03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
Size 208KB
Sample260903-p3eg2atthy
SHA256 03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4
MD5 aa25c2b2a2a5a053a0d46c5d44fc9c88
SHA1 be932634edc5d37b62c6c3751749d3d9ea2ef3f1
SHA512 1bef8c97454762cb68208acff6f645589b710e7ef9d320658e899d025a4854f6d19508e695974c77c1ae7feb1ff94acd3e485d4257f7e378b07598c67be63437
SSDEEP 3072:fvdyBIAN7skHoa99ypiCKajaShDLHz0tFfmLkYFt4pLthEjQT6j:tyBp7rJ96ay4HiFHkEj1
TLSH
T138248C02BB4190DAF0AF163158EF42998A1AFD32EF66C213F650B3AEDC7219D5C47752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 38 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	LNQFKY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	LHMTNU.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	XCQXS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	RGSD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WUE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	SKPLL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	MBKP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	FQQZX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	VXEPG.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	SLSPVK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	KQQGT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	BENKWUT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	HYJC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	KPY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	FIDFAFF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	NJN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	NIACU.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	KTUWQBZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	IPJA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	FHQH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	QRRAV.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	VFSZH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	CVC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	DXHP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	OOTI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	JUX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	RJAPLXT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	UZM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	IOF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	CKXTMJE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WTS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	BVWKH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	JUX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	FVLY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	NSUKXS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	AREABR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	PJHQ.exe

Creates a file in the Startup directory 1 TTPs 64 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DXHP.exe	DXHP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KTUWQBZ.exe	KTUWQBZ.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VXEPG.exe	VXEPG.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FHQH.exe	FHQH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AGPU.exe	AGPU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JUX.exe	JUX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FQQZX.exe	FQQZX.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UBWSPF.exe	UBWSPF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DXPOG.exe	DXPOG.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RJAPLXT.exe	RJAPLXT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QRRAV.exe	QRRAV.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OOTI.exe	OOTI.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AGPU.exe	AGPU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BVWKH.exe	BVWKH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VXEPG.exe	VXEPG.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FHQH.exe	FHQH.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AREABR.exe	AREABR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QRRAV.exe	QRRAV.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UZM.exe	UZM.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TDDKCI.exe	TDDKCI.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIDFAFF.exe	FIDFAFF.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KTUWQBZ.exe	KTUWQBZ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DXHP.exe	DXHP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKZYSV.exe	LKZYSV.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTS.exe	WTS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LDXX.exe	LDXX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XTEMKMO.exe	XTEMKMO.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SLSPVK.exe	SLSPVK.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JUX.exe	JUX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KQQGT.exe	KQQGT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVLY.exe	FVLY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BENKWUT.exe	BENKWUT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VFSZH.exe	VFSZH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HYJC.exe	HYJC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBKP.exe	MBKP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LHMTNU.exe	LHMTNU.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XCQXS.exe	XCQXS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GFJGAL.exe	GFJGAL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CVC.exe	CVC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IOF.exe	IOF.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTS.exe	WTS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SLSPVK.exe	SLSPVK.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KQQGT.exe	KQQGT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WUE.exe	WUE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JSPVA.exe	JSPVA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LNQFKY.exe	LNQFKY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJN.exe	NJN.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NSUKXS.exe	NSUKXS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NIACU.exe	NIACU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VZUKJM.exe	VZUKJM.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VZUKJM.exe	VZUKJM.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RJAPLXT.exe	RJAPLXT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CVC.exe	CVC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IOF.exe	IOF.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SKPLL.exe	SKPLL.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKZYSV.exe	LKZYSV.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OOTI.exe	OOTI.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NIACU.exe	NIACU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZGO.exe	ZGO.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PJHQ.exe	PJHQ.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PJHQ.exe	PJHQ.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KPY.exe	KPY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIDFAFF.exe	FIDFAFF.exe

