397bd41a9414a011a8c09e4c62987f65e9ff6b534556a72cec3a0e59f9820c6a885eca66f3e59c713526583a133dcb8b33c
TLSH
T124A002300EC1A0E28824606D434A3F00042AF4420310022012950082E08446BAAB88BA
MD5 SHA1 SHA512 TLSH

Submit Download

CMGBOZ.exe.bat

Path C:\Windows\System\CMGBOZ.exe.bat
Size 72B
SHA256 bcde8ac4ac62f7613c611235df2c5dbdd35c20c0fce5f09725908495812e0cc6
MD5 29328e8ce19c6fc4a4fa15742764023e
SHA1 b97e72b303dcdef4d467d879c62d240971a704c3
SHA512 34b508e9441f079404f545e8cbb1f461965adfffd872e56c8ac9a4dfce81fe0c7bee49ec34e802e9353247729c6465ece3e890e913d3886f5f6970dfca827791
TLSH
T141A002328FC320E28834E0ED434A3F0206ABF4C2031000381A970282E0044738A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

CVQH.exe.bat

Path C:\Windows\System\CVQH.exe.bat
Size 68B
SHA256 25764fd1f2421ad884deb56f36157c42a6d02fc1cd80b9b4b905102a46af353a
MD5 9fa4b1608145c33d258517ca110582e6
SHA1 64ab953c2ea4092a825abcf5fca7e169f049fd4a
SHA512 1d4a535305c85949038752ff0fed19e2a0188e63772ab5c8644fffe8566feb392904d72819d5b8643365abe3c3ceb551c5209688ac232b64f0d1f58fb31e1e88
TLSH
T1CFA002380EC328EB8824607DC34A3F20062EF44303100820139500A2F08447B8A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

CWR.exe.bat

Path C:\Windows\System\CWR.exe.bat
Size 66B
SHA256 4a3a058e3f72a14b03d62f1d85d1449c87c4c48cce0112bb23508030864cf87e
MD5 a8b921aa3d51e203ba64a1eae778817e
SHA1 91b671ff5a6c5785199c3300f5f15de2751956c1
SHA512 f54ad954bda2ed24f0e3625d02ce8887612503128f85dcd07d11f46fd6864e06c3c2fb117e2859cd62066b106f11411270bc7b6d289eb8e76f4251ea1fd78142
TLSH
T1EFA00230CEC120E2883460ED434A3F00042AF4420318002012950082F00446B8A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

DAOEE.exe.bat

Path C:\Windows\System\DAOEE.exe.bat
Size 70B
SHA256 d153d127861fed7a56929b912954ffff6830b96210c49ab76801fae1c94eca84
MD5 0f1a20091bc6a2c0cfc558f0c213dd52
SHA1 45d9be9038b4ef3ecc257cccd8c01a07eb7d4607
SHA512 3ccd4b12ea75dd1df8e478f3614861e6bc8b6af4876fb7cbb44223fb817224603390b5a6c41356305551bbc068d81120271abb55b1e1a44f668183daa4a0de97
TLSH
T10EA002380EC3A0F2C824406D434A3720042AF4422313A0301ADD0082F204473AA388F8
MD5 SHA1 SHA512 TLSH

Submit Download

EAEOC.exe.bat

Path C:\Windows\System\EAEOC.exe.bat
Size 70B
SHA256 f8ccf6329f78e695506d3aee4042ce7b3af1e804f69cbe54e4e02d6cd1961927
MD5 2aa5d324018b544446a2661ea405c505
SHA1 a57b74453029f842c228f97fcce05037123ccc69
SHA512 2da4aa01dfcfd47734b1940da3281623c97d42a28f4892f87e6ddb2fd0714c78ff01606a0d41361135096f52cfb2f024fab3f39f7401f56fc84c2c6504ac8e7c
TLSH
T1AFA002302FC120E28824606D434B3F00A42AFC620312203012DF808AF0844E3CB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

ETHVM.exe.bat

Path C:\Windows\System\ETHVM.exe.bat
Size 70B
SHA256 b089c1eef5a58255c849e857defb868fa67f21e76b0acd6bf90593f4f7104fab
MD5 8a1a90f44136dcb423b90746009606b4
SHA1 301f77f9ad385e89d3d719c556d94160f9236799
SHA512 7e3f5d811c90843e4e8ea5419fbeaa3e109efab6054a080646c85dc8a90965e9d4da89f011932b80341c4d492998c52e042e7e761f3b126c08363611798f4790
TLSH
T1A9A002300ECB20E288A4406D434A3F000E2EF44A031000A012D5208AE28446BCEA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

FEBD.exe.bat

Path C:\Windows\System\FEBD.exe.bat
Size 68B
SHA256 ac6c779ebcaeac81ae204603308b53810a74c75137299f80a090ab8c61ed7010
MD5 6e8ebd08a672f6e692fa00fd6a2298a4
SHA1 e5e97ae0ee6b64b3a709e3800404ceafed4fd9ea
SHA512 5b505bdcde0daef6490912447864d9bb6e4953a693f8802b9351630555629e9f6326e4d666617c44c9c67a81096cfca03728d8cec545dc890ddd49779feb0e3d
TLSH
T16EA002322EC1E0E2A834407D436A3700043AFC4A0390083012950282E00C4638BA0EB8
MD5 SHA1 SHA512 TLSH

Submit Download

FOLZSWI.exe.bat

Path C:\Windows\System\FOLZSWI.exe.bat
Size 74B
SHA256 2450a6d8628b379658ce546c0233e1cd589791662bf93fc21c049a3b0f2b7aec
MD5 60e40d0438339b6c972637dcf6e981a9
SHA1 635449cd8be4b43f61a8f43f8459a6144ca23465
SHA512 6795b12bdb6317cd6c228292193f207f1933fd05266959152d31680cc4856c97ddfc2805e4811288fbf401d907d10aeaefadb58428d381512fa9d4071d783151
TLSH
T1BDA002320EC322FE883440ED4BEA3F0204BEF44A031008203AD50082F024463CA20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

FRTEW.exe.bat

Path C:\Windows\System\FRTEW.exe.bat
Size 70B
SHA256 0dfec4c9671c373eb6f5b1e6edb0603394e5f994b9f5cf387382bb4d331a323f
MD5 eec613b0671e33c6b57c6dfb4c5ca5a3
SHA1 7ba3cf51a1a3dae1e40da4e74f66a8ec76302676
SHA512 e418e160307f4c8c509f27948d048f5324042a5efe552f9dae242b48c0ad5d9ae76947fb86f71581ec08458b826920c66d4806954defc447346e4e4d0dfba16a
TLSH
T115A002300FC128E28836406DE36B37A0042AF44A039008203ADD00A2E0244738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

GCWHGF.exe.bat

Path C:\Windows\System\GCWHGF.exe.bat
Size 72B
SHA256 062f2b661a3998bec5bc100cfde5ee0f677a691e16480edf932b33155278a844
MD5 fb2219cc3bab263f03e4be0823e285c8
SHA1 f7d9845d4572c78aceb6033df90ff3289cb3a02a
SHA512 5251c4cffd4c0271d20cc55f2ef9e7499d683dbcb3785156fe6662a81b4feeda2a869749e71c8431213dd8fddc6c784f58f6eaf72a0e65a349a8f8a407b09349
TLSH
T1E6A002F02EC130E288A4406D63CBBF0206ABF642031000203295028AE884463CAA0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

GPQTNRQ.exe.bat

Path C:\Windows\System\GPQTNRQ.exe.bat
Size 74B
SHA256 146623d47d929ad61031c944fa62cb84b43eda30a225d5673ee7130145bc907a
MD5 ed200bd001d7af4f69b37ee166394dbe
SHA1 b61434ec60d8659ad73666857b7d915a8ef7a54d
SHA512 9343d70bab4717390499e6c2e86cf0af77fae0147c94ee36eb5f60eafa4fba709b9d971844197576454acc4bc2225f1dd3a85e7e97d55c5a776fbeb4dc26ea79
TLSH
T135A002382EC320E2A824406DEF4A37080CBFF44A03B082381A9520EBF0044E38A208FC
MD5 SHA1 SHA512 TLSH

Submit Download

HQXEWGZ.exe.bat

Path C:\Windows\System\HQXEWGZ.exe.bat
Size 74B
SHA256 fbd846e6516a5d3f080778df533048478f78deacbeafa69a84e222c180b4240c
MD5 c8ffa2281181417476a1994a284a7043
SHA1 af66fb42fb508ed20a16285018b48a2a69d7c03d
SHA512 568df079e7f98688c67d780676e77c10187782271c3f159d1da71e6224914996d5925c0452f4c23ac948cd16ec9c181b0fccb68b4dc77477bf5f3b7cd07ecc14
TLSH
T102A002328FC320E2EEA640ED436E370824AAF46203100A20929F0883E0064738E208FB
MD5 SHA1 SHA512 TLSH

