46c73824720601e3e410faafb2a6ad15257eb474d9b685c99d02da7a2ed76eb8

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
Size 208KB
Sample260930-yf8l2atalg
SHA256 46c73824720601e3e410faafb2a6ad15257eb474d9b685c99d02da7a2ed76eb8
MD5 6c0ed4fc57344bff92339fb40a63f8a0
SHA1 66e6f302f233ff09354070352e42d709a94d79f9
SHA512 28314c94a043edeaf3b5c0cdc999fc26707504821dda4b55822ed0d347e5d503ab83c7a780442759976b6ca976d06924f77607bb526d5609e932a961e08aedf5
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+LVfS4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+LV6kEj1
TLSH
T151247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 50 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYQ.exe	VYQ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JUF.exe	JUF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CFFA.exe	CFFA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FSO.exe	FSO.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OJTD.exe	OJTD.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GSAIS.exe	GSAIS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KUIIC.exe	KUIIC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLACL.exe	TLACL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XFJFHLF.exe	XFJFHLF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NACO.exe	NACO.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XVY.exe	XVY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SRR.exe	SRR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RWPH.exe	RWPH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GEFWAPX.exe	GEFWAPX.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MYSS.exe	MYSS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RNCUL.exe	RNCUL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WGIXB.exe	WGIXB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KXHGFQ.exe	KXHGFQ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QPQS.exe	QPQS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADB.exe	ADB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VBUX.exe	VBUX.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BXDEK.exe	BXDEK.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CWXIJSE.exe	CWXIJSE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NPMO.exe	NPMO.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YYH.exe	YYH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OGASIM.exe	OGASIM.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PNGXL.exe	PNGXL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MGBQ.exe	MGBQ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HTSIAFL.exe	HTSIAFL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MOP.exe	MOP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBLIFL.exe	HBLIFL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PUTMPLF.exe	PUTMPLF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TYUIT.exe	TYUIT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVUUU.exe	EVUUU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWNAI.exe	NWNAI.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CHUF.exe	CHUF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WRI.exe	WRI.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MZFPEQ.exe	MZFPEQ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GZFR.exe	GZFR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XPPD.exe	XPPD.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DLJTOKN.exe	DLJTOKN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VPUY.exe	VPUY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FPAJJ.exe	FPAJJ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FCCAF.exe	FCCAF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LNZ.exe	LNZ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VCPOIP.exe	VCPOIP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JRF.exe	JRF.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJYS.exe	NJYS.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GLLYQNG.exe	GLLYQNG.exe