Executes dropped EXE 64 IoCs

pid	Process
3680	VXEPG.exe
4528	FHQH.exe
3624	VXEPG.exe
4576	FHQH.exe
1504	AGPU.exe
640	OOTI.exe
4760	AREABR.exe
796	OOTI.exe
2592	AGPU.exe
1064	AREABR.exe
2468	WTS.exe
3176	LDXX.exe
844	XTEMKMO.exe
4724	NIACU.exe
1656	WTS.exe
4792	XTEMKMO.exe
2984	LDXX.exe
624	NIACU.exe
4884	KPY.exe
3412	RGSD.exe
3984	KPY.exe
4692	BVWKH.exe
3156	RGSD.exe
4456	BVWKH.exe
1984	LKZYSV.exe
748	VZUKJM.exe
3228	SLSPVK.exe
2312	LKZYSV.exe
2812	SLSPVK.exe
4780	VZUKJM.exe
3668	JUX.exe
3372	KQQGT.exe
800	JUX.exe
5032	WUE.exe
3640	KQQGT.exe
1420	ZGO.exe
3436	RJAPLXT.exe
4892	RJAPLXT.exe
4280	ZGO.exe
3216	WUE.exe
2536	SKPLL.exe
4804	FIDFAFF.exe
4980	SKPLL.exe
980	KTUWQBZ.exe
2644	FIDFAFF.exe
60	FVLY.exe
2612	KTUWQBZ.exe
2064	FVLY.exe
364	QRRAV.exe
4592	BENKWUT.exe
1160	VFSZH.exe
3508	JSPVA.exe
3092	PJHQ.exe
3880	QRRAV.exe
2932	BENKWUT.exe
4748	JSPVA.exe
3684	PJHQ.exe
3144	VFSZH.exe
656	LNQFKY.exe
1368	UZM.exe
4916	IPJA.exe
556	TDDKCI.exe
216	UZM.exe
3328	LNQFKY.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d9635574 = "C:\\windows\\SysWOW64\\NSUKXS.exe"	NSUKXS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\abcfc438 = "C:\\windows\\CKXTMJE.exe"	CKXTMJE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4bae2a31 = "C:\\windows\\SysWOW64\\TDDKCI.exe"	TDDKCI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\318a61cb = "C:\\windows\\system\\IOF.exe"	IOF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c57a2f5c = "C:\\windows\\DXHP.exe"	DXHP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\307c80ec = "C:\\windows\\system\\SLSPVK.exe"	SLSPVK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3f2fa39a = "C:\\windows\\system\\JUX.exe"	JUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\16ca58f3 = "C:\\windows\\system\\ZGO.exe"	ZGO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5d78724f = "C:\\windows\\system\\BENKWUT.exe"	BENKWUT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b2304aa = "C:\\windows\\SysWOW64\\IPJA.exe"	IPJA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c57a2f5c = "C:\\windows\\DXHP.exe"	DXHP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5e3fa3d = "C:\\windows\\SysWOW64\\XCQXS.exe"	XCQXS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ce5954a1 = "C:\\windows\\SysWOW64\\AGPU.exe"	AGPU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ba22b6 = "C:\\windows\\BVWKH.exe"	BVWKH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bb77c83e = "C:\\windows\\system\\LKZYSV.exe"	LKZYSV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3f2fa39a = "C:\\windows\\system\\JUX.exe"	JUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ce848bc6 = "C:\\windows\\SysWOW64\\SKPLL.exe"	SKPLL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2707cc24 = "C:\\windows\\SysWOW64\\FQQZX.exe"	FQQZX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\318a61cb = "C:\\windows\\system\\IOF.exe"	IOF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5815ed67 = "C:\\windows\\system\\DXPOG.exe"	DXPOG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ce5954a1 = "C:\\windows\\SysWOW64\\AGPU.exe"	AGPU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bb77c83e = "C:\\windows\\system\\LKZYSV.exe"	LKZYSV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9619467f = "C:\\windows\\SysWOW64\\FVLY.exe"	FVLY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\913ccec0 = "C:\\windows\\system\\PJHQ.exe"	PJHQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d9635574 = "C:\\windows\\SysWOW64\\NSUKXS.exe"	NSUKXS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5815ed67 = "C:\\windows\\system\\DXPOG.exe"	DXPOG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\51996be7 = "C:\\windows\\SysWOW64\\OOTI.exe"	OOTI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ce848bc6 = "C:\\windows\\SysWOW64\\SKPLL.exe"	SKPLL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\33578586 = "C:\\windows\\QRRAV.exe"	QRRAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2707cc24 = "C:\\windows\\SysWOW64\\FQQZX.exe"	FQQZX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\30408ff8 = "C:\\windows\\system\\AREABR.exe"	AREABR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ba22b6 = "C:\\windows\\BVWKH.exe"	BVWKH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74b3f204 = "C:\\windows\\system\\VZUKJM.exe"	VZUKJM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ce848bc6 = "C:\\windows\\SysWOW64\\SKPLL.exe"	SKPLL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d20d5b09 = "C:\\windows\\system\\UZM.exe"	UZM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9859d588 = "C:\\windows\\SysWOW64\\NJN.exe"	NJN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\54d64319 = "C:\\windows\\system\\MBKP.exe"	MBKP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\74b3f204 = "C:\\windows\\system\\VZUKJM.exe"	VZUKJM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4bae2a31 = "C:\\windows\\SysWOW64\\TDDKCI.exe"	TDDKCI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aec4eade = "C:\\windows\\CVC.exe"	CVC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aa184b93 = "C:\\windows\\FHQH.exe"	FHQH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b4994595 = "C:\\windows\\system\\KPY.exe"	KPY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bb77c83e = "C:\\windows\\system\\LKZYSV.exe"	LKZYSV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f2c66312 = "C:\\windows\\system\\WUE.exe"	WUE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5d78724f = "C:\\windows\\system\\BENKWUT.exe"	BENKWUT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d78724f = "C:\\windows\\system\\BENKWUT.exe"	BENKWUT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d156d921 = "C:\\windows\\system\\HYJC.exe"	HYJC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2707cc24 = "C:\\windows\\SysWOW64\\FQQZX.exe"	FQQZX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\698f2ef8 = "C:\\windows\\VXEPG.exe"	VXEPG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ad0b6690 = "C:\\windows\\SysWOW64\\KTUWQBZ.exe"	KTUWQBZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\913ccec0 = "C:\\windows\\system\\PJHQ.exe"	PJHQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\16ca58f3 = "C:\\windows\\system\\ZGO.exe"	ZGO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f2c66312 = "C:\\windows\\system\\WUE.exe"	WUE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5e3fa3d = "C:\\windows\\SysWOW64\\XCQXS.exe"	XCQXS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5815ed67 = "C:\\windows\\system\\DXPOG.exe"	DXPOG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\698f2ef8 = "C:\\windows\\VXEPG.exe"	VXEPG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aa184b93 = "C:\\windows\\FHQH.exe"	FHQH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fde062b3 = "C:\\windows\\SysWOW64\\XTEMKMO.exe"	XTEMKMO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ce848bc6 = "C:\\windows\\SysWOW64\\SKPLL.exe"	SKPLL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d8409f1e = "C:\\windows\\SysWOW64\\LHMTNU.exe"	LHMTNU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\abcfc438 = "C:\\windows\\CKXTMJE.exe"	CKXTMJE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aa184b93 = "C:\\windows\\FHQH.exe"	FHQH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\51151039 = "C:\\windows\\system\\NIACU.exe"	NIACU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d20d5b09 = "C:\\windows\\system\\UZM.exe"	UZM.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\FQQZX.exe.bat	NJN.exe
File opened for modification	C:\windows\SysWOW64\LHMTNU.exe	MBKP.exe
File opened for modification	C:\windows\SysWOW64\OOTI.exe	VXEPG.exe
File created	C:\windows\SysWOW64\AGPU.exe.bat	FHQH.exe
File created	C:\windows\SysWOW64\XTEMKMO.exe	WTS.exe
File opened for modification	C:\windows\SysWOW64\NJN.exe	CVC.exe
File opened for modification	C:\windows\SysWOW64\XCQXS.exe	DXHP.exe
File created	C:\windows\SysWOW64\OOTI.exe	VXEPG.exe
File opened for modification	C:\windows\SysWOW64\AGPU.exe	FHQH.exe
File opened for modification	C:\windows\SysWOW64\KTUWQBZ.exe	SKPLL.exe
File created	C:\windows\SysWOW64\FVLY.exe.bat	FIDFAFF.exe
File created	C:\windows\SysWOW64\IPJA.exe	LNQFKY.exe
File opened for modification	C:\windows\SysWOW64\TDDKCI.exe	UZM.exe
File created	C:\windows\SysWOW64\NSUKXS.exe	LHMTNU.exe
File opened for modification	C:\windows\SysWOW64\NSUKXS.exe	LHMTNU.exe
File opened for modification	C:\windows\SysWOW64\SKPLL.exe	WUE.exe
File opened for modification	C:\windows\SysWOW64\IPJA.exe	LNQFKY.exe
File created	C:\windows\SysWOW64\TDDKCI.exe	UZM.exe
File opened for modification	C:\windows\SysWOW64\FQQZX.exe	NJN.exe
File created	C:\windows\SysWOW64\XCQXS.exe	DXHP.exe
File created	C:\windows\SysWOW64\XCQXS.exe.bat	DXHP.exe
File opened for modification	C:\windows\SysWOW64\GFJGAL.exe	XCQXS.exe
File created	C:\windows\SysWOW64\GFJGAL.exe.bat	XCQXS.exe
File opened for modification	C:\windows\SysWOW64\JSPVA.exe	BENKWUT.exe
File created	C:\windows\SysWOW64\JSPVA.exe.bat	BENKWUT.exe
File created	C:\windows\SysWOW64\LHMTNU.exe	MBKP.exe
File created	C:\windows\SysWOW64\XTEMKMO.exe.bat	WTS.exe
File created	C:\windows\SysWOW64\SKPLL.exe	WUE.exe
File created	C:\windows\SysWOW64\SKPLL.exe.bat	WUE.exe
File created	C:\windows\SysWOW64\IPJA.exe.bat	LNQFKY.exe
File created	C:\windows\SysWOW64\GFJGAL.exe	XCQXS.exe
File created	C:\windows\SysWOW64\OOTI.exe.bat	VXEPG.exe
File created	C:\windows\SysWOW64\KTUWQBZ.exe	SKPLL.exe
File created	C:\windows\SysWOW64\TDDKCI.exe.bat	UZM.exe
File created	C:\windows\SysWOW64\NJN.exe	CVC.exe
File created	C:\windows\SysWOW64\FQQZX.exe	NJN.exe
File created	C:\windows\SysWOW64\LHMTNU.exe.bat	MBKP.exe
File created	C:\windows\SysWOW64\NSUKXS.exe.bat	LHMTNU.exe
File opened for modification	C:\windows\SysWOW64\XTEMKMO.exe	WTS.exe
File created	C:\windows\SysWOW64\KTUWQBZ.exe.bat	SKPLL.exe
File created	C:\windows\SysWOW64\FVLY.exe	FIDFAFF.exe
File created	C:\windows\SysWOW64\AGPU.exe	FHQH.exe
File opened for modification	C:\windows\SysWOW64\FVLY.exe	FIDFAFF.exe
File created	C:\windows\SysWOW64\JSPVA.exe	BENKWUT.exe
File created	C:\windows\SysWOW64\NJN.exe.bat	CVC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\windows\VXEPG.exe.bat	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
File created	C:\windows\system\JUX.exe	SLSPVK.exe
File opened for modification	C:\windows\system\PJHQ.exe	FVLY.exe
File created	C:\windows\system\LNQFKY.exe.bat	PJHQ.exe
File opened for modification	C:\windows\system\UZM.exe	VFSZH.exe
File created	C:\windows\system\HYJC.exe.bat	CVC.exe
File opened for modification	C:\windows\system\MBKP.exe	HYJC.exe
File created	C:\windows\system\KPY.exe	NIACU.exe
File created	C:\windows\system\WUE.exe	JUX.exe
File opened for modification	C:\windows\system\RJAPLXT.exe	KQQGT.exe
File created	C:\windows\system\ZGO.exe	JUX.exe
File created	C:\windows\FIDFAFF.exe.bat	RJAPLXT.exe
File created	C:\windows\VFSZH.exe.bat	QRRAV.exe
File created	C:\windows\UBWSPF.exe.bat	FQQZX.exe
File created	C:\windows\DXHP.exe.bat	NSUKXS.exe
File created	C:\windows\system\RGSD.exe	KPY.exe
File opened for modification	C:\windows\system\VZUKJM.exe	RGSD.exe
File opened for modification	C:\windows\KQQGT.exe	SLSPVK.exe
File created	C:\windows\system\LNQFKY.exe	PJHQ.exe
File created	C:\windows\CKXTMJE.exe	IOF.exe
File opened for modification	C:\windows\CKXTMJE.exe	IOF.exe
File created	C:\windows\FHQH.exe	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
File opened for modification	C:\windows\system\WUE.exe	JUX.exe
File created	C:\windows\CVC.exe	IPJA.exe
File created	C:\windows\CVC.exe.bat	IPJA.exe
File created	C:\windows\CKXTMJE.exe.bat	IOF.exe
File opened for modification	C:\windows\WTS.exe	AREABR.exe
File created	C:\windows\system\VZUKJM.exe.bat	RGSD.exe
File created	C:\windows\KQQGT.exe	SLSPVK.exe
File created	C:\windows\system\RJAPLXT.exe.bat	KQQGT.exe
File opened for modification	C:\windows\FIDFAFF.exe	RJAPLXT.exe
File created	C:\windows\system\ZGO.exe.bat	JUX.exe
File created	C:\windows\FHQH.exe.bat	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
File created	C:\windows\system\AREABR.exe	OOTI.exe
File opened for modification	C:\windows\system\KPY.exe	NIACU.exe
File created	C:\windows\system\NIACU.exe.bat	WTS.exe
File opened for modification	C:\windows\system\RGSD.exe	KPY.exe
File created	C:\windows\BVWKH.exe	KPY.exe
File created	C:\windows\system\WUE.exe.bat	JUX.exe
File created	C:\windows\system\DXPOG.exe.bat	CKXTMJE.exe
File created	C:\windows\VXEPG.exe	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
File created	C:\windows\LDXX.exe	AREABR.exe
File created	C:\windows\system\SLSPVK.exe.bat	BVWKH.exe
File created	C:\windows\system\UZM.exe.bat	VFSZH.exe
File created	C:\windows\system\MBKP.exe	HYJC.exe
File created	C:\windows\DXHP.exe	NSUKXS.exe
File created	C:\windows\system\IOF.exe	NSUKXS.exe
File created	C:\windows\WTS.exe	AREABR.exe
File created	C:\windows\system\RGSD.exe.bat	KPY.exe
File created	C:\windows\system\BENKWUT.exe	FVLY.exe
File created	C:\windows\QRRAV.exe.bat	KTUWQBZ.exe
File created	C:\windows\VFSZH.exe	QRRAV.exe
File created	C:\windows\system\UZM.exe	VFSZH.exe
File created	C:\windows\system\MBKP.exe.bat	HYJC.exe
File created	C:\windows\system\IOF.exe.bat	NSUKXS.exe
File created	C:\windows\BVWKH.exe.bat	KPY.exe
File created	C:\windows\WTS.exe.bat	AREABR.exe
File created	C:\windows\system\LKZYSV.exe.bat	BVWKH.exe
File created	C:\windows\KQQGT.exe.bat	SLSPVK.exe
File opened for modification	C:\windows\CVC.exe	IPJA.exe
File created	C:\windows\system\DXPOG.exe	CKXTMJE.exe
File opened for modification	C:\windows\BVWKH.exe	KPY.exe
File created	C:\windows\system\VZUKJM.exe	RGSD.exe
File opened for modification	C:\windows\system\BENKWUT.exe	FVLY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3972	cmd.exe
4260	cmd.exe
4772	cmd.exe
4924	cmd.exe
3992	cmd.exe
4664	cmd.exe
4756	cmd.exe
2556	cmd.exe
644	cmd.exe
680	cmd.exe
3088	cmd.exe
4956	cmd.exe
4788	cmd.exe
5048	cmd.exe
4296	cmd.exe
2600	cmd.exe
3980	cmd.exe
1016	cmd.exe
4472	cmd.exe
4112	cmd.exe
1508	cmd.exe
2704	cmd.exe
3288	cmd.exe
3828	cmd.exe
3740	cmd.exe
3236	cmd.exe
4056	cmd.exe
4332	cmd.exe
1536	cmd.exe
1816	cmd.exe
3232	cmd.exe
4968	cmd.exe
4240	cmd.exe
2728	cmd.exe
3936	cmd.exe
4336	cmd.exe
2388	cmd.exe
2708	cmd.exe
3656	cmd.exe
5068	cmd.exe
1852	cmd.exe
1944	cmd.exe
1748	cmd.exe
5008	cmd.exe
4008	cmd.exe
4036	cmd.exe
3748	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4892	1912	WerFault.exe	84
656	3680	WerFault.exe	87
2024	3060	WerFault.exe	91
4480	4528	WerFault.exe	92
4260	4576	WerFault.exe	96
4856	3624	WerFault.exe	95
1512	1504	WerFault.exe	118
1940	640	WerFault.exe	117
3812	4760	WerFault.exe	127
3564	796	WerFault.exe	128
4056	2592	WerFault.exe	129
3524	1064	WerFault.exe	131
3852	2468	WerFault.exe	144
1704	3176	WerFault.exe	147
4276	844	WerFault.exe	152
3144	4724	WerFault.exe	155
2936	1656	WerFault.exe	159
800	4792	WerFault.exe	160
3820	2984	WerFault.exe	161
1652	624	WerFault.exe	163
3816	4884	WerFault.exe	182
3288	3412	WerFault.exe	187
4556	3984	WerFault.exe	191
3684	4692	WerFault.exe	192
824	3156	WerFault.exe	196
1080	4456	WerFault.exe	195
1004	1984	WerFault.exe	207
4376	3228	WerFault.exe	213
1936	748	WerFault.exe	212
4252	2312	WerFault.exe	219
4472	2812	WerFault.exe	222
4840	4780	WerFault.exe	223
4396	3668	WerFault.exe	234
4444	3372	WerFault.exe	237
4856	800	WerFault.exe	241
2644	5032	WerFault.exe	247
3328	3640	WerFault.exe	252
3600	1420	WerFault.exe	253
3508	3436	WerFault.exe	254
4832	4280	WerFault.exe	259
4112	4892	WerFault.exe	258
3560	3216	WerFault.exe	260
4796	2536	WerFault.exe	279
1004	4804	WerFault.exe	280
2296	4980	WerFault.exe	293
3496	980	WerFault.exe	294
1240	60	WerFault.exe	295
4396	2644	WerFault.exe	296
1220	2612	WerFault.exe	298
3900	2064	WerFault.exe	300
5016	364	WerFault.exe	317
3996	4592	WerFault.exe	318
1192	1160	WerFault.exe	325
956	3508	WerFault.exe	328
1980	3092	WerFault.exe	329
4820	3880	WerFault.exe	334
2304	2932	WerFault.exe	335
3500	4748	WerFault.exe	339
3300	3684	WerFault.exe	340
3804	3144	WerFault.exe	341
2056	656	WerFault.exe	360
1292	1368	WerFault.exe	361
2052	4916	WerFault.exe	372
5088	556	WerFault.exe	375