Submit Download

HWMPGBH.exe.bat

Path C:\Windows\System\HWMPGBH.exe.bat
Size 74B
SHA256 e8931a1f94ea5f8e890c203027284e7ce5580351c81fe275e84f61332f7ab515
MD5 72e6393f4a016797b0af063d2cd68bbb
SHA1 24bab611802737347ae0a349c2cdb767a8aa2319
SHA512 b3358e72e6b1790d06cef5b898002b0bd39fae4454eaa6fef76cb81a26984dfcc2b5849db55517ea745c9c9c36bcdeb645cc705b7e0cff0a6c316fb1b74d09b8
TLSH
T143A004300DC150DDD43D40FD434D37104D15FC4107150410135F0045D0444F3C554574
MD5 SHA1 SHA512 TLSH

Submit Download

IIGXEV.exe.bat

Path C:\Windows\System\IIGXEV.exe.bat
Size 72B
SHA256 837b7f3bc3f7fc7406d6c5243bebe56a016107d0879c58d7f8ee7b24caedb1b7
MD5 67d96035065c565984c9f97434708d41
SHA1 9d7ee276067e6c97fdd1c7915eb9884b5466a74a
SHA512 265650c22e97e24c8fca893b01dce7bebfb1c6304ae1b2442c1592de935a52c8d8adeee46ed547602aff1a2470464da398cc454f845a6c97f5cc2678946dc55f
TLSH
T192A002328EC1A2E28A2440ED4BCA3F00842AF4430310802A92D52082E30446BAA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

IIOW.exe.bat

Path C:\Windows\System\IIOW.exe.bat
Size 68B
SHA256 751a52659fd9feef94f75dd47f0eca6f52184d2a5e44062f8ea48ca31e686013
MD5 e05c247765be88b49b6006208390beea
SHA1 58534fd1f89906a7b5e4e595e78f99bbcbe39f90
SHA512 9916e4523de3c9f3074d9d0e2434dcbf6b47974537dd38de0c9790a0748fd33ad7dd8f014ce1ce28847ebfbcc9c195f87119d7f4034e8f32bb20bb60fc44d5c1
TLSH
T10CA002B08EC1A0E28824407D434B3700042AF44A0310802213D720E2E224C7B8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

IKPNV.exe.bat

Path C:\Windows\System\IKPNV.exe.bat
Size 70B
SHA256 8e5afcc80f22b24c8e206c7f4f18c35f884e4d7e38cc9e66fee4a10a6981da0f
MD5 979b9bd05bcfd3765a8bcd08196ee96f
SHA1 51232f580241ceeff5c756f78b4d922ce92b29b7
SHA512 043882d533271cb40e20a58edf9ebdf02e9058999488d466fbd19ee499710e7e9e468593e9a8af6ce28670acba4d0c9e9662b8a9efd9b442d4b92d3cfc07c9fc
TLSH
T16EA002300EE1A0E2CC244E6D4BCA3780042AFC620310082012D53283E0A4EE38A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

IRBLNV.exe.bat

Path C:\Windows\System\IRBLNV.exe.bat
Size 72B
SHA256 7e3ae6262c22bb2eac1a13a6592a2da6193ad0df838eefed304953f1dec6862a
MD5 5f3e3d7932e92dc71b7c70864cb3861d
SHA1 dd53de14313db6cdb95a611e3aadf308a743bfbe
SHA512 6c6038f8eb841577002b364a2e84538d60c23a13c85b76711fc6d8e0899599a9b6e9b2a702cf57d93a228570d692245318b06ec8420e77b2d40db80e7b10d02c
TLSH
T1E2A002300EC1A0E2882442EDEB4B37A00E2AF443031000A012D520C2E0844638AA2BBC
MD5 SHA1 SHA512 TLSH

Submit Download

JTNW.exe.bat

Path C:\Windows\System\JTNW.exe.bat
Size 68B
SHA256 0f474cedfb08c5caba1b9230a702791e0a7f241bb6d99b2feadfe07cc069e7a7
MD5 f359d9b53bff674b9395f7f60f3adcd9
SHA1 44a2db4c42f8cdcae2ec146951b7bbe4cd83dbe9
SHA512 2b2b099e0ec25ebd8a479d0e3e87573d2cdc8f21e92cc03911dbc30125907beaaf420a58df01cb99394546681aed7f962278ac895f6604d8b398ee976fd2a143
TLSH
T10FA002B00EC920EA8824406D434A370A042EF4420330082012FD00A2F08447B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

JWPZQQ.exe.bat

Path C:\Windows\System\JWPZQQ.exe.bat
Size 72B
SHA256 4cbaa6be775c44d9e0b8da275dc741c3e7b6d3e4dadd63ddc2a8b35aa2ff8bf7
MD5 7febf0a44dc01f41f07f348078cd2abe
SHA1 07198d00ae960e87b66b818c30bf6ce887247791
SHA512 376e28324a5d10bc0e620f944a8b85a9fb466b2071b384f4f077cfeabfe2e89181c36be252800f9701d4e4d845b34f256283c08a09f739c8f8ea397ee0696a58
TLSH
T143A002382EC128E28C24406DC34A3708042EF4420330022A9EB520AAF006463EAA8CBA
MD5 SHA1 SHA512 TLSH

Submit Download

JZZ.exe.bat

Path C:\Windows\System\JZZ.exe.bat
Size 66B
SHA256 cc4421eb2f118d6669e35a2d567587fea2ff681cae2043e1124ad0923ae4bc8f
MD5 b042dc0e74df616fc62f55bbfdde9a7f
SHA1 2b2e0b81683b4eded6c786c913327f7be13e8df5
SHA512 45db85712f1f2cc738d8c8bda036c304597a874fc5fb969e1dd0cebac28f363219c28a0b1a2ab1b0020e491e262ba05b82ebd43c699ad57e7f70ee562c56b0a6
TLSH
T1A1A002320FE320E2882C407F634A3788242EF4420330002092B70082F006C63AA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LQNNOS.exe.bat

Path C:\Windows\System\LQNNOS.exe.bat
Size 72B
SHA256 f6937578a4872d4f1b9b469f84ef7d28a30e8faa908c8ab288bdcd3fc1410146
MD5 fbcc2052689a3b770ab0638a37210b3f
SHA1 4727312a095dbaa8bca6dc09295edfe7541f63dc
SHA512 1b726467dd3ae3d04d6687c31aad8afc37dd2abb7f06e74dbb031fb83eb1266d5ce4a7334800ae0265f86a9a15a7ecb2ff32ce2a9ff525766b54af1cbc7644dc
TLSH
T124A002300EE920E28A2440ED434EB7A0042AF44A03F002B012978082E00C4638A208FA
MD5 SHA1 SHA512 TLSH

Submit Download

MFGCZQ.exe.bat

Path C:\Windows\System\MFGCZQ.exe.bat
Size 72B
SHA256 ad800e079942b041bff510457d4e4bcf879a1f5b4e41ea4eb63ea10e97506003
MD5 d608789b8a076a58942ecf2b043f7d29
SHA1 a790da6376f1f8b6d0cbd7322de36fc0c238b393
SHA512 5af44a8e73218d985a665c9476e236be1b83cbf9f3dbd53a580f5bda0420b229bdb888f04813af9b4d7e880cce1d9064d1ee8e12945baed0a98edb2f24fb23f2
TLSH
T153A00230CEC120EE8CE4426DC34A37002C2FF4420F1000281A97008AF024E63CA208F8
MD5 SHA1 SHA512 TLSH

Submit Download

MHD.exe.bat

Path C:\Windows\System\MHD.exe.bat
Size 66B
SHA256 bc366043681667647cd9d4a783f026faac9fadf01a3169f3fa558e60a3e41749
MD5 59bccf3616bc9a697ddaa89e6b1e9022
SHA1 4d1df07c66498e3a0ea089d3117c49a5f4566fa0
SHA512 a8ac141651160cd9accebf86effd6ee43784f00f1ac6323b8c77d0ef99c9d1142b7f4b3adc5d23c43e3ac089eeb7a2019168c5db32d9fa41ea21f89cb402517a
TLSH
T179A002308EC3A0EB882C486D634A3700042AFC420BD000321295008BE024463CB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

MKNQ.exe.bat

Path C:\Windows\System\MKNQ.exe.bat
Size 68B
SHA256 b6195e7340574b2d61e739e0157cf631741ace4b43ee2d902ef49705890d475d
MD5 9c2e8aa203a928ed2def7fe6d81ab0ba
SHA1 5daabcf95d2c82060327d22cbf4898eadd9e37d9
SHA512 44f30238afaf6cd091eb2fb180c285fc1aecb8f694063993a5e852e7958b4988699721fd43730926f0845aeb51ede1ca1155ebdcf344765aab384ceeb74588d4
TLSH
T114A002308EC128FA8C24406DC3CA37000C2EFC42831020201A95008AF0847F38A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