Executes dropped EXE 64 IoCs

pid	Process
3336	TYUIT.exe
2832	EVUUU.exe
4512	WGIXB.exe
5936	NWNAI.exe
6096	TYUIT.exe
5912	EVUUU.exe
5252	WGIXB.exe
1624	NWNAI.exe
5028	XVY.exe
1796	FPAJJ.exe
3672	XVY.exe
4928	KXHGFQ.exe
2036	FPAJJ.exe
3024	KXHGFQ.exe
3136	JUF.exe
1376	CFFA.exe
1280	CFFA.exe
4768	JUF.exe
484	SRR.exe
2912	QPQS.exe
4788	SRR.exe
4796	QPQS.exe
1268	RWPH.exe
2868	FCCAF.exe
3464	YYH.exe
2664	RWPH.exe
5884	YYH.exe
2924	FCCAF.exe
3376	CHUF.exe
4448	ADB.exe
4168	VBUX.exe
4916	LNZ.exe
5572	ADB.exe
4452	CHUF.exe
5532	LNZ.exe
1408	VBUX.exe
5108	GEFWAPX.exe
3620	DLJTOKN.exe
3536	OGASIM.exe
5592	GEFWAPX.exe
2892	DLJTOKN.exe
1640	VCPOIP.exe
5160	WRI.exe
2820	OGASIM.exe
5460	VCPOIP.exe
5552	WRI.exe
1772	HTSIAFL.exe
5824	BXDEK.exe
1468	MOP.exe
732	HTSIAFL.exe
1812	BXDEK.exe
2096	NACO.exe
5420	MYSS.exe
4668	MOP.exe
3880	MYSS.exe
4292	NACO.exe
3372	JRF.exe
4204	MZFPEQ.exe
708	FSO.exe
3296	JRF.exe
4988	MZFPEQ.exe
4092	RNCUL.exe
4068	NJYS.exe
4880	FSO.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\f8c87eb3 = "C:\\windows\\TYUIT.exe"	TYUIT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\11b88aae = "C:\\windows\\CFFA.exe"	CFFA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3e714a9b = "C:\\windows\\QPQS.exe"	QPQS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fd414691 = "C:\\windows\\SRR.exe"	SRR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\f2d55733 = "C:\\windows\\SysWOW64\\NACO.exe"	NACO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\73b1f04 = "C:\\windows\\system\\PNGXL.exe"	PNGXL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\956f74a5 = "C:\\windows\\SysWOW64\\HBLIFL.exe"	HBLIFL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3e714a9b = "C:\\windows\\QPQS.exe"	QPQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\1f9bd23b = "C:\\windows\\FCCAF.exe"	FCCAF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ef396c6b = "C:\\windows\\MZFPEQ.exe"	MZFPEQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5f7ad34e = "C:\\windows\\system\\OJTD.exe"	OJTD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6989759b = "C:\\windows\\system\\GLLYQNG.exe"	GLLYQNG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1a9b38dc = "C:\\windows\\system\\RWPH.exe"	RWPH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\52608be7 = "C:\\windows\\SysWOW64\\FPAJJ.exe"	FPAJJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4afd16ef = "C:\\windows\\KXHGFQ.exe"	KXHGFQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\4afd16ef = "C:\\windows\\KXHGFQ.exe"	KXHGFQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\13377c7 = "C:\\windows\\VCPOIP.exe"	VCPOIP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3d661d37 = "C:\\windows\\GZFR.exe"	GZFR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc758ac8 = "C:\\windows\\system\\NWNAI.exe"	NWNAI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ef85556 = "C:\\windows\\system\\WGIXB.exe"	WGIXB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\11b88aae = "C:\\windows\\CFFA.exe"	CFFA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\94d33527 = "C:\\windows\\SysWOW64\\JUF.exe"	JUF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\3e714a9b = "C:\\windows\\QPQS.exe"	QPQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\13377c7 = "C:\\windows\\VCPOIP.exe"	VCPOIP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\433e37de = "C:\\windows\\EVUUU.exe"	EVUUU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3f26746 = "C:\\windows\\system\\XVY.exe"	XVY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\3f26746 = "C:\\windows\\system\\XVY.exe"	XVY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\183734f6 = "C:\\windows\\SysWOW64\\CHUF.exe"	