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QRRAV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OOTI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KPY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LNQFKY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AREABR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RGSD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXHP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FHQH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HYJC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FQQZX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LHMTNU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SLSPVK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PJHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LNQFKY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KTUWQBZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXPOG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OOTI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BVWKH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SKPLL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BVWKH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RGSD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SKPLL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NSUKXS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGPU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDXX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQQGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBKP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NIACU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RJAPLXT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FVLY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BENKWUT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PJHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BENKWUT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FVLY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDXX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
3680	VXEPG.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
4576	FHQH.exe
4576	FHQH.exe
3624	VXEPG.exe
3624	VXEPG.exe
3680	VXEPG.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
4576	FHQH.exe
4576	FHQH.exe
3624	VXEPG.exe
3624	VXEPG.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
4576	FHQH.exe
4576	FHQH.exe
3624	VXEPG.exe
3624	VXEPG.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3680	VXEPG.exe
3680	VXEPG.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
3060	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
4528	FHQH.exe
4528	FHQH.exe
4576	FHQH.exe
4576	FHQH.exe
3624	VXEPG.exe
3624	VXEPG.exe
640	OOTI.exe
640	OOTI.exe
1504	AGPU.exe
1504	AGPU.exe
4760	AREABR.exe
4760	AREABR.exe
796	OOTI.exe
796	OOTI.exe
2592	AGPU.exe
2592	AGPU.exe
1064	AREABR.exe
1064	AREABR.exe
2468	WTS.exe
2468	WTS.exe
3176	LDXX.exe
3176	LDXX.exe
844	XTEMKMO.exe
844	XTEMKMO.exe
4724	NIACU.exe
4724	NIACU.exe
1656	WTS.exe
1656	WTS.exe
4792	XTEMKMO.exe
4792	XTEMKMO.exe
2984	LDXX.exe
2984	LDXX.exe
624	NIACU.exe
624	NIACU.exe
4884	KPY.exe
4884	KPY.exe
3412	RGSD.exe
3412	RGSD.exe
3984	KPY.exe
3984	KPY.exe
4692	BVWKH.exe
4692	BVWKH.exe
3156	RGSD.exe
3156	RGSD.exe
4456	BVWKH.exe
4456	BVWKH.exe
1984	LKZYSV.exe
1984	LKZYSV.exe
3228	SLSPVK.exe
3228	SLSPVK.exe
748	VZUKJM.exe
748	VZUKJM.exe
2312	LKZYSV.exe
2312	LKZYSV.exe
2812	SLSPVK.exe
2812	SLSPVK.exe
4780	VZUKJM.exe
4780	VZUKJM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 644	1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe	85
PID 644 wrote to memory of 3680	644	cmd.exe	87
PID 1912 wrote to memory of 2728	1912	03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe	89
PID 2728 wrote to memory of 4528	2728	cmd.exe	92
PID 3624 wrote to memory of 4296	3624	VXEPG.exe	113
PID 4576 wrote to memory of 2704	4576	FHQH.exe	114
PID 2704 wrote to memory of 1504	2704	cmd.exe	118
PID 4296 wrote to memory of 640	4296	cmd.exe	117
PID 640 wrote to memory of 4008	640	OOTI.exe	123
PID 4008 wrote to memory of 4760	4008	cmd.exe	127
PID 1064 wrote to memory of 4036	1064	AREABR.exe	142
PID 4036 wrote to memory of 2468	4036	cmd.exe	144
PID 1064 wrote to memory of 2600	1064	AREABR.exe	145
PID 2600 wrote to memory of 3176	2600	cmd.exe	147
PID 2468 wrote to memory of 3936	2468	WTS.exe	148
PID 3936 wrote to memory of 844	3936	cmd.exe	152
PID 2468 wrote to memory of 4260	2468	WTS.exe	153
PID 4260 wrote to memory of 4724	4260	cmd.exe	155
PID 624 wrote to memory of 680	624	NIACU.exe	180
PID 680 wrote to memory of 4884	680	cmd.exe	182
PID 4884 wrote to memory of 3088	4884	KPY.exe	185
PID 3088 wrote to memory of 3412	3088	cmd.exe	187
PID 4884 wrote to memory of 4772	4884	KPY.exe	189
PID 4772 wrote to memory of 4692	4772	cmd.exe	192
PID 4456 wrote to memory of 3980	4456	BVWKH.exe	205
PID 3980 wrote to memory of 1984	3980	cmd.exe	207
PID 4456 wrote to memory of 1016	4456	BVWKH.exe	208
PID 3156 wrote to memory of 4956	3156	RGSD.exe	209
PID 4956 wrote to memory of 748	4956	cmd.exe	212
PID 1016 wrote to memory of 3228	1016	cmd.exe	213
PID 2812 wrote to memory of 3288	2812	SLSPVK.exe	231
PID 3288 wrote to memory of 3668	3288	cmd.exe	234
PID 2812 wrote to memory of 3828	2812	SLSPVK.exe	235
PID 3828 wrote to memory of 3372	3828	cmd.exe	237
PID 800 wrote to memory of 3740	800	JUX.exe	244
PID 3740 wrote to memory of 5032	3740	cmd.exe	247
PID 3372 wrote to memory of 4788	3372	KQQGT.exe	248
PID 3668 wrote to memory of 1816	3668	JUX.exe	250
PID 1816 wrote to memory of 1420	1816	cmd.exe	253
PID 4788 wrote to memory of 3436	4788	cmd.exe	254
PID 3216 wrote to memory of 3236	3216	WUE.exe	275
PID 4892 wrote to memory of 1944	4892	RJAPLXT.exe	277
PID 3236 wrote to memory of 2536	3236	cmd.exe	279
PID 1944 wrote to memory of 4804	1944	cmd.exe	280
PID 2536 wrote to memory of 4924	2536	SKPLL.exe	289
PID 4804 wrote to memory of 4472	4804	FIDFAFF.exe	291
PID 4924 wrote to memory of 980	4924	cmd.exe	294
PID 4472 wrote to memory of 60	4472	cmd.exe	295
PID 2064 wrote to memory of 1748	2064	FVLY.exe	313
PID 2612 wrote to memory of 4112	2612	KTUWQBZ.exe	315
PID 4112 wrote to memory of 364	4112	cmd.exe	317
PID 1748 wrote to memory of 4592	1748	cmd.exe	318
PID 364 wrote to memory of 3992	364	QRRAV.exe	321
PID 4592 wrote to memory of 5048	4592	BENKWUT.exe	323
PID 3992 wrote to memory of 1160	3992	cmd.exe	325
PID 2064 wrote to memory of 4664	2064	FVLY.exe	326
PID 5048 wrote to memory of 3508	5048	cmd.exe	328
PID 4664 wrote to memory of 3092	4664	cmd.exe	329
PID 3684 wrote to memory of 3748	3684	PJHQ.exe	356
PID 3144 wrote to memory of 1508	3144	VFSZH.exe	358
PID 3748 wrote to memory of 656	3748	cmd.exe	360
PID 1508 wrote to memory of 1368	1508	cmd.exe	361
PID 656 wrote to memory of 4056	656	LNQFKY.exe	368
PID 1368 wrote to memory of 4756	1368	UZM.exe	370