MQDWNU.exe.bat

Path C:\Windows\System\MQDWNU.exe.bat
Size 72B
SHA256 2d9c02dc018bff371379435d5777455d4ec02c054edf40615fd8d21093163f2f
MD5 dcf4ef1a13734ef3c67a49efa4d8862c
SHA1 e7f7fa1462355d72411131b22d6426b83c9e6c3d
SHA512 ddcec0da606a65d68c04c106e8bef0899b8f52d7c2ab7e6913e114ea059e4be7aa10213f93f79da1aff31a6aa8c087ae8b6f793661e20c309d94b95ca46d9345
TLSH
T1CCA002308EC320FA8A2CC0ED634A3700243EF4420B10003012958282E8C4C638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

NGG.exe.bat

Path C:\Windows\System\NGG.exe.bat
Size 66B
SHA256 063ab7301abfc468827909c9b3290dcce1e44ef9ebc36fe49e8fc0d1ebbf434c
MD5 e87770665c7bcaacbd20754a1ddbe1fc
SHA1 5e3948518d0c25965460edf0ca0bd07b729250da
SHA512 1b5432271de400221badbd71acb9c93d60f20125efbdc424deea5862200ea835493c810871b94bbdb250d74205bbfa612d259cb59ac88757bfb59a13b20e6622
TLSH
T118A002300EC930E28C24406D436A372204AFF4420392203892950083E0044638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

NPX.exe.bat

Path C:\Windows\System\NPX.exe.bat
Size 66B
SHA256 3c19c3eb9a95f914770651053e89b02e081f04991ca175176cf3440901a9790e
MD5 7d19a18ce7c5d3edecb21f0b108b0fbf
SHA1 d7c9c16c97bb0ce6a802e57cc752aa195cd7ceae
SHA512 9c1a46112e78c9d633776e99ba63f47c0463161034391d668b5bdc7e5a84cf07f107fc9016a0c99b23180ab46af957c6cf50d65f48a8d1ec784cd6e06532321e
TLSH
T1A4A002328EC122E28C24406D436A3700A42AF4C2033002B01A950082E8044638A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

NVVSF.exe.bat

Path C:\Windows\System\NVVSF.exe.bat
Size 70B
SHA256 4017122cd5b67d86206f94b1abf20e89679e5480905bd55d76d6d839d98c49d5
MD5 bd3beb26de6ce272e784c58c02706630
SHA1 fc55761dd63b029bd2a8d55b37262d85c92a9099
SHA512 809ebf7385c88a06384b61d16d246e373988937a2d75a00b429e4de39a8e44fe0ffbdd4d862950e37de80ffcd40a8bbfa27a394dcb775049204e8c419ac26b1f
TLSH
T1B5A002300EC132EA8824406D436E3722062EF4420B10882812952282F0844638BACCB8
MD5 SHA1 SHA512 TLSH

Submit Download

OJH.exe.bat

Path C:\Windows\System\OJH.exe.bat
Size 66B
SHA256 ca29fa357891a9bd9842a312d23acc8defe6c8f5e0728e9988ed8734554489c6
MD5 eec3117234a561d5dae8a9ec11b13c20
SHA1 c77f017403b9609b432693f66f439774fc3dbf68
SHA512 39abf00447be866deb64b6e6433d44034b1c4f4c5cc6389db7b9f0191abd00a3118eab5ac6af3624bc7fb3b7dd22fb8036ddd4174a58daaa09645b79cbb3fb14
TLSH
T126A002380FC320EECA2440EF437A37200C2AFC42031000201B950082F2844738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

OXSC.exe.bat

Path C:\Windows\System\OXSC.exe.bat
Size 68B
SHA256 ee3fcbeff40da64a67ea276978f0ae96e08cd8b453c60383145d156a28731ad3
MD5 99084057d8e438c3add08839cd32d564
SHA1 98ea6e1bf70a39b7f3cb9f95808c2320dc056fe7
SHA512 a4a06a9b05d1fd37768159a7e385d918a63f814ea8eeac169f82b298424af567a862b7e42c552904681792bc5ae73ff617f61f929f75636d9693046aaa185ca6
TLSH
T1EDA002B8AFC328FAC824607D434A3708042BF4428310002012B52082F20446B8A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

PBLTFH.exe.bat

Path C:\Windows\System\PBLTFH.exe.bat
Size 72B
SHA256 0de96b13a30152c160c946abfc8601012fcb17490a7819bf55d8e959ce76fa14
MD5 4b2a1c84fd501ca83d0f23efe1966dea
SHA1 bec3f278bf0129b1d9b9b9dd1b69db9b3da56883
SHA512 c8332f04615c85bba59d28dc609e26daf4ade583a9133693a7f201acbf58864083904d4ca8df631da97227cfa5cfa0d07c5a05381af9b80c25a1d88c8c546243
TLSH
T1E5A002300EC320FE8824486FC34E3720062AF442033008F01B9D00C2E0C6C738AA0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

PJX.exe.bat

Path C:\Windows\System\PJX.exe.bat
Size 66B
SHA256 71fbbd8e6c021bce7e8151bda700c6940eb07c6faaa8d1a015f80dc14204e791
MD5 a28113d3bb897a40b4b3c3c7f26b229a
SHA1 0669563fe9d97a8e9e929fce0ac38182042379cf
SHA512 e1eff483ca6132c7c3c8af8344b4e745d86845dbb051040df107de16cd0b67ac48ace5d982021e5f3585ccf9c5aabc3acc69c2b70504a023f689cdf4aa514a0c
TLSH
T109A002380EC120E28C34406F434A37008C2AFCC2031082E01A950082E0046638A20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

PPK.exe.bat

Path C:\Windows\System\PPK.exe.bat
Size 66B
SHA256 a7f64a73db959cc69a6012c44541050df0d98860d9c6b98513c52bbbb2e9047b
MD5 e90d28e340c5a5d9887904d4d8ca4734
SHA1 809422991115a8a100374a7506fd71405cd235f3
SHA512 5ec0821b99a8f20f78213f12f570f26b3d0ef7f525bcb85c98c2b2147658f7f66d90456fa16b470982302d262d87c48d83353daab414792a8dca26a9410e4efb
TLSH
T185A002300EC920E2A826406D434B3F80042AF442033800E012952083E0044E38A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

PTI.exe.bat

Path C:\Windows\System\PTI.exe.bat
Size 66B
SHA256 a9560632c2eedc5384a7f121481d204a026b88d6d4769dfb728e42ce42266257
MD5 d967da8e53e19b1041cc209be3cbede3
SHA1 285f926992e02d1735853564b2ccb7cc839d207a
SHA512 2828465dfbb5e0a9abf5d13a28111028bd62c09d7ebd8f8ef59d514613f3ba0c76192305baacf6543b9eee3d60ecf71111a995a9a0c86d393421ff0bc4a7acbb
TLSH
T19FA002B00FC122F28824406D6B4A370004EEF442031000E012970082E004C638E208B8
MD5 SHA1 SHA512 TLSH

Submit Download

QYZ.exe.bat

Path C:\Windows\System\QYZ.exe.bat
Size 66B
SHA256 0a907c3af364b744c9177cd5891fa0f3bc1462395e90ec9cb690147a33330cab
MD5 9667277cbcec3433ba801253f8fddc21
SHA1 753014129a88e6a9f9de5a4c3db9610cf7537691
SHA512 d419a301bfa7cbfb1bb4047d384ffdbba0e7e1d5880fba7508a5aa072e10e2dfb9f0407930b0e07c15123a9971fdf084d22a9f424fa486563cf08225168c1869
TLSH
T13DA002330FC328E38826406D434A3F00243AF44203380020129D0082E2064E38E20BB8
MD5 SHA1 SHA512 TLSH

Submit Download

RBJCFYM.exe.bat

Path C:\Windows\System\RBJCFYM.exe.bat
Size 74B
SHA256 5f953fbe18f5e00de74aea1c5d158146ee299e1c31dfc739f0fd49eb712679c7
MD5 81fc17412fab1f04f0765695b683a340
SHA1 64b54cbd183257955c0ed3a0c142177fda85d7d6
SHA512 7152a76662fe448b40656627422bf734d28be5bd42198fbf117cf9d276fc519a886c7a9fbe8ceb7d05cf6e5eb876e0bcfea16c648d9d83166cd37b2cefeea1bc
TLSH
T15FA002B02FE928E2C824426F434A3780242AF44B031000A032950082E02446B8AE08BA
MD5 SHA1 SHA512 TLSH