CHUF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\183734f6 = "C:\\windows\\SysWOW64\\CHUF.exe"	CHUF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\13377c7 = "C:\\windows\\VCPOIP.exe"	VCPOIP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c2859681 = "C:\\windows\\HTSIAFL.exe"	HTSIAFL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f8c87eb3 = "C:\\windows\\TYUIT.exe"	TYUIT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\22c254bc = "C:\\windows\\LNZ.exe"	LNZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\b7b7c5f4 = "C:\\windows\\OGASIM.exe"	OGASIM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\34db33ac = "C:\\windows\\SysWOW64\\JRF.exe"	JRF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3ef85556 = "C:\\windows\\system\\WGIXB.exe"	WGIXB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ef85556 = "C:\\windows\\system\\WGIXB.exe"	WGIXB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\3f26746 = "C:\\windows\\system\\XVY.exe"	XVY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\1a9b38dc = "C:\\windows\\system\\RWPH.exe"	RWPH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\c653f13c = "C:\\windows\\system\\ADB.exe"	ADB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\b5266a7b = "C:\\windows\\system\\GEFWAPX.exe"	GEFWAPX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\13377c7 = "C:\\windows\\VCPOIP.exe"	VCPOIP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7d2e64e8 = "C:\\windows\\MOP.exe"	MOP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\433e37de = "C:\\windows\\EVUUU.exe"	EVUUU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\433e37de = "C:\\windows\\EVUUU.exe"	EVUUU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\7d2e64e8 = "C:\\windows\\MOP.exe"	MOP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\ef992732 = "C:\\windows\\SysWOW64\\FSO.exe"	FSO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ef396c6b = "C:\\windows\\MZFPEQ.exe"	MZFPEQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\31d199b8 = "C:\\windows\\SysWOW64\\RNCUL.exe"	RNCUL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1b7797bb = "C:\\windows\\system\\VPUY.exe"	VPUY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eaefbb71 = "C:\\windows\\KUIIC.exe"	KUIIC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dc758ac8 = "C:\\windows\\system\\NWNAI.exe"	NWNAI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3f26746 = "C:\\windows\\system\\XVY.exe"	XVY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\11b88aae = "C:\\windows\\CFFA.exe"	CFFA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\c653f13c = "C:\\windows\\system\\ADB.exe"	ADB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\d2bdaa94 = "C:\\windows\\WRI.exe"	WRI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5f221ec = "C:\\windows\\BXDEK.exe"	BXDEK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b1a97470 = "C:\\windows\\XFJFHLF.exe"	XFJFHLF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1f9bd23b = "C:\\windows\\FCCAF.exe"	FCCAF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c653f13c = "C:\\windows\\system\\ADB.exe"	ADB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c653f13c = "C:\\windows\\system\\ADB.exe"	ADB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\d26541d5 = "C:\\windows\\system\\MYSS.exe"	MYSS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\31d199b8 = "C:\\windows\\SysWOW64\\RNCUL.exe"	RNCUL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\59604030 = "C:\\windows\\SysWOW64\\NJYS.exe"	NJYS.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\FPAJJ.exe	XVY.exe
File created	C:\windows\SysWOW64\FPAJJ.exe.bat	XVY.exe
File opened for modification	C:\windows\SysWOW64\JUF.exe	FPAJJ.exe
File created	C:\windows\SysWOW64\YYH.exe	QPQS.exe
File created	C:\windows\SysWOW64\YYH.exe.bat	QPQS.exe