C:\Users\Admin\AppData\Local\Temp\03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
"C:\Users\Admin\AppData\Local\Temp\03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\VXEPG.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\windows\VXEPG.exe
    C:\windows\VXEPG.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 776
      4⤵
      Program crash
      PID:656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FHQH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\windows\FHQH.exe
    C:\windows\FHQH.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 868
      4⤵
      Program crash
      PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1356
  2⤵
  - Program crash
  PID:4892

C:\Users\Admin\AppData\Local\Temp\03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
C:\Users\Admin\AppData\Local\Temp\03f6e97b20abdcf580a834b8effc941e7ab7245a91be661ac82c5ecd3a0d52e4.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 808
  2⤵
  - Program crash
  PID:2024

C:\windows\VXEPG.exe
C:\windows\VXEPG.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTI.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\windows\SysWOW64\OOTI.exe
    C:\windows\system32\OOTI.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\AREABR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\windows\system\AREABR.exe
        
        C:\windows\system\AREABR.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 756
        6⤵
        Program crash
        
        PID:3812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1336
      4⤵
      Program crash
      PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 952
  2⤵
  - Program crash
  PID:4856

C:\windows\FHQH.exe
C:\windows\FHQH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\AGPU.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\windows\SysWOW64\AGPU.exe
    C:\windows\system32\AGPU.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 844
      4⤵
      Program crash
      PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 1260
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1912 -ip 1912
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3680 -ip 3680
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3060 -ip 3060
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4528 -ip 4528
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4576 -ip 4576
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3624 -ip 3624
1⤵
PID:4280

C:\windows\SysWOW64\OOTI.exe
C:\windows\SysWOW64\OOTI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 840
  2⤵
  - Program crash
  PID:3564

C:\windows\SysWOW64\AGPU.exe
C:\windows\SysWOW64\AGPU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 848
  2⤵
  - Program crash
  PID:4056

C:\windows\system\AREABR.exe
C:\windows\system\AREABR.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\WTS.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\windows\WTS.exe
    C:\windows\WTS.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTEMKMO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\windows\SysWOW64\XTEMKMO.exe
        
        C:\windows\system32\XTEMKMO.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 856
        6⤵
        Program crash
        
        PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\NIACU.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\windows\system\NIACU.exe
        
        C:\windows\system\NIACU.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 852
        6⤵
        Program crash
        
        PID:3144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 1324
      4⤵
      Program crash
      PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\LDXX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\windows\LDXX.exe
    C:\windows\LDXX.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 856
      4⤵
      Program crash
      PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1260
  2⤵
  - Program crash
  PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 640 -ip 640
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4760 -ip 4760
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 796 -ip 796
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2592 -ip 2592
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1064 -ip 1064
1⤵
PID:4116

C:\windows\WTS.exe
C:\windows\WTS.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 812
  2⤵
  - Program crash
  PID:2936

C:\windows\SysWOW64\XTEMKMO.exe
C:\windows\SysWOW64\XTEMKMO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 840
  2⤵
  - Program crash
  PID:800

C:\windows\LDXX.exe
C:\windows\LDXX.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 820
  2⤵
  - Program crash
  PID:3820

C:\windows\system\NIACU.exe
C:\windows\system\NIACU.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\KPY.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\windows\system\KPY.exe
    C:\windows\system\KPY.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\RGSD.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\windows\system\RGSD.exe
        
        C:\windows\system\RGSD.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 852
        6⤵
        Program crash
        
        PID:3288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\BVWKH.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\windows\BVWKH.exe
        
        C:\windows\BVWKH.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 852
        6⤵
        Program crash
        
        PID:3684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 964
      4⤵
      Program crash
      PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1268
  2⤵
  - Program crash
  PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2468 -ip 2468
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3176 -ip 3176
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 844 -ip 844
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4724 -ip 4724
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1656 -ip 1656
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4792 -ip 4792
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2984 -ip 2984
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 624 -ip 624
1⤵
PID:4968

C:\windows\system\KPY.exe
C:\windows\system\KPY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 812
  2⤵
  - Program crash
  PID:4556

C:\windows\BVWKH.exe
C:\windows\BVWKH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\LKZYSV.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\windows\system\LKZYSV.exe
    C:\windows\system\LKZYSV.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 856
      4⤵
      Program crash
      PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\SLSPVK.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\windows\system\SLSPVK.exe
    C:\windows\system\SLSPVK.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 848
      4⤵
      Program crash
      PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 952
  2⤵
  - Program crash
  PID:1080

C:\windows\system\RGSD.exe
C:\windows\system\RGSD.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\VZUKJM.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\windows\system\VZUKJM.exe
    C:\windows\system\VZUKJM.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 852
      4⤵
      Program crash
      PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 924
  2⤵
  - Program crash
  PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4884 -ip 4884
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3412 -ip 3412
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3984 -ip 3984
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4692 -ip 4692
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3156 -ip 3156
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4456 -ip 4456
1⤵
PID:3132