Submit Download

RGUBL.exe.bat

Path C:\Windows\System\RGUBL.exe.bat
Size 70B
SHA256 43021e5e27fb15d195c0bfb5791f20ad269350ffd91b3b9af307129d38db1348
MD5 55d734239f9dbec2fee37dff10663083
SHA1 4d4308ea43877bc75a2c59165f10c49c872ba6ab
SHA512 7bdc0d97bc69e53851e7df793be1a69a2cce0e957c5b262622a5734e0277fc803960fae5ac73d766070b21bdd91ecb097e01fd275937ed5a1f3627f26ab97ff3
TLSH
T1C5A002308EC9A0F2A824C0ED43CF3722C42AF46203120030139500C2E0044638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

RJA.exe.bat

Path C:\Windows\System\RJA.exe.bat
Size 66B
SHA256 c3209879e1b7a884ddd45c40dd0525f27d55335bc8127e465e88471e3be9bb8e
MD5 bc801a229a4e802f43fe6f1c2c571923
SHA1 c8b912f63cbdbaecd8b9277ebf51157f5fc35d55
SHA512 9953d0a7eea76d19f130db40a01ad96b0b6b1c9789e93f2f861c79b640ff3cff668c92d642e58cf947af4684b3427ef8224ddadaabbd206a063fb1bde59bbfa2
TLSH
T1AAA002380EC120F28C2440EF434A37800C2AFC42031008201ADD2082E0044638A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

SSJ.exe.bat

Path C:\Windows\System\SSJ.exe.bat
Size 66B
SHA256 ecaea5f677e260d3972fd4930a02e3f02aa06954fe4f2c37f5ab776cac47b5e3
MD5 f9635de910b676ececbf574321e984de
SHA1 27545eb64990ca9ef62a7cfdc215cb1871b8ce16
SHA512 381cf9d5b288485905f5ead5977a867f6b07bd3ae20b9af9796a18f74d5fb81835c0f3f5b567ac2ce57223ee35affc67b10e3eb7d7fb6ba5e252504964faf551
TLSH
T14FA002300EC1A0EA882440EF634B37008C2BF44A0310082012B50282E0244638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

SVC.exe.bat

Path C:\Windows\System\SVC.exe.bat
Size 66B
SHA256 04932eca77398283afc2905c9dacb7d4c864cf935afa0b155070bef50e8e1622
MD5 566a409694fdefceb6f3e9f7835c4a27
SHA1 6994a27aa176c64ac7b644b3ed550a367c633386
SHA512 5ed990575e0e16c11fd9b9c6a707cda04240e7f879536f2398384ac0c76f7b2c0210a32af24b0f6738f061fff2c1502a5a65026c0b3f0c4dbea3b2f55e99b0d1
TLSH
T178A002302EC120E28824E06D434B37002C2EFC4A031208A012B50082F0044638E208B8
MD5 SHA1 SHA512 TLSH

Submit Download

TOTOCXT.exe.bat

Path C:\Windows\System\TOTOCXT.exe.bat
Size 74B
SHA256 87e010ecf8f492bbeb65b66aa6df85deba9f1c045d7ef00e1685760dc6afd624
MD5 dee55fae37831df4b4c806fe6898578e
SHA1 848b621289f403d27a1b5e7df0acaa013ab5f1cd
SHA512 0333017d62c3159ccbe5b7da3f29cbc67847c7dd57053a9fe73cbf859ad43abd0e8cf770abf45a96e85ab0ae835a89cbd4a0f64cac8402927ed773c23ca3b5cb
TLSH
T1ECA002300FC92CE28834406DE34A3780042AF44203100A2212970083EA044F3AE20ABC
MD5 SHA1 SHA512 TLSH

Submit Download

TSNXC.exe.bat

Path C:\Windows\System\TSNXC.exe.bat
Size 70B
SHA256 69078b7ebe15fb251d6b07a85a72c2238fe7b194b51ce9a1b441603d494cc2a7
MD5 bc4c74c3e6fea068cf60bed986ec980d
SHA1 3e7292e256d5cdf33b4011fc90ed22397d9ef62c
SHA512 693448b539aa17870ddf369cfb8168ea9f2baa590bbc1548a5f6c67ff62ae094abf5276b7819fc42ce86e72ed994c7662531a24dcd362663ec801620f68c7398
TLSH
T18BA002B02EC130E2883462ED434A3700042AF4428B908030129502C2EA04C638F20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

UCFXWH.exe.bat

Path C:\Windows\System\UCFXWH.exe.bat
Size 72B
SHA256 cfa51b8144f7ddb5ba65020110260059dc11aa3dfdb4d72683edb703fffeef2f
MD5 e318ee8c954b38cb9ac4146f39b63ae3
SHA1 a016e70c32d527fe7eac7d7e937faa4e00d942a4
SHA512 0a782e3ba74b9498eed73fd2235809131d7debfd92a8d53b90e48577745a74dff5464f6aa803cc748d234bb3662f7cc15d944789066a332d6305a48be9c2cd8f
TLSH
T11AA002300FC120FAAC2CC06D436B37A0042EF442233000221395088AF08447B8AB08B8
MD5 SHA1 SHA512 TLSH

Submit Download

UDDNQOS.exe.bat

Path C:\Windows\System\UDDNQOS.exe.bat
Size 74B
SHA256 c980558f6ec523134c25849141ab9bb48fe8bb4a3925b3febae7ca294b90f858
MD5 31fb5da12caf19de5b92256b0b058bda
SHA1 985a84bbfd325ea91f3526a02af69d5143155e45
SHA512 b234290c931fb229f2ee30491d9722c3db97f6da386d588f646dbfdf9a7e3f3ffeeb707bb471a9ba9d5cd1d45e2f8445071e19a1596831fe0bbfc8842e5e07db
TLSH
T17DA002320ECD28FACCACC06D434A3720242AFC42031820A01297808AF00E4E38AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

UTSOR.exe.bat

Path C:\Windows\System\UTSOR.exe.bat
Size 70B
SHA256 fde7900be016941215872ed9bf471647bd5002ece368eba01a0ced118b5563a0
MD5 344bd2d5c20fd0fc8008574bfc99544e
SHA1 a5f1e092d6fc9e90f6aafddbf7740ae791d3ced3
SHA512 f16a26f0115faa8215997a43602b9df5f4cbcd0f61c2ebb4dafb622e229db0eab87d8cb78b1ce7f67662e6e90ff05effbb1e5974344d675f58b6e914aa2ec7a1
TLSH
T1F2A00230AEC320F28834406D43CE3700042FF742031020201297008AEC0447B8AB88F8
MD5 SHA1 SHA512 TLSH

Submit Download

VCKM.exe.bat

Path C:\Windows\System\VCKM.exe.bat
Size 68B
SHA256 f5322c73cd43666cfb5ce43a8843261bc74bc027ab4d3ce1f861a5e33aab38eb
MD5 c49a4bab6bbbff502e4034c3856d331a
SHA1 6d406f43b702e46e57d8fcfca8c6a750a9927d03
SHA512 d3f434d18f5aa259bdd64a48582e7707fb9bef34b3c7fd93595e875086b45f4e90d198cfccb7a7a60f5f063bbe01a443d907e13d28025e52f1262ccca11d16f5
TLSH
T100A002300EC120E2A824406D434ABF08043EF44A0330822092950082E0844EBAA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

VDRT.exe.bat

Path C:\Windows\System\VDRT.exe.bat
Size 68B
SHA256 bd499194886acd6d0ca220a7b940e18435211784966d970e0ced2ac7519597d1
MD5 a5d96d9bddb2f3453d149a4f5948ee0c
SHA1 23f4df8d407c51c62a37b205e4d4631f5fbca986
SHA512 cb1f8e8b457e46d18eaad6ec49b4ef0e201614061d88238cf714cd52292546edc7775a97aac5598027bb2c6dd69f31f4f7e8dc12029398e118eb869b0a7e3c0d
TLSH
T16DA002300EE120EA8824406D434AB78004AEFC430310032012B70082E0064E38A228B8
MD5 SHA1 SHA512 TLSH

Submit Download

WBUAPD.exe.bat

Path C:\Windows\System\WBUAPD.exe.bat
Size 72B
SHA256 39097e0c0c5dc0e1423203775deaf40090ec2d7c7380c344b74f5aabe3099f99
MD5 a279c4421cfa5d64e4cdc771a32ae6e0
SHA1 dd81ff2f7047ad762273641d9fa3f7c1838df6aa
SHA512 23b713dc292f219912c5fbb25a0057beb94af53effe1812ea683ad98bf36de299d637791eb8cccc6cba96c1831bb25a8d467abb27c6edfeee309109c4807f27a
TLSH
T1EAA002308EC9A0E288A4606DC34E3F02072AFC422B3000B0139500C2E0044E38BA0EBA
MD5 SHA1 SHA512 TLSH