File created	C:\windows\SysWOW64\JRF.exe.bat	MYSS.exe
File created	C:\windows\SysWOW64\HBLIFL.exe	VPUY.exe
File opened for modification	C:\windows\SysWOW64\VYQ.exe	GLLYQNG.exe
File created	C:\windows\SysWOW64\JUF.exe.bat	FPAJJ.exe
File created	C:\windows\SysWOW64\CHUF.exe	FCCAF.exe
File opened for modification	C:\windows\SysWOW64\CHUF.exe	FCCAF.exe
File created	C:\windows\SysWOW64\CHUF.exe.bat	FCCAF.exe
File created	C:\windows\SysWOW64\NACO.exe	BXDEK.exe
File created	C:\windows\SysWOW64\FSO.exe.bat	MZFPEQ.exe
File opened for modification	C:\windows\SysWOW64\NJYS.exe	JRF.exe
File created	C:\windows\SysWOW64\NJYS.exe.bat	JRF.exe
File opened for modification	C:\windows\SysWOW64\JRF.exe	MYSS.exe
File created	C:\windows\SysWOW64\VYQ.exe	GLLYQNG.exe
File created	C:\windows\SysWOW64\VYQ.exe.bat	GLLYQNG.exe
File created	C:\windows\SysWOW64\JUF.exe	FPAJJ.exe
File opened for modification	C:\windows\SysWOW64\YYH.exe	QPQS.exe
File created	C:\windows\SysWOW64\FSO.exe	MZFPEQ.exe
File created	C:\windows\SysWOW64\NJYS.exe	JRF.exe
File opened for modification	C:\windows\SysWOW64\RNCUL.exe	MZFPEQ.exe
File created	C:\windows\SysWOW64\PUTMPLF.exe	XPPD.exe
File opened for modification	C:\windows\SysWOW64\PUTMPLF.exe	XPPD.exe
File opened for modification	C:\windows\SysWOW64\NACO.exe	BXDEK.exe
File created	C:\windows\SysWOW64\RNCUL.exe	MZFPEQ.exe
File opened for modification	C:\windows\SysWOW64\FSO.exe	MZFPEQ.exe
File created	C:\windows\SysWOW64\RNCUL.exe.bat	MZFPEQ.exe
File opened for modification	C:\windows\SysWOW64\HBLIFL.exe	VPUY.exe
File created	C:\windows\SysWOW64\PUTMPLF.exe.bat	XPPD.exe
File created	C:\windows\SysWOW64\NACO.exe.bat	BXDEK.exe
File created	C:\windows\SysWOW64\FPAJJ.exe	XVY.exe
File created	C:\windows\SysWOW64\JRF.exe	MYSS.exe
File created	C:\windows\SysWOW64\HBLIFL.exe.bat	VPUY.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\windows\MZFPEQ.exe	NACO.exe
File created	C:\windows\KXHGFQ.exe	XVY.exe
File created	C:\windows\KXHGFQ.exe.bat	XVY.exe
File created	C:\windows\system\ADB.exe	YYH.exe
File created	C:\windows\LNZ.exe.bat	ADB.exe
File created	C:\windows\BXDEK.exe.bat	VCPOIP.exe
File created	C:\windows\HTSIAFL.exe.bat	WRI.exe
File created	C:\windows\system\VPUY.exe	CWXIJSE.exe
File opened for modification	C:\windows\system\PNGXL.exe	NPMO.exe
File created	C:\windows\system\NWNAI.exe.bat	EVUUU.exe
File opened for modification	C:\windows\QPQS.exe	CFFA.exe
File created	C:\windows\system\ADB.exe.bat	YYH.exe
File created	C:\windows\HTSIAFL.exe	WRI.exe
File opened for modification	C:\windows\HTSIAFL.exe	WRI.exe
File created	C:\windows\MZFPEQ.exe.bat	NACO.exe
File created	C:\windows\system\XPPD.exe.bat	PNGXL.exe
File created	C:\windows\system\OJTD.exe	PUTMPLF.exe
File created	C:\windows\QPQS.exe.bat	CFFA.exe
File opened for modification	C:\windows\system\ADB.exe	YYH.exe
File opened for modification	C:\windows\system\DLJTOKN.exe	VBUX.exe
File opened for modification	C:\windows\WRI.exe	GEFWAPX.exe
File created	C:\windows\VCPOIP.exe.bat	DLJTOKN.exe
File created	C:\windows\system\VPUY.exe.bat	CWXIJSE.exe
File created	C:\windows\system\GSAIS.exe	OJTD.exe
File created	C:\windows\KUIIC.exe.bat	OJTD.exe
File opened for modification	C:\windows\system\XVY.exe	NWNAI.exe
File opened for modification	C:\windows\FCCAF.exe	SRR.exe
File created	C:\windows\LNZ.exe	ADB.exe
File opened for modification	C:\windows\system\GEFWAPX.exe	LNZ.exe
File created	C:\windows\WRI.exe.bat	GEFWAPX.exe
File opened for modification	C:\windows\system\OJTD.exe	PUTMPLF.exe
File opened for modification	C:\windows\system\WGIXB.exe	TYUIT.exe
File opened for modification	C:\windows\SRR.exe	JUF.exe
File created	C:\windows\NPMO.exe	RNCUL.exe
File opened for modification	C:\windows\GZFR.exe	NPMO.exe
File created	C:\windows\system\XPPD.exe	PNGXL.exe
File created	C:\windows\MGBQ.exe.bat	HBLIFL.exe