C:\windows\system\LKZYSV.exe
C:\windows\system\LKZYSV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 648
  2⤵
  - Program crash
  PID:4252

C:\windows\system\SLSPVK.exe
C:\windows\system\SLSPVK.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\JUX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\windows\system\JUX.exe
    C:\windows\system\JUX.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\windows\system\ZGO.exe
        
        C:\windows\system\ZGO.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 772
        6⤵
        Program crash
        
        PID:3600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 992
      4⤵
      Program crash
      PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\KQQGT.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\windows\KQQGT.exe
    C:\windows\KQQGT.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\RJAPLXT.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\windows\system\RJAPLXT.exe
        
        C:\windows\system\RJAPLXT.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:3436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 912
        6⤵
        Program crash
        
        PID:3508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 964
      4⤵
      Program crash
      PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1280
  2⤵
  - Program crash
  PID:4472

C:\windows\system\VZUKJM.exe
C:\windows\system\VZUKJM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 816
  2⤵
  - Program crash
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1984 -ip 1984
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3228 -ip 3228
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 748 -ip 748
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2312 -ip 2312
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2812 -ip 2812
1⤵
PID:2476

C:\windows\system\JUX.exe
C:\windows\system\JUX.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\windows\system\WUE.exe
    C:\windows\system\WUE.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 872
      4⤵
      Program crash
      PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1212
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4780 -ip 4780
1⤵
PID:1124

C:\windows\KQQGT.exe
C:\windows\KQQGT.exe
1⤵
- Executes dropped EXE
PID:3640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 820
  2⤵
  - Program crash
  PID:3328

C:\windows\system\RJAPLXT.exe
C:\windows\system\RJAPLXT.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FIDFAFF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\windows\FIDFAFF.exe
    C:\windows\FIDFAFF.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVLY.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\windows\SysWOW64\FVLY.exe
        
        C:\windows\system32\FVLY.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:60
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 856
        6⤵
        Program crash
        
        PID:1240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1332
      4⤵
      Program crash
      PID:1004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1288
  2⤵
  - Program crash
  PID:4112

C:\windows\system\ZGO.exe
C:\windows\system\ZGO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 816
  2⤵
  - Program crash
  PID:4832

C:\windows\system\WUE.exe
C:\windows\system\WUE.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKPLL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\windows\SysWOW64\SKPLL.exe
    C:\windows\system32\SKPLL.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTUWQBZ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\windows\SysWOW64\KTUWQBZ.exe
        
        C:\windows\system32\KTUWQBZ.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 764
        6⤵
        Program crash
        
        PID:3496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1236
      4⤵
      Program crash
      PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1260
  2⤵
  - Program crash
  PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3668 -ip 3668
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3372 -ip 3372
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 800 -ip 800
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5032 -ip 5032
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3640 -ip 3640
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1420 -ip 1420
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3436 -ip 3436
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4892 -ip 4892
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4280 -ip 4280
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3216 -ip 3216
1⤵
PID:3948

C:\windows\SysWOW64\SKPLL.exe
C:\windows\SysWOW64\SKPLL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 844
  2⤵
  - Program crash
  PID:2296

C:\windows\FIDFAFF.exe
C:\windows\FIDFAFF.exe
1⤵
- Executes dropped EXE
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 824
  2⤵
  - Program crash
  PID:4396

C:\windows\SysWOW64\KTUWQBZ.exe
C:\windows\SysWOW64\KTUWQBZ.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\QRRAV.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\windows\QRRAV.exe
    C:\windows\QRRAV.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\windows\VFSZH.exe
        
        C:\windows\VFSZH.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:1160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 856
        6⤵
        Program crash
        
        PID:1192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 1324
      4⤵
      Program crash
      PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 988
  2⤵
  - Program crash
  PID:1220

C:\windows\SysWOW64\FVLY.exe
C:\windows\SysWOW64\FVLY.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\BENKWUT.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\windows\system\BENKWUT.exe
    C:\windows\system\BENKWUT.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\windows\SysWOW64\JSPVA.exe
        
        C:\windows\system32\JSPVA.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:3508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 860
        6⤵
        Program crash
        
        PID:956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 996
      4⤵
      Program crash
      PID:3996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\PJHQ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\windows\system\PJHQ.exe
    C:\windows\system\PJHQ.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 844
      4⤵
      Program crash
      PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 1260
  2⤵
  - Program crash
  PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2536 -ip 2536
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4804 -ip 4804
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4980 -ip 4980
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 980 -ip 980
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 60 -ip 60
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2644 -ip 2644
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 2612 -ip 2612
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2064 -ip 2064
1⤵
PID:1472

C:\windows\QRRAV.exe
C:\windows\QRRAV.exe
1⤵
- Executes dropped EXE
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 804
  2⤵
  - Program crash
  PID:4820

C:\windows\system\BENKWUT.exe
C:\windows\system\BENKWUT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 812
  2⤵
  - Program crash
  PID:2304

C:\windows\SysWOW64\JSPVA.exe
C:\windows\SysWOW64\JSPVA.exe
1⤵
- Executes dropped EXE
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 836
  2⤵
  - Program crash
  PID:3500

C:\windows\system\PJHQ.exe
C:\windows\system\PJHQ.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\LNQFKY.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\windows\system\LNQFKY.exe
    C:\windows\system\LNQFKY.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPJA.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4056
    - - C:\windows\SysWOW64\IPJA.exe
        
        C:\windows\system32\IPJA.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 768
        6⤵
        Program crash
        
        PID:2052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 996
      4⤵
      Program crash
      PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 952
  2⤵
  - Program crash
  PID:3300

C:\windows\VFSZH.exe
C:\windows\VFSZH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\UZM.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\windows\system\UZM.exe
    C:\windows\system\UZM.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDDKCI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4756
    - - C:\windows\SysWOW64\TDDKCI.exe
        
        C:\windows\system32\TDDKCI.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        
        PID:556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 840
        6⤵
        Program crash
        
        PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 988
      4⤵
      Program crash
      PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 1268
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 364 -ip 364
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4592 -ip 4592
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 1160 -ip 1160
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3508 -ip 3508
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3092 -ip 3092
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3880 -ip 3880
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2932 -ip 2932
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4748 -ip 4748
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3684 -ip 3684
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 3144 -ip 3144
1⤵
PID:4064

C:\windows\system\UZM.exe
C:\windows\system\UZM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 812
  2⤵
  PID:2020

C:\windows\system\LNQFKY.exe
C:\windows\system\LNQFKY.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 812
  2⤵
  PID:1240

C:\windows\SysWOW64\TDDKCI.exe
C:\windows\SysWOW64\TDDKCI.exe
1⤵
- Adds Run key to start application
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 848
  2⤵
  PID:1036

C:\windows\SysWOW64\IPJA.exe
C:\windows\SysWOW64\IPJA.exe
1⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\CVC.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\windows\CVC.exe
    C:\windows\CVC.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\HYJC.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2388
    - - C:\windows\system\HYJC.exe
        
        C:\windows\system\HYJC.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:4120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 840
        6⤵
        
        PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJN.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:3972
    - - C:\windows\SysWOW64\NJN.exe
        
        C:\windows\system32\NJN.exe
        5⤵
        Creates a file in the Startup directory
        Adds Run key to start application
        
        PID:116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 860
        6⤵
        
        PID:5096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 1336
      4⤵
      PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 952
  2⤵
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 656 -ip 656
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1368 -ip 1368
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4916 -ip 4916
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 556 -ip 556
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 216 -ip 216
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3328 -ip 3328
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4348 -ip 4348
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4972 -ip 4972
1⤵
PID:4240

C:\windows\CVC.exe
C:\windows\CVC.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 808
  2⤵
  PID:3420

C:\windows\system\HYJC.exe
C:\windows\system\HYJC.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\MBKP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4332
- - C:\windows\system\MBKP.exe
    C:\windows\system\MBKP.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in System32 directory
    PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LHMTNU.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:5008
    - - C:\windows\SysWOW64\LHMTNU.exe
        
        C:\windows\system32\LHMTNU.exe
        5⤵
        Creates a file in the Startup directory
        Adds Run key to start application
        
        PID:2808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 848
        6⤵
        
        PID:4224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1300
      4⤵
      PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 804
  2⤵
  PID:2392

C:\windows\SysWOW64\NJN.exe
C:\windows\SysWOW64\NJN.exe
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQQZX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1536
- - C:\windows\SysWOW64\FQQZX.exe
    C:\windows\system32\FQQZX.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\UBWSPF.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:2708
    - - C:\windows\UBWSPF.exe
        
        C:\windows\UBWSPF.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:4060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 616
        6⤵
        
        PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 1000
      4⤵
      PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 960
  2⤵
  PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1704 -ip 1704
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4120 -ip 4120
1⤵
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4940 -ip 4940
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 116 -ip 116
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1292 -ip 1292
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4700 -ip 4700
1⤵
PID:3048

C:\windows\system\MBKP.exe
C:\windows\system\MBKP.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 800
  2⤵
  PID:4116

C:\windows\SysWOW64\FQQZX.exe
C:\windows\SysWOW64\FQQZX.exe
1⤵
- Adds Run key to start application
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 840
  2⤵
  PID:1512

C:\windows\UBWSPF.exe
C:\windows\UBWSPF.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 808
  2⤵
  PID:2176

C:\windows\SysWOW64\LHMTNU.exe
C:\windows\SysWOW64\LHMTNU.exe
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSUKXS.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\windows\SysWOW64\NSUKXS.exe
    C:\windows\system32\NSUKXS.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\DXHP.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:5068
    - - C:\windows\DXHP.exe
        
        C:\windows\DXHP.exe
        5⤵
        Creates a file in the Startup directory
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 856
        6⤵
        
        PID:4652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\IOF.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3232
    - - C:\windows\system\IOF.exe
        
        C:\windows\system\IOF.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:1112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 852
        6⤵
        
        PID:3544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1324
      4⤵
      PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1288
  2⤵
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1648 -ip 1648
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3300 -ip 3300
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2808 -ip 2808
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4060 -ip 4060
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1476 -ip 1476
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4660 -ip 4660
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2580 -ip 2580
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3164 -ip 3164
1⤵
PID:4968

C:\windows\SysWOW64\NSUKXS.exe
C:\windows\SysWOW64\NSUKXS.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 836
  2⤵
  PID:2164

C:\windows\system\IOF.exe
C:\windows\system\IOF.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\CKXTMJE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2556
- - C:\windows\CKXTMJE.exe
    C:\windows\CKXTMJE.exe
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\DXPOG.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1852
    - - C:\windows\system\DXPOG.exe
        
        C:\windows\system\DXPOG.exe
        5⤵
        Creates a file in the Startup directory
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 944
  2⤵
  PID:4488

C:\windows\DXHP.exe
C:\windows\DXHP.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:2476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCQXS.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4968
- - C:\windows\SysWOW64\XCQXS.exe
    C:\windows\system32\XCQXS.exe
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in System32 directory
    PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFJGAL.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\windows\SysWOW64\GFJGAL.exe
        
        C:\windows\system32\GFJGAL.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 924
  2⤵
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1484 -ip 1484
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2072 -ip 2072
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2332 -ip 2332
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1112 -ip 1112
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1976 -ip 1976
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2476 -ip 2476
1⤵
PID:3772

C:\windows\CKXTMJE.exe
C:\windows\CKXTMJE.exe
1⤵
PID:1988

C:\windows\SysWOW64\XCQXS.exe
C:\windows\SysWOW64\XCQXS.exe
1⤵
- Adds Run key to start application
PID:736

C:\windows\SysWOW64\GFJGAL.exe
C:\windows\SysWOW64\GFJGAL.exe
1⤵
PID:2816

C:\windows\system\DXPOG.exe
C:\windows\system\DXPOG.exe
1⤵
- Adds Run key to start application
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LDXX.exe

Path C:\Windows\LDXX.exe
Size 208KB
SHA256 21212eb8ddeaec53751675d702e0228be3250ecdb0f691626f5f68a3f04a2990
MD5 c3e4ff001bccdcb551aed2e62f03a05b
SHA1 b66445641d4a8f50486f3ae2eb6bfb82b42b08d1
SHA512 43859ba31591bbb59fb16d341eb72ad28c18177c71ddd5efe045903d2afe5836b1928829751dea76b932623f455f27f10f62e1e5e01bc3331d6deabb66c86573
SSDEEP 6144:wtBRh6rcdGkBCUpVx5VQr827+rfTkIw55fifB52IgkEj1:wtBBTkH5TIgkC
TLSH
T1FC249D4036A0C2BAE2876B3001E547E566F17C2097B9515FFF423BED49766428CE7BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AREABR.exe

Path C:\Windows\System\AREABR.exe
Size 208KB
SHA256 c0bb197be14550f717d3e7f28d3a1a485ae5dae3518a32d8e7626fbe63dfe9cf
MD5 f1866b16429994beb8000aad3142ea95
SHA1 81127152a53b6e767baa80e599a30f8309a351d8
SHA512 4cf9dc23734a24e9fb55854371f8b96afa08a073c39c5cce614de4b81a1ecf7f78d6fdca448facfc3890de90ab80a97e2d6a39dc69c02477bdf8fa727a55f3a4
SSDEEP 3072:zNRcX2kBv+3IqzU5uUP3e5tqJg9Q4MDl+Q59gIb1H/r62iPu8y8Mo/4pLthEjQT2:n22JYTR3e5wJg9xZQUyfray5QkEj1
TLSH
T139249E4236D2B453EEAB0A3E0CF282AC3B61BC219F51671BB2507FDD987CE544D90B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JUX.exe

Path C:\Windows\System\JUX.exe
Size 208KB
SHA256 cedc43936aa4c519b7a9f7ae92b04c2e6f402f4888916d889cd47c9a6baa6383
MD5 dced22b982cfe42219b650c1ab847411
SHA1 0726a754340c0a966a2b8fba2724636e94b081c6
SHA512 bbe4c6502ba9ccd5d16b62ed7d27e05e76ef17c6feb7206d947ffe8fc749d6d4f6a2083cac89fe28dc8d307461486ae12707683c0b8d75687ec2af80340ada56
SSDEEP 3072:c7fdK5ddcLZlPg6gS3TisugdQJ/lsA/9DaYpXHuR2UBKH4pLthEjQT6j:QfPLZKN8ikFA1+KXHycHkEj1
TLSH
T19C247D91FFA999C7D197463068F1E9602E5EBCE0DF65C16B22D0F36D6DF51286822330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KPY.exe

Path C:\Windows\System\KPY.exe
Size 208KB
SHA256 f5217a867b6dc5ab421370adab8a0d94b744c765e255979db854b00e02b10533
MD5 987c1e636b14d38fa1be325cf0663dd6
SHA1 4dfa555f0c6aaaf5ee286cb9cedc1508caa6bec2
SHA512 ae26ec8a7090cc9d57c53a5ae1e7d304ad20567c78d88afe4324a979482c92de430cbfbaa1e95a77315e54ca36cb724b3d065e301666d555045cdd8ed5ef60d2
SSDEEP 3072:/gzVlYjO3N3sonSaZeoWKOGtTc1KAeUkDXyuQ3BS7Vk4Au3Sz4pLthEjQT6j:/GR7jZeoWKOGjAeJDCuWzVumkEj1
TLSH
T1B0248D43758AC816D4B7C73588F482E07E7EBC917FE241DF7C80336EA8B51488956B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LKZYSV.exe

Path C:\Windows\System\LKZYSV.exe
Size 208KB
SHA256 355721dd990803c6a327077f7c1deca76429905f86b75d1ebc0d3dfa0f780345
MD5 ec85af6edeb8ec33444a9558a4b479e8
SHA1 0691f130e427b2dec86cd5988bf1439160ca3d1e
SHA512 726775434bfe2eb385e9d54e18ead730c0b157145b2ae33fe11494108c8084439bb8f2bb4eb8f4b8d1d2a4b23e020a07de50d6b1ff5c3190729fb253ced2dec4
SSDEEP 6144:TMAsW/uBFihofrmZv6G3iMsd/xZ9qFD6ZyOY90+kEj1:Ybfs3ALkO0kC
TLSH
T11D247E40B6BEC261E0EF173485F1D2A86DB9BC329BB9422B7642F35C2C747661953732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NIACU.exe

Path C:\Windows\System\NIACU.exe
Size 208KB
SHA256 190f822bb1bf353095c66df759653c78aa1bbbc01c450b1a9f81b2bb0f390ca7
MD5 1ca3be56fe99a2e672beb78b859985b2
SHA1 65fac7fa0d91919637c3c5e8b5bc5a48d13280f8
SHA512 504f558f915f2210ac3574900590bf28961fe36f314b9f623412645b66a371bab158116e01750c356e9082d1288f22d8edaeb3e26b8435a625cad936e69a3673
SSDEEP 3072:A7+p5GzdVi4Jf4ScKw/JAFsOOHobO1Z38wJ4pLthEjQT6j:A7+zkLiCQScDJA2OOIbOr3XJkEj1
TLSH
T1E5247C023050C053D26F5631A4EAC6A6DD667E10AFE6332B7584372F5EB2128DC75BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGSD.exe