Submit Download

WMVB.exe.bat

Path C:\Windows\System\WMVB.exe.bat
Size 68B
SHA256 ccda41932fce36b76cd4d008867f2ce52fab3929ac1f7aacfa949cb80c0769d5
MD5 278ebd6b5afbd3e1a4ca559ee2dbf81d
SHA1 2dd083792c4dd494a8c0d86ab835e722732bf923
SHA512 d9af10210cf784159bf0ce15910e2f1f7a93852408ef6001e713ce5c53d20e0d812796fb678fe8c3b57033056538de98353b9f1b2bfdc22770dd9f1141536b91
TLSH
T149A002300EC928E28824606D434A3700842BF44A033000F0129500C2E004C638F20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

WVLK.exe.bat

Path C:\Windows\System\WVLK.exe.bat
Size 68B
SHA256 6f4a88bbfa110f65e176a7ce45451f543d99861c78118524cad451d01a35b36d
MD5 a159ea1130d1ff8c47c9cc2017366bf8
SHA1 a537bc5bd57d06907fc306be7213bc1de2b95b75
SHA512 f2318bd893613360175d5e40d32d8f75e63448c7a7d7d7903fa7caa845a06a0ec22bbf040fc41e7e7eb60b16be866a4d7cc0bb2e7fa2d131d358512462e2a7c3
TLSH
T1C7A002300EC9B2E2C824706D634AB780042EF442031A0020D29700C2F2046638A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

WYZZD.exe.bat

Path C:\Windows\System\WYZZD.exe.bat
Size 70B
SHA256 b34b1e37546ae301f84d0c5c10ab66ae9049354f1e48f7d2b04ed67a8929a8ec
MD5 68363d5cf611a1b967d6883ca01aa45e
SHA1 002ccf2264c89d7a3adbe624a2a3a70635c5ac01
SHA512 3b9c9720fbf2444cb47a4eb69580499faa05bb4adb4a5248095254af8368c20ad00f0f2ef95b9dbc9e69fe977b5cc58936236dda2503c877af9dfe970d31dab5
TLSH
T18FA0023C0EC9A8E28824E06F634E3702842AFC428310003812D700C2E2044EBCB20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

XCAKDZQ.exe.bat

Path C:\Windows\System\XCAKDZQ.exe.bat
Size 74B
SHA256 657c423f1fb804fdf5b8d0948e35ccfa2605fa1be46f376eede6d9327967f359
MD5 51f283d351c9bfa7f18697f3b7dfb022
SHA1 2cc441303bbe4357ea13acc83ad0d32c5a0fbebf
SHA512 47ccc584bc506a836df4ca28c9afaad26c8ff61c2ba56ddde56541ba4474f7ebf7de9abd4af14915a2f706c9bff7c41f39aa494adad9e19cb318c1ebc6f0615c
TLSH
T1EDA002328EC120E2C8A4427DC34A3700242EF442031008321A9720CBF2AC66BCAA08BA
MD5 SHA1 SHA512 TLSH

Submit Download

XJRC.exe.bat

Path C:\Windows\System\XJRC.exe.bat
Size 68B
SHA256 a60afc78544e49fc46380bf195b250860adc8ca6b3da97b13afe51538209abd1
MD5 afbd5d9bbb3e8b4c4cdf25fd7a43f826
SHA1 1dd851b019a768b56cdffc9c21c3dc2bbc1f76c4
SHA512 528a624f17af16af921ddc3bafae09480d68a0e437ae523f78e33fe27599fc86aee7edfbd311f4fb7bc987e76b97ca62cccf65d29bac981d3fd53007acbef5ad
TLSH
T1BCA002302EE122E288A4686F436A37002CBAF4420310023032950082E224663CA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

XRMU.exe.bat

Path C:\Windows\System\XRMU.exe.bat
Size 68B
SHA256 231b574d594ff4a7293d3bfac3a57687c73f18ee144dfa177547ee728d0bf6e9
MD5 73b50b07640a3ddbb8c33b11de37e18f
SHA1 81f7acae518732f3012850c08b274aa899b27cd9
SHA512 4c5bed35777bead92efb6919189aa9f69b14c0f111ae924af424f85b1aba7fe4698fe9091ad650f1874f77e02c20fbe775fe03089ddd2de625d534a48c6785df
TLSH
T161A0043C1DC110D14D1450DDC34577101C15F4434354443011753041D115D734510D74
MD5 SHA1 SHA512 TLSH

Submit Download

XWZAPY.exe.bat

Path C:\Windows\System\XWZAPY.exe.bat
Size 72B
SHA256 2f78778015b78a8a153189fe4be69dab0bda2d10fcfa7cd3d35b0cc510ad0b9e
MD5 2c324cb501a059cbabcd3219ae428f48
SHA1 ecf634a3764dc6ccc786b1fcf0b72554d530b147
SHA512 09ca7432d3f3aaf39ea5c057b22c66e129a6df558449f639023f439efe2a11907ef595e9bb1b98c51c44ed0c7d5de17b75544e99bb5a2932e53a62090cd069f1
TLSH
T1C4A00230AEC128EA882440ED434A3F00242AF4620310203092952882E2246638EA0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

YYY.exe.bat

Path C:\Windows\System\YYY.exe.bat
Size 66B
SHA256 08e7419c0c01005944d4d14d494c71f9eaa7c3a07b7a206ef7638ab7fea807cd
MD5 d91a4f4b00685949c26a0b3880170330
SHA1 0a2121a76debc485dcf183a7c8e37dc4d2c20651
SHA512 48b9221bf1d821d831b20ea2d7531684e33614455ca103cf157e2171026daf69951809e4af115fb289ecadffc6666a21ac50bc96e85c013a2be7d809d423b2c0
TLSH
T153A002300EC928F288A4406D434A3780342EF6420310002012950082E0044E38AA0BBA
MD5 SHA1 SHA512 TLSH

Submit Download

ZKRKYQZ.exe.bat

Path C:\Windows\System\ZKRKYQZ.exe.bat
Size 74B
SHA256 8309e9dcc6ce4ed9b2c320e472561410240d9647166ad86e1fd8d68b5c939429
MD5 a451cff1af68eab95fda7d5b3f9a4693
SHA1 4e8d9a126a6097ab2489b8002e0afa32b19c709a
SHA512 f37fd242fbcf60e06bd01d09fcf9d1d4ec575d63735f8f4dca976f3c0fb5f0c55466f630ae9320e285d1ed23ee17cc33ca59f01d3afb14ae485190d11ae4977a
TLSH
T1EDA004310FD315F14F55C15D474577004417F4410314005431553051D0055D35730774
MD5 SHA1 SHA512 TLSH

Submit Download

ZOJ.exe.bat

Path C:\Windows\System\ZOJ.exe.bat
Size 66B
SHA256 7252c192eadc57bb9bf3205e543fdfe8815214f929cf24b067f1d84fcb80f480
MD5 029ee4927508b8c9de6ecd278c46bb62
SHA1 0f419f86863abc33cc4bf5f013cfa5d472a27e1e
SHA512 3b62dcabf3d0473ee400e793e55d5137b1e1c055d87fa9b5dff9313e5e21c1de18fb645f3459b1a9fcb3aa9ddde5cc46bd43bfd399129bf0209a627faf5b77e3
TLSH
T120A002380EC120E2883440ED634A370004ABF44A0B900820129700A2E004463EB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

TCKFDG.exe.bat

Path C:\Windows\TCKFDG.exe.bat
Size 58B
SHA256 610bb437bf9aa47846fbf76d935ae72c5124b6e3f58752b4acd39d5ade18731e
MD5 3501faa175194a997a7d0ed0557f2520
SHA1 55f9ca644b61d236d0dd4ab96f419d374fa3e6fe
SHA512 c18049cb9f3fb72402cd13a4655d1735fb3e90c44157aaa53b9c9526da9f62658dd78de224a748bbb47eb149b3b4b485f7dc448e9aa541a7f60c6c0aa06d3122
TLSH
T176A0023008C92CC88C246A49636A3700048AF440A2908C2A1A1528826004CC380082B0
MD5 SHA1 SHA512 TLSH

Submit Download

TOXRN.exe.bat

Path C:\Windows\TOXRN.exe.bat
Size 56B
SHA256 4d3c09cd316d3463f325c340c61348fb5c0507e2cce646ec4054a4cb1825b726
MD5 5343b7641a79f24a6cf47bd3da8e57cc
SHA1 9bde46e10c1af066c6c994e1a6f90723a1523101
SHA512 2fb9f7d4182f3b0de501b38d161079a5974d5b78f18100e8e2861c9b5500a17f8a2ff4593008188cd161af317f5d79d16ceb45f312b062c6e4658e56667d8841
TLSH
T14A9002B008C322C28824404B634E3708248EF6400A920220D21528807004E6B80000B8
MD5 SHA1 SHA512 TLSH