File opened for modification	C:\windows\CFFA.exe	KXHGFQ.exe
File created	C:\windows\QPQS.exe	CFFA.exe
File created	C:\windows\system\RWPH.exe.bat	SRR.exe
File created	C:\windows\system\GEFWAPX.exe	LNZ.exe
File created	C:\windows\WRI.exe	GEFWAPX.exe
File opened for modification	C:\windows\system\MYSS.exe	HTSIAFL.exe
File opened for modification	C:\windows\system\VPUY.exe	CWXIJSE.exe
File opened for modification	C:\windows\system\XPPD.exe	PNGXL.exe
File created	C:\windows\TYUIT.exe.bat	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
File created	C:\windows\OGASIM.exe.bat	DLJTOKN.exe
File opened for modification	C:\windows\NPMO.exe	RNCUL.exe
File created	C:\windows\GZFR.exe.bat	NPMO.exe
File created	C:\windows\system\GSAIS.exe.bat	OJTD.exe
File created	C:\windows\system\GLLYQNG.exe	GSAIS.exe
File created	C:\windows\TLACL.exe	KUIIC.exe
File created	C:\windows\SRR.exe.bat	JUF.exe
File created	C:\windows\system\DLJTOKN.exe	VBUX.exe
File created	C:\windows\BXDEK.exe	VCPOIP.exe
File opened for modification	C:\windows\KUIIC.exe	OJTD.exe
File opened for modification	C:\windows\OGASIM.exe	DLJTOKN.exe
File created	C:\windows\FCCAF.exe.bat	SRR.exe
File created	C:\windows\VBUX.exe	CHUF.exe
File created	C:\windows\VBUX.exe.bat	CHUF.exe
File opened for modification	C:\windows\LNZ.exe	ADB.exe
File opened for modification	C:\windows\system\GSAIS.exe	OJTD.exe
File created	C:\windows\EVUUU.exe	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
File created	C:\windows\system\WGIXB.exe.bat	TYUIT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 49 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe
2116	cmd.exe
4948	cmd.exe
2352	cmd.exe
4392	cmd.exe
3228	cmd.exe
5016	cmd.exe
5804	cmd.exe
5568	cmd.exe
2640	cmd.exe
4408	cmd.exe
476	cmd.exe
1036	cmd.exe
4344	cmd.exe
1580	cmd.exe
4748	cmd.exe
960	cmd.exe
2000	cmd.exe
200	cmd.exe
3908	cmd.exe
1728	cmd.exe
3784	cmd.exe
5076	cmd.exe
5480	cmd.exe
1616	cmd.exe
772	cmd.exe
4704	cmd.exe
3732	cmd.exe
1456	cmd.exe
6092	cmd.exe
600	cmd.exe
4932	cmd.exe
3396	cmd.exe
5196	cmd.exe
1416	cmd.exe
992	cmd.exe
2388	cmd.exe
3700	cmd.exe
1508	cmd.exe
6044	cmd.exe
4072	cmd.exe
4176	cmd.exe
5696	cmd.exe
2848	cmd.exe
4380	cmd.exe
5044	cmd.exe
3480	cmd.exe
944	cmd.exe
5456	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4948	2132	WerFault.exe	89
5788	3336	WerFault.exe	92
2548	2832	WerFault.exe	95
1472	1844	WerFault.exe	99
4668	4512	WerFault.exe	100
4328	5936	WerFault.exe	103
1448	6096	WerFault.exe	107
4888	5252	WerFault.exe	109
4932	5912	WerFault.exe	108
4716	1624	WerFault.exe	111
1216	5028	WerFault.exe	133
2628	1796	WerFault.exe	138
1504	3672	WerFault.exe	142
3412	4928	WerFault.exe	143
4164	2036	WerFault.exe	146
1940	3024	WerFault.exe	147
3376	3136	WerFault.exe	160
4784	1376	WerFault.exe	161
2892	1280	WerFault.exe	168
912	4768	WerFault.exe	170
2700	484	WerFault.exe	175
2364	2912	WerFault.exe	174
4744	4796	WerFault.exe	179
5940	4788	WerFault.exe	178
1488	1268	WerFault.exe	195
4696	2868	WerFault.exe	200
3620	3464	WerFault.exe	201
2976	2664	WerFault.exe	203
5696	2924	WerFault.exe	211
2892	5884	WerFault.exe	210
4552	3376	WerFault.exe	223
4128	4448	WerFault.exe	225
2508	4168	WerFault.exe	234
5984	4916	WerFault.exe	235
3624	5572	WerFault.exe	238
4176	4452	WerFault.exe	239
5584	5532	WerFault.exe	242
3944	1408	WerFault.exe	243
3020	5108	WerFault.exe	260
4988	3620	WerFault.exe	261
724	3536	WerFault.exe	268
4888	5592	WerFault.exe	273
1156	2892	WerFault.exe	274
1684	1640	WerFault.exe	277
3708	5160	WerFault.exe	278
3052	2820	WerFault.exe	280
2076	5460	WerFault.exe	283
3388	5552	WerFault.exe	284
4296	1772	WerFault.exe	305
1216	5824	WerFault.exe	306
3196	1468	WerFault.exe	313
5640	732	WerFault.exe	318
1572	1812	WerFault.exe	321
2444	2096	WerFault.exe	322
3708	5420	WerFault.exe	323
1288	4668	WerFault.exe	325
3224	3880	WerFault.exe	328
4252	4292	WerFault.