Path C:\Windows\System\RGSD.exe
Size 208KB
SHA256 22781ecf5ed2ec66f18e54bbfe37eb359474c6b3df6755d631e720f7c2b89a6f
MD5 ac5755728ad250ea7829ade190714e2a
SHA1 b6051fdc3e7e53b1ef6021ed3dd99c9d4c4bdbb5
SHA512 1f39bedab73f9afae4096feda5689a535267953c28cf9b83ea44d39af6ab6298eb8914ccc81e2506739d9be3c71f6803801d03bce9af04c86d085ac7c70df73b
SSDEEP 3072:14MrL/rT7Nv13jr/2b8pKe3/1tV+m7mTxCkPKmSD7odX894pLthEjQT6j:1407Ncowm7mtNV07odM9kEj1
TLSH
T176247C6D7ADEC4C2E09715BD88F656A91BB63D32EF6D410B32023BDD9C331E42950B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VXEPG.exe

Path C:\Windows\VXEPG.exe
Size 208KB
SHA256 3582cb745e94c4f8459b618853bd52a8a2c1550561fce82e1207b324a91da308
MD5 b72d354c73166322f70b54ffd8de2451
SHA1 044a5a35441d0057cb6c750eaa031e112f290bf5
SHA512 3f09bae30f3e6e4b40072bcc5605d759994d39eb2a2e5d18be6ba24703f163233ce8bde5997b30437fd93568959b4d8cc8cc11fd382d501f6c0b871c7a51b1f9
SSDEEP 6144:sJKtxV5dhmR8GSTiMI3VWVkDSxXpMkEj1:sJKtxV5dhmR8pTmASsXukC
TLSH
T147246B42B191D856ECA32B7394E1C7B81D3AFCE29FADD23B224C3B0D6DB1B846481755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTS.exe

Path C:\Windows\WTS.exe
Size 208KB
SHA256 0420dfcfa9e88916160a8d57288e908d9e3e447131dee1957ad37b31cf0d0582
MD5 2c7f687fc014383f39451e9f4da2a5db
SHA1 8d3aa0174779fa5754236b444139754e7b223e7d
SHA512 b46c8c35f752dd0c396694b8a97d0a23b9a368cc1a5414cd14323f434a5c95a52ab0ac9fbbb38d5280d005e50fc46f3538b5a7e631bf73c60bd35bc6cc305bce
SSDEEP 3072:UQIxK7mxCgnKuiGWDJRepgP7WdXNcQ2E01PjXFAKc4pLthEjQT6j:UQIxK7KBnJiLDJQU0XNcQU1PrFA1kEj1
TLSH
T1F4247C42B2518441D2A376388AE14EF82636FC307F755237A64CB31F6E76759F923B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BVWKH.exe.bat

Path C:\windows\BVWKH.exe.bat
Size 56B
SHA256 772caf03be6e984e2597cdeae5e0db3b3038126f6dc2d0d7a0ab76157ef9967e
MD5 2daa84bb80ee62ec248fd73d60b8004e
SHA1 f5e6c7df843a916807f572192972429f0aecb872
SHA512 6410978f164543ea168bacca0911bade85109b3b2d21fa4c85c48fc143c49beab154ee64078f64ea44b93959ecd6a9d0efbae3806476ada87b3a23fb828b04e3
MD5 SHA1 SHA512

Submit Download

FHQH.exe

Path C:\windows\FHQH.exe
Size 208KB
SHA256 986ce725bea08e6259b626b53bd04bd07d7f28255b821aed8d4b5cda80e897c6
MD5 4e7d581b81ea91e0c8930f680563f8f1
SHA1 5cfe988abb5b2bf371d4d432bdb85778c0359c32
SHA512 20afd6e1f35524d1d198101844db042630ccb916c8ab2baa5aa9693b0d0e9beb5377ccac0e75a23a8dc85a9e7338471300404c730d8b13f401c8b0691e62307d
SSDEEP 3072:gW9CO41zW5pZJ5p50uvq2WKW9FYx+zASasdjr2zMYeCoZ3I8p4pLthEjQT6j:giyz+vqftY8BaeH2QYepZ3npkEj1
TLSH
T15C248E197569C416E0A742744CCACB3C2D79BCA17791CB6F3E48B38D28B1398CAB6753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FHQH.exe.bat

Path C:\windows\FHQH.exe.bat
Size 54B
SHA256 9294b6eb1248f498237415afe7b8144b43568dd02146b973cab639feb013c91e
MD5 5ea06a313eda6352f953927126245ebb
SHA1 38a4c940336c7f076e8b47d7b7da05d93ea7c46e
SHA512 efff76a23432246b39908c1fffc27f833b2e6a2170e604dd06a4a4f6929847a40a73425a0cbae213c4cdbb71ea113dfe3a50ffc40f593dcf533dacd33fa5386a
MD5 SHA1 SHA512

Submit Download

KQQGT.exe.bat

Path C:\windows\KQQGT.exe.bat
Size 56B
SHA256 2789981b9bb5080bc6afbd2acd20cd375ac2e12d4137619f02d29b4f516e6c3a
MD5 873feafc229131665e15adc97dd0c3c3
SHA1 866d4c06e3170150f7e039e34a9fdce7f4ed209b
SHA512 273bcd33a821ffc56d3749931ac0b4c71e30927cc59105c59f3ffac2b4a8a5d7dd7439abe898f84aba8d5b47399fe1ef44aa1ffa635035d3e1f09794f0a0feba
MD5 SHA1 SHA512

Submit Download

LDXX.exe.bat

Path C:\windows\LDXX.exe.bat
Size 54B
SHA256 d753d523f4728a51f4c30ce278f28ffb2d3dcb70bd410ff60d05e8cec68a6cec
MD5 184b8dde58ea8e463ccf4080b3131508
SHA1 c631227ab273596d107f079a457aa285cfa364e4
SHA512 279afffcd34793c4f228b2412ad80df4824812496c9485904fbe57a6ecd3e403e43a744d0c7b757751c54b18ab1ab50aa5fd2a9973188a29815f2c3c581ef3c8
MD5 SHA1 SHA512

Submit Download

AGPU.exe

Path C:\windows\SysWOW64\AGPU.exe
Size 208KB
SHA256 c50385151a4428f549febf33e11c78f4969db8c5b9eec4f232a5d57be80a464f
MD5 bbc788a472eec0d910e366bcc9636406
SHA1 a7503c1748c6db8073794f6adaec2b9ffe6e46db
SHA512 2e67f96a9fdb20761dc5cd10c9fa9569589bbf144ddb0db4cc0a96a86702b19d90713ac37c33b446afcc50644d34658cb8ae2fe6d15549e5015faedf3336cf03
SSDEEP 3072:A7/0pUblMDJ83dh15txmJrpon49jTEVXT4k5BDKcwsE7wWDO5bjXSqAxa/+Ij1B6:a/0pURMtRI4ZoV/5AT4jXrA3I0kEj1
TLSH
T1D9248CD133E2E4E5D123473188E9C5642BF5BF71DAB5420FBA6133AE0972B83AC14B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGPU.exe.bat

Path C:\windows\SysWOW64\AGPU.exe.bat
Size 72B
SHA256 2fb30398352e5203ff5c9622068cbed0374c701d7408faf6ac9de4c19f545c6c
MD5 d9d6a35b0ee0ad5a9b0d4a81d686805a
SHA1 e54a5e3e547a09cf1f184b4765b1a6bfde4c70b8
SHA512 1e4926cdb76569a55ec531ee116c0fecd5f3eb3b48e88edb7863591a9c723a5ce16704821822cb6084874fc394e2039381a46b3c88d492a5cc49ca0a8e04d87f
TLSH
T13AA002300AE932F08E2440EDC34A37A0042AF44A03100028929D20C2E004C6BAE22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

OOTI.exe.bat

Path C:\windows\SysWOW64\OOTI.exe.bat
Size 72B
SHA256 727dc3d23eb1c9024bddc57c345845c5d01956677efccd31aad2725b4a503940
MD5 efac3b3766da32ef78d4f718afb63861
SHA1 78410762ade9fed83458c7c83f50521412d68091
SHA512 4226e2b3c520e8a1c3d62193a85305f1d72f1c6b9149e78490401a793171049f0d9905bde7f3e377de093155d3dbebdbc90dbf6ac9c0f7d7ec9a85d95cc15549
TLSH
T115A002B00FE322E08824406DEB4A372884AAF44A83120020129520C2E2044CF8A32CB8
MD5 SHA1 SHA512 TLSH

Submit Download

XTEMKMO.exe.bat

Path C:\windows\SysWOW64\XTEMKMO.exe.bat
Size 78B
SHA256 e4385fccc860cb18139bd6bac69d7a92a74ecc5dc8662502c653c14fbcef3496
MD5 9f643e57860c92a512177cb19bc1e95b
SHA1 c5571fa057e25f825afd3169046dbc26da73bc09
SHA512 9cfa18ea3cf9e00315e88eb0016ef27950ede9a97b02624a286d2a8095102f8a2d4c51976bd2682153257fffa1452e94c792f5f2f38da3a6bd3e29a872cd4a89
TLSH
T11CA0043405C151D0C454545DC74F7F700C15F44DC3541051117513C1D404CC75D10CF4
MD5 SHA1 SHA512 TLSH