Submit Download

TZYDO.exe.bat

Path C:\Windows\TZYDO.exe.bat
Size 56B
SHA256 9294417b561ff7605e87f8604a8cc52aa67622f36be5eff0deac6804dc827ba1
MD5 6f1aae0a996d527953c8ca44480aed55
SHA1 308d4158c3a3b0809244d5ec6797dc1bd5b16784
SHA512 5dda8bfedbdfaaa4fb267bd0039eb257573cc4645593dc768280aed3b13261f51bbc585cf6a696a919504aca2baf5f53a79fa155728ccc9974e5f8d7f3662950
MD5 SHA1 SHA512

Submit Download

UAGH.exe.bat

Path C:\Windows\UAGH.exe.bat
Size 54B
SHA256 6abcebaac382addc5b737d2773b77da2f1ca326141e815e9879f0da6de99e165
MD5 5d2e4165c8335ed0d9e971e5cd32c2fd
SHA1 292680c31c1d254af4923742fa976612028540e3
SHA512 970f7fa20985c2d10e965c922d1c354fd1aeac1f88a762c089dccdecb155e1a90d428d9c76ad2e57e009fb126c08870b3e1d936e0c44c7362f8c8daf8cc751ae
MD5 SHA1 SHA512

Submit Download

ULV.exe.bat

Path C:\Windows\ULV.exe.bat
Size 52B
SHA256 be0998f59aa9656bbf319dbf30762be2adfe2ade4a1e49881f09dbf088b564b5
MD5 4c0ea2138a594cdd7e45a0b764a1916e
SHA1 49f32c9c9fae6cd86b8a5cd26dde0f58d4bb2570
SHA512 175093c9e2c017491ae757193e59a81a52ebc6e5ab1aeb472da58db26cd9558e36ca456c97cc367c737aba7ebd061217c0a4817a0fc1337ff674189c13b09566
MD5 SHA1 SHA512

Submit Download

WBXE.exe.bat

Path C:\Windows\WBXE.exe.bat
Size 54B
SHA256 6b55fb8049251fa46b7134fa39dc58ca4f0af11d345008eb4e99647269fea614
MD5 16756fd29348af5081bf77b235ea72e6
SHA1 71475863bbbf080b186905fbfe4b56d5522ba93a
SHA512 103af44733ef6bfe39835700484d3d401f638666d29f46232e33a902fba254a85ba03f483e2adb526d95fea171518b0d2958beca0780213bd56b9f15759f1f32
MD5 SHA1 SHA512

Submit Download

WEJEYU.exe.bat

Path C:\Windows\WEJEYU.exe.bat
Size 58B
SHA256 47eb90b1896b487af05013569d3776a113772cc6117175feb37c634f6bf6e09b
MD5 8592183b6da1e324133954bfd793f6bf
SHA1 d46440a69e54e6dd5167f118b260099bcecc20d4
SHA512 d3e94278675017963de10a2c4cc7db2ae5858af7ae08448184190a4dd20116268eb8e1d15b6f34db3b417c076e5158baf56c5d170963908da1dbecfa37b53e1e
TLSH
T156A0023888C1A3E0A82440FB4B4ABF00260AF4420A100020131588806804C4382028B0
MD5 SHA1 SHA512 TLSH

Submit Download

WEZYXQX.exe.bat

Path C:\Windows\WEZYXQX.exe.bat
Size 60B
SHA256 1dc16a26e9a6b58cc33ac659dfad5cccefceaf983a8cb3f355b1770c54c9a40a
MD5 9ca430537b3cafb18afb468fc9b2f829
SHA1 fac3679f59999da249b0a7d6deabaa432fbaede4
SHA512 0a13071eb895b4970b81ad5c318e080cce502a991e20ed7bd38d625534867b331266121a7ffa2f89b964bdcf3a91288446b3acf66cf062ec128dd2a7c3393fbd
TLSH
T1FFA0023808C13AC0AC244049436A3F0084AAF4CA0A100288939780A078844EB8280AF2
MD5 SHA1 SHA512 TLSH

Submit Download

WGID.exe.bat

Path C:\Windows\WGID.exe.bat
Size 54B
SHA256 bd6bc7e66f7b682030f2934e0c9d4de60dd2123d891ab720c88cee3f520aec78
MD5 a18d17ba23c448e47327ad44c2b777ea
SHA1 74bf35084e117b984861bd9450e39561c800a2df
SHA512 e77c424e5f575eb67451ee5dfad59bf47eca90687886f3c090c09a8ef6b26020c0a043de31adf3875fa7f22c2a2173050ede35d3526cb65d0a390c15a9df234d
MD5 SHA1 SHA512

Submit Download

WPVUW.exe.bat

Path C:\Windows\WPVUW.exe.bat
Size 56B
SHA256 f7cba7f942a20e508459a6a0ae56137d098c52f0911d845631ed830e58154d5b
MD5 7d0663a0446316af9be5fb2e4e9fe96d
SHA1 366221c48d29b6fb1631acef6ef05b25ba401e69
SHA512 cf98e771d267c7e9c66a296655908ade3c4bbe1a97994c43aa8d90951881aea1b8f4922e5afc0611cb7e44f15e44f9820e71b16e1c43372bf1c2c4aece49f223
TLSH
T16B90023008C122E08A24404963EB3700048AF44202100000939580A0780666B83808B0
MD5 SHA1 SHA512 TLSH

Submit Download

WRGI.exe.bat

Path C:\Windows\WRGI.exe.bat
Size 54B
SHA256 df5fa0b0ded85692cdc180b659643298966835066c22c769aaaa13b0ed0d4593
MD5 1bdb650c2eec3dc29b004886772426a6
SHA1 96fff7e134a1e0a1b76e568f6de5d9c5c3963b5a
SHA512 0293d4c0bcdc835421175b01b30b424cc4abf60fdd1ac77628ba6b7b1fcd0c0f651dd389012a77b14e1bcd87073938f19b3aa30dc3334ae6e4be1ef8f1d4d1db
MD5 SHA1 SHA512

Submit Download

WZWHAK.exe.bat

Path C:\Windows\WZWHAK.exe.bat
Size 58B
SHA256 6838b85cf66625d0424c3048b3f0e839196fb5c3f7b32226f73187918a783e2b
MD5 326ea7d2337c85dcca6d9e2eb6f6f952
SHA1 30941943a5a84f4559d4ac21310fb1b528fd3449
SHA512 83373d1b4be1471382cfe2b28373b4345262bf72715f34142f267bb0adf61855e267ffddcba2a2f7d1851ddf3ff7eae51e70eb7220db08b5e6a34738a52a7427
MD5 SHA1 SHA512

Submit Download

XPDEV.exe.bat

Path C:\Windows\XPDEV.exe.bat
Size 56B
SHA256 b1f1680c0b30cdf7b1c429f7ba33b8be37af527b915928effec9b01f95828b9b
MD5 b25a1775eeb62458d11e3a96ce141303
SHA1 d19bea836dd607ce1f788fc912bcfe6c29ab4236
SHA512 8d1f2d37e4869dd8f074337ad4c4bafba767e04a75c503774e7645478b372c7e5a0fb1cf37fea583867038a15dbb446557830e9ad9eaa61a96155c7b45943cad
MD5 SHA1 SHA512

Submit Download

XZYSN.exe.bat

Path C:\Windows\XZYSN.exe.bat
Size 56B
SHA256 9573ee0b96d3dbe8c4785ea2d13f8d70d40130b21499bacd903573b22b6c49f1
MD5 f44ab021fb04488772d326256f631313
SHA1 63a42cdb6d67dc670040822a573461339c8ba75b
SHA512 ef36970ffbf0866d5278c8838eaec5ed47d562c71289d7d51d6172b005fd4d09f8536fd68fccd80faa151270044426d33654ad2a1ed0dd9ff15ddc23bd20058a
MD5 SHA1 SHA512

Submit Download

YISE.exe.bat

Path C:\Windows\YISE.exe.bat
Size 54B
SHA256 bc1f1fd06b42cd88621560efef43da963238c6ca60f9e77372d72479953d42b6
MD5 92d3bd14768953d169a5d78af3b1efcd
SHA1 c67308179316156dc4b62ab388cc7df25384384f
SHA512 31fc565b3cac0e9566e76831b7174189ddcdbdc6f8d4ad913d89be579d71d14df58544b4d349536ebddab46aaaa4c379ebd804d308b465b17c1ff9787f0b21e6
MD5 SHA1 SHA512

Submit Download

ZFZVWDF.exe.bat

Path C:\Windows\ZFZVWDF.exe.bat
Size 60B
SHA256 4e9d2b39373645e7a8b5664b207bef10d09ae11cbbcc23bd8a5a0f5e412fd40d
MD5 b618c7c32a97c2da14971c86792eb88c
SHA1 25de2334b3eb7875350aa41fd6222c10fdad99d6
SHA512 dec54f13c047bd824f431436f19f32c03de4dfb12ccd570bed839c72040974fb5962a6ee0478faf2118c3fcffa6d7818fd6e1140a6be03020e005fbc99ee4880
TLSH
T1A7A002300AC138E8882C7849434A370B040BF6C0021C80C2121D02A070A444380802F0
MD5 SHA1 SHA512 TLSH

Submit Download

ZQCVYTD.exe.bat

Path C:\Windows\ZQCVYTD.exe.bat
Size 60B
SHA256 03ffee5cd23499461373a863c22bfbae8f9857344c1a7d2992b80005209837c7
MD5 7f3b0a28f002bc265bd683c6d5b7e96e
SHA1 bdceed354765e6e2f869dfb4d938e0e4cc4d2a72
SHA512 e5dbe8af396795386b3b5dcbd22f3e5559b1b1d786d7854f5c950f77470c7d892496060bf20e9a13f0f12345795f01b57bf6ad618c6de2e3a6d63893d47cd968
TLSH
T1CBA002380AC1AAE0882C68C9C34AF780A40FFE402A100028139580C8700C44383000B0
MD5 SHA1 SHA512 TLSH

Submit Download

ZRFDB.exe.bat

Path C:\Windows\ZRFDB.exe.bat
Size 56B
SHA256 e61d4cfae4f9a768b9b150b4b92768a743f3261760d9250b7389b1d94402c98a
MD5 11877126e033bbddd2f8cd5694a86ab2
SHA1 9d759395a5c0d3876a8769c90f40ac4078b513a1
SHA512 44322e19637e76dd0f5f0598e5450a7e5f91bfb46383886fb234f961bdd6547ce8190aee6f947a6647d0293eb351c84ef341ed683a4e40f1510334a33e6cab9c
MD5 SHA1 SHA512

Submit Download

JAMMYXB.exe

Path C:\windows\JAMMYXB.exe
Size 208KB
SHA256 aed257d62e86b4dfe86ed16985ee701b4a53298cc4246114318f0398fb54cb42
MD5 346feb31c2c993bd1353b6fb103b60b8
SHA1 b27d93b93f631220633f66fc296a809a34e24b0d
SHA512 d9f8740f1d3f4689e6f6092be65c9e20ba696dad1aa5079c35397ef3d126102ad436ffdae79be106b01b591e42017071b26937b682fcf578e522013c23ca88a6
SSDEEP 3072:7+FSkqTgghpBcWzKeYggvggSgHgGgBAw8T9TNw9VZfXpfGvT2uMnZmr4pLthEjQS:7omZzKhw8K7kvT2uMZmrkEj1
TLSH
T180248E4636C4F992E423423684EE92B80A39BC226FF7531B3648377EAFBD7404C55629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MXJ.exe

Path C:\windows\MXJ.exe
Size 208KB
SHA256 79cf1f7bf466f9cb5c27850598199870b29a7ce8a94f36e64b16d9318a89ec01
MD5 ce1201c3d627cdbd2b6b9c8c730c75be
SHA1 ed5ebd48a69b33ab6cd0c874d8a6ecaacd656b82
SHA512 678e99e551e7ff854bdda62cd81a812579168d748f5576489026997ccaaefd0d041db01e6679a038c7052e0cb31a3bdef590bccb4523024fbfba4aee27afdede
SSDEEP 6144:7DONZHkvZ7fdnhhdlEltwlIqnw7k+HEi2zGHwEVkEj1:P9vZ7fhhtE4lIMw7k+HEi2zGHwEVkC
TLSH
T118249E077DAA9896E0F753B6C4E18DA0DBA67C72AFA7830F7984371E55B0640CD28770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RKFGPN.exe

Path C:\windows\RKFGPN.exe
Size 208KB
SHA256 579714ba9625a7f59d863cc42402ccf0b3fb8362d19662b88a525ebe05f4a0da
MD5 e7728a748fcdad8632e86ffa6ad78322
SHA1 acf771f01614d592d11147d98444a6512c08134e
SHA512 7b0f47b8e4916b1b84e3b1ac28a6eb860578329aed6115f19f961cfe9176b53a91147c482b012688253c32bbb2a288765081207465a1156e7e2fbf144204a9bb
SSDEEP 6144:7P1386UKEwYuXn1S606HUuK+nvvAVRJuHZkEj1:D1386UBvuXnGpn63AekC
TLSH
T1F8248C1ABF514412E41B57398CED4F640EAABC368FAA138FA908732F5C718D49E5C7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQXYEI.exe

Path C:\windows\SQXYEI.exe
Size 208KB
SHA256 824f0699f804d949806786516d0dcb424fb2764d57fb9395f7f01234ca7a385b
MD5 2cafeefc22d5711e6b4dcfb851cbbebb
SHA1 3b94bb8a53738763747e7256b20777006c278288
SHA512 4b566777f207272edaa890a86c11ab813b40f6bbc0677817291810e9aac641aa811f6bc3d32a53a8a9144f44dba530b7bc420441e96a5d995e2f5efa529cbf5e
SSDEEP 3072:7Y+2Xytt1r3iY7Ek7ikBRfNsnfSR/iU4wWcGlM3uMdoexCIWNmuCUk54Cr4pLthC:7Z2CR7F3ZNs+/y23jKesmuC5hkEj1
TLSH
T1AC247D8139A88183E0B70B384CF1B2B427ADBC639BB7550B2604F79E7D715C94B86797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUOZMHK.exe

Path C:\windows\SUOZMHK.exe
Size 208KB
SHA256 d9fb81b2cb18537fb4f3d48acce667d67c1828493fe4901bcfd9ad3c0fbaf5eb
MD5 8be57f242b204d529275ddb15e648750
SHA1 eeabcb4b2134a10ae9a14e09d4cc2c8093ba58be
SHA512 fe163c750e27505955cdb88c20b1f1cd5438712ea7bf7ab063097646f11a0e60050bb33352f05600570968b64245392d633541acf76a8d690f547ed17851fcf0
SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfq4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LOSkEj1
TLSH
T108247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDB.exe

Path C:\windows\SysWOW64\BDB.exe
Size 208KB
SHA256 1e8c1bf47832c3b60f40114161022cd48ce9d5a3ab4a3a75d04dbcc10b756469
MD5 ed3488c9c13981911f7f365391322a04
SHA1 2657e05193d33169ea51da04b6a788c461554d99
SHA512 3a69642362585c2dc70a421cdefd20dd194db6d15938dff134c159a9f7ce03ac8b08c2668382a66805b7722dc662f0a9b4663711f25575f8c8b88ddd64348c88
SSDEEP 3072:7cgrWmgsMcOmJM8fHNPwV+rif7I/8XIapNiV7hK2o/Gfwk4pLthEjQT6j:7VDMOJHNwvIUYapNI4/swkkEj1
TLSH
T176248DA13AA9D4D3E1F79A3047E58F9977923D21DAE2970734B8330DA9353B70C1A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GWRSXB.exe

Path C:\windows\SysWOW64\GWRSXB.exe
Size 208KB
SHA256 f04a7505c6aa8bd919356bb43678801cb74eacd73b6baca2531ef1360777bf6b
MD5 45a0ce764123fd8f3de1139c3cd9c866
SHA1 f7eee0fcb7759a915f9908f678cf0442e812aefb
SHA512 789dc2bffd6054904ca2b5940eec7b48bd8139076076e5b3a8371337b8de0da2e494f30622a9ddadd7cd47d4e3881834b80a73e4d72a9e2c4296f0b1269a808d
SSDEEP 3072:7eGuP6GHy4+4Pq6pbBExwoFWeXK9SgnZmd1QAOUaKqJfNlNftVeZ+a14pLthEjQS:7efP6ELq0tEtSlZmd1NgdJFeZ+EkEj1
TLSH
T14E248D023681FDDBD2260139C4F286653A96FD975F23C23B6344336D3BB21E66F916A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LAW.exe

Path C:\windows\SysWOW64\LAW.exe
Size 208KB
SHA256 970a979edbce88db6dcfa7569d825921ff7bec9c5ff9c97a8d12f16e983b290c
MD5 2550ad5eb3dd0ca266aa2322303ff6bc
SHA1 7671c06b47fe778545ff9654af53c2c404f51e94
SHA512 145d8e3b2729a54a57db530710fb41bef0b9fce50a0c80a49a8226488028e76db4d9800888d4c2bde765a47a595c985347a6366a1e0d6687a14c1756aef3a509
SSDEEP 3072:7Kdao+LoE+KaGdIhEk+AfpYvABkjU5fsSiJpfnrYE5bmuUFJuNqnmT4PV4pLthEB:7do+LoEA0REQGg3V/8gsO49kEj1
TLSH
T1D3247D01F7A5C856E46F03F896EAC2941E72BC21EB76DB1F74D433AD16326504823B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OBNW.exe