Submit Download

VXEPG.exe.bat

Path C:\windows\VXEPG.exe.bat
Size 56B
SHA256 2a7f5679b651a7a555423a99abc8994474d2e2a4d7c25efae79cc0981f9099b7
MD5 2c9c294f437cfb5a343cf4f05dff8e8a
SHA1 d23b94ac4e10768a47fd5e59dc5e011665c43daa
SHA512 33455e4699408ebb1047e5ac339c03c16443ae42c47bca789c50b012f1ccc24f153d121787cf7ce96246572b84fc87e832c17d56a114b19575637ad67ce97314
TLSH
T1719002308AC920C08C244069434A3F00060BF4608292080232D500AA7024443A0088B2
MD5 SHA1 SHA512 TLSH

Submit Download

WTS.exe.bat

Path C:\windows\WTS.exe.bat
Size 52B
SHA256 ec85a8049129b2a5f1b6bbf6484ab20d487155c1bafc5a8b8d3093dc746cde67
MD5 3d6fd1ef4d9555f1abd54244369d2645
SHA1 51d758ccea359fcfcd767c86dc0b82ba747df535
SHA512 122b9c19df2437c65aed57e2e763dbfbb6f0a6664bd6d1062565455e79ef7680dc7d718caa714522a008d2a705e027c40ab4c501accc89652de229af03589673
MD5 SHA1 SHA512

Submit Download

AREABR.exe.bat

Path C:\windows\system\AREABR.exe.bat
Size 72B
SHA256 a27e7a33513ff01f6a1c93470312289b418bc947fce99f78d3d697432faf0a80
MD5 b0e1852999843f555d21786eaca2a79e
SHA1 6460ecd7ceab2e9fe674e45172c7fd79ec0a9ef8
SHA512 6caed0d224f73ead3141e706f275298bb9942eece10bdda1ebe3cf7ea6aaf94a785ff706c497d0bf5f9f7016bcb88f40674fbd6797d92dec517a45f9730e8a15
TLSH
T1A6A002302EC3A0E28824406DE3CA3722042AFC620B18082892950082F0044EB8B308BA
MD5 SHA1 SHA512 TLSH

Submit Download

JUX.exe.bat

Path C:\windows\system\JUX.exe.bat
Size 66B
SHA256 b68283f061531f49e05cec563733cd4cd4f018d259b4f9efee077f35622c9a05
MD5 81ae0aea9d765d7e85e51a7aab0cac13
SHA1 e80e55fd251589814d08d496dd08bd3f9bf1b353
SHA512 69a19506db1b86a2fbee0e8e7e27eb1d06a5f48e20dcb4cf6452440c347509ff79a22d9d22c9553d89d2f62a115720f0af9d169c35a3de5247d387a2c2f938b0
TLSH
T1DFA002300EE120E2AC24406D434A3708842FF4C223B002B092B58082E0044638A20EBA
MD5 SHA1 SHA512 TLSH

Submit Download

KPY.exe.bat

Path C:\windows\system\KPY.exe.bat
Size 66B
SHA256 6f0ee61b18334155f676c1d6cd9e8dcc2eb44920915e83fb27b5d351f34a3c3e
MD5 76badb0acdff54204b592d0d09af8c77
SHA1 6514b5d6e0e71aeb6f2d619efab550ec6dc9b4ba
SHA512 d0deff13e025497ccd304b92af5e4028f65ff75925307d5ad3d0920c80f61b24fd513f0afd3a1687144cf20cf972e7790271bd025ac6c9f2315150c3f7ead77b
TLSH
T134A002300EC123F28824406D434A3F002C2AFC720330002012958882E0244638AE0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

LKZYSV.exe.bat

Path C:\windows\system\LKZYSV.exe.bat
Size 72B
SHA256 539307717715b5c5235b6c7bd48e8eeac1e100cb01e09c97c4b386edc817de5d
MD5 b0aef96c8bf541ac23010f8b9f6c5c65
SHA1 14d754909a5ec22dd5c6fe049e22d339b4c3242c
SHA512 e24f73f0edec4f66560606ecb2e6e05a87aacce132b9044ca685e0e7bdc4ec826d7582cca9c85c0a8dbb1200506c9e3f74746141fd10811988b67794bc857bda
TLSH
T147A002300FC120EAAC2442ED4B4A3702842AF44B03D800A012B502A2E804E738B208F8
MD5 SHA1 SHA512 TLSH

Submit Download

NIACU.exe.bat

Path C:\windows\system\NIACU.exe.bat
Size 70B
SHA256 0838e9c5cce6a889e266a1dffe3d48c105022df8c37185dc3f0f932904bf72b9
MD5 57d5d51b405ac3dfc61505d71575c885
SHA1 844e12984fe7565ce70a6cff987894d02a94e05f
SHA512 8284aa285947d2e313abf4d2fe3fcea0d30a201db8156e535456713c9ceb37a9cdbb2087755f85a3bab2c2170abe9a341a344307bf3782869e01c90fd6a0abeb
TLSH
T133A002300FC120E2A82C40EF436A3700042AF442C31288A2129D20A2E024CEB8A228BA
MD5 SHA1 SHA512 TLSH

Submit Download

RGSD.exe.bat

Path C:\windows\system\RGSD.exe.bat
Size 68B
SHA256 6b9a1fbe2ae325084ca9bf97543234dbbc086eec79a1aee62a7d0f8b95b7d238
MD5 c7df82f3c0df57be4afa8d972d13f1bd
SHA1 ca77951a18e5b5052500c4f6cd7355ab96332013
SHA512 e464fc5695a5bcdabf582369af288102728e69333bedf64103565ce20058bc39fb430f2bdda6de2184e668c4d6a9246466c1e53a9aa07f73af5da5b6698bc0f5
TLSH
T19CA002B00FC1E0FA8824406DC34A3720042AFC4A0332003012950082E0244638B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SLSPVK.exe.bat

Path C:\windows\system\SLSPVK.exe.bat
Size 72B
SHA256 8e58a918e5fa5d75d71297613432f0a4f0625a40407e1c1709adbdc2e9e93f96
MD5 81333e9c7c3981b06625861000257d54
SHA1 ec7943a1b7b6bdeb2161c8544aa77fb25719df2e
SHA512 5729de787c6a5fc7a1a923700c27d16d20269638604ea5a4aabb2e913a6ea0be26aa6b59f0d3e0a2850bf01b5f146d4e725626127a55ab1d57c6751dc02bbf87
TLSH
T1D9A002300EC120F2A824406D4B4AB7800C2AF46B831888E01AB72882E004463EA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

VZUKJM.exe.bat

Path C:\windows\system\VZUKJM.exe.bat
Size 72B
SHA256 8522fd8cf6100cf76cdc75e9fa959d80d949590ecf97a1b525ff5b0982e3e46a
MD5 598b879aa596866151ead2557693a22b
SHA1 dd2ac76797861428e2b22aacaf3ab0a3454e2efa
SHA512 c794b58766a0343dbb78bdbf498ce3945c356ff68dd423f53c0b51c36fcb48a10f32f319e4827407108b7f01eba20382870f668e2ce97df765ca373b3f9ba440
TLSH
T1DCA002380EC320F28824407D43EAB7080C2AFC42831202201B9700C2F004C6B8AB08B8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-343-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/60-352-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/624-159-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/624-140-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/640-80-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/640-55-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/748-242-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/748-227-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/796-88-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/796-73-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/800-265-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/800-301-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/844-117-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/844-143-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/980-351-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/980-340-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1064-78-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1064-118-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1420-290-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1420-304-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1504-56-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1504-79-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1656-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1656-145-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1912-31-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1912-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1984-206-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1984-240-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2064-347-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2312-231-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2312-254-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2468-93-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2468-141-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2536-348-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2536-319-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2592-94-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2592-75-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2612-346-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2644-342-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2644-353-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2812-237-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2812-267-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2984-138-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2984-147-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3060-33-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3060-19-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3156-233-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3156-189-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3176-142-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3176-104-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3216-298-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3216-326-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3228-241-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3228-228-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3372-300-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3372-263-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3412-171-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3412-193-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3436-305-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3436-292-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3624-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3624-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3640-303-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3668-299-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3668-253-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3680-12-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3680-32-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3984-179-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3984-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-297-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-323-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4456-235-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4456-190-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4528-34-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4528-24-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4576-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4576-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4692-183-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4692-201-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4724-129-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4724-144-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4760-70-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4760-81-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-268-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4792-146-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4792-136-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4804-321-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4804-349-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4884-191-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4884-158-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4892-296-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4892-325-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4980-350-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5032-287-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5032-302-0x0000000000400000-0x0000000000438000-memory.dmp

Download