Path C:\windows\SysWOW64\OBNW.exe
Size 208KB
SHA256 5fb2408010b54c8a84122dd5c7aac367546cd5a92a47361f3286d215b55b8ed0
MD5 156f9c44afd5a2486520f61a60ba405d
SHA1 0e952280bce4743d3445606881d5848750e8caff
SHA512 7a5587e34487da305ef7336d2849e31093020153cba744e5575b401030d5825e3a8dcea0355f890d8e43b2e6607eba79b6ba7481707be76956b21884dbb684d7
SSDEEP 3072:7mlJMbQrkmkTh7tkwOvOVw8weJ6cbZOAH4pLthEjQT6j:7yqHP/OvtnCkEj1
TLSH
T1FA248D42B69DC51AF09F5EB94DEED5905AB7FC019B35821BF2A07B8E1D712F08814B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OYTF.exe

Path C:\windows\SysWOW64\OYTF.exe
Size 208KB
SHA256 6176486a7c18e795d9bde9b6e7f2efe3712aff9e18c9da50b8cc9f6f79ab43d3
MD5 650c53a8f2ad6968ed33a010d9e1e5ca
SHA1 9b664ee1d0ef594263f7db47b5f9d9bfe1de0f3e
SHA512 1945b37579a844b7d84424cd103817432665bc2d0a00f7a94e3a3af87040880ef419d6bceeb2298106cf5053db9cf6b3298ae4014642ea6a78413692fbb749dc
SSDEEP 3072:7WDXSeKLsOx0f5aCqS6i/5AnBp/rqTYEwUd7Esyk0NzO9r3e6Og4ToEOWvC47e+2:7sSqa3Jw0Nz0OzVCk6RkEj1
TLSH
T170249E5EFA95E113F06B4AF49AD1861E57BFFD31EFA5834B6184338E19325E04A103A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UKD.exe

Path C:\windows\SysWOW64\UKD.exe
Size 208KB
SHA256 54f5163610cf440a58837c57e1b529630b5808b09c2f58945141b70b79fabc62
MD5 b9788b3ed2d21059f230b7705a8c0891
SHA1 6a6555e3596c947d93119995bf51a420ae2f007c
SHA512 f84aba62b28256237eb502cde89f5ea529677c5841f5e14d608f4207ce1b2cc9781dd99dc373c6f04df2db3ec4814eb1b3e4582fa29be29dc8f04ad64726dec4
SSDEEP 3072:7w7i+dZbJ2tLbhmMlcnSHcbZj5wk/XBwoQzUBv8ElxFThg8CnsVhmma4pLthEjQS:7gLZbktLb0scZ5w2GodFTGpkEj1
TLSH
T11224BE0271DAC12AD4BB1AB4A5F653A42AF3BC157BE6C34B2448B36F2D30D404D7E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WRGI.exe

Path C:\windows\WRGI.exe
Size 208KB
SHA256 680a74e7813c1d5b35f03f3d829d0017e34c0e5c0e02c6c3a1b68853fed2b368
MD5 dbf4411d891aa193f8f3fc46a644f136
SHA1 918117410f6f4578ef3e34e90a816c0abe73b109
SHA512 a27bb1d6259cc69219b5d245ae978ad28e9a47eebbb9a6cc8a5e8a2c1005d1ac42345505f16889a1c3d10a842faf0ac4fa857eab4dcde4136fa58141b5387412
SSDEEP 3072:7BlQwAwwgATzcjbcG7k5aAL4SkNcx7Z7qXOcfaeiA4Ap45H8OZ4pLthEjQT6j:7B6FTgag17k59NkNcxxdljLAQ8YkEj1
TLSH
T1B2247D82BD95C0A1E517573088F986181EFABC82BFB1911FF6C937ACDEB17804D523A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WZWHAK.exe

Path C:\windows\WZWHAK.exe
Size 208KB
SHA256 4c8b5b01ed91795fdda4ebd1cc23348a24e7954b5025ca1a40586a774a4f0095
MD5 19f5a5952b0b9b32a6d317714d303f90
SHA1 840dcba9c2c754bc603769972bbd36c0eadccd82
SHA512 35d87d9fe0f0bfc622b69176d229afd9c86d77d8ae76f48efa6aad56814078f594caa421e416476840fc8ec511faf3706d5d51df0161771aa736defdbc25fa20
SSDEEP 3072:7M6Q+W/ETiKKYUwp6Nbtrh9SAoc2ut6fSIORN+CPtPcZlpSBfgpg4pLthEjQT6j:72n/Yvp6Nbf9JDsfSIO2+ROp5pgkEj1
TLSH
T1D0245D01B9B0C162F4BBC63588F6865C7D3D7D62EF62938F6048B72E68F16DD4844A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FOLZSWI.exe

Path C:\windows\system\FOLZSWI.exe
Size 208KB
SHA256 9eda10e9ee54db74d630e1ae1856ab8777256420d8a15a28bbeb8d4daef56850
MD5 9b801967431c9e2addf0439a61bc0eec
SHA1 696440d91e49af33ee37583132282445b4a78dc2
SHA512 fa12b7f14821aab673622c0481157da32ae7a1ce2684fb95cc4368692ae7bb76bcbecf5eb42c8e8c7b0207423604e9538397853ca05634d3d720f9ff777a401a
SSDEEP 6144:7aFIud/y6RorDvxpSaS3qsnsOE5ZpkEj1:eFIK/y6RoppUPnsZpkC
TLSH
T1B9248D043759C0A3D0B74B31D9E6CBE49BB27E729FB24E1B7290739D68716011A13F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GCWHGF.exe

Path C:\windows\system\GCWHGF.exe
Size 208KB
SHA256 36e00475db43718cee719dfb373d529471ae87f7454a485359d731aa473d0d1f
MD5 d8f0c03b23697ea7856ec1c39c1c94bf
SHA1 4c47f28ec7a01d9b716d32717d615c2bae52f048
SHA512 e805987023aa48b9f55a8b4cc623d9cc01fac9db240ec5dbe0d4335cdc858424d6ceae737ee4a2a0f32735ca0357f63220ddcdc7f428c75d0dd0c22dd61fd53f
SSDEEP 3072:7b87KRo2uhDs9/gEghfh4pl9YEzwm5q1c1Fv4pLthEjQT6j:7To2uVsiNNh4H9TU5KkEj1
TLSH
T18D247C04BE628522E06717B04CE6D6706DB7BE65BA65D70B3B003BBE64B13444C47BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UTSOR.exe

Path C:\windows\system\UTSOR.exe
Size 208KB
SHA256 becfe2e71fae2e75f542ad6aa867c572782c45640cc4ba00ab792726303bdc50
MD5 73c341e3ea8ee4633f6d1f4d86265f49
SHA1 c4eed16fcbc8026001d6fac6fd36de898bfd7ae1
SHA512 2b5230320f52a87c79ae9dfdac77c8a42c29a54ddd581e736373b96ab2e6e69e3fa7a59892e5f833eb5d31f2809b1b0f6931ea0141696d6d37e3f472c9d07b9e
SSDEEP 3072:7DlOmmjXa7d6ri9E1rpt2PC+3TM4tYmh9I5TrooO+8fACn4pLthEjQT6j:7DwDXrJ1ryPCJe+Vog84QkEj1
TLSH
T1B5247C017696D156E2B707348CD7CBB81A3AFC21BB67121F39C9B76E3CB2A618C51325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-385-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/668-397-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1100-44-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1100-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1124-209-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1124-193-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1184-374-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1184-361-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1456-149-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1956-164-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1956-148-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1992-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1992-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2080-479-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2080-492-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2204-269-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2204-253-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2212-224-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2212-208-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2272-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2272-178-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2776-467-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2776-480-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2972-339-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2972-326-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2988-575-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2988-588-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3068-515-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3068-528-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3192-314-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3192-298-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3428-516-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3428-503-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3504-456-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3504-443-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3712-90-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3712-74-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3764-409-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4044-659-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4068-432-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4068-420-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4104-283-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4104-299-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4236-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4236-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4288-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4288-75-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4324-599-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4324-612-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-540-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-527-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4416-120-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4416-104-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4512-551-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4512-564-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4516-362-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4736-373-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4736-386-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4800-223-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4800-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4884-648-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4884-635-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4900-25-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4944-647-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4992-284-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4992-268-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5160-623-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5160-636-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5256-179-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5256-163-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5280-504-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5280-491-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5444-338-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5444-350-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5472-45-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5472-29-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5528-468-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5528-455-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5624-238-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5624-254-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5712-444-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5716-624-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5716-611-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-421-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-408-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5832-576-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5832-563-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5876-105-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5876-89-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5984-600-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5984-587-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6068-313-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6068-327-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6136-539-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6136-552-0x0000000000400000-0x0000000000438000-memory.dmp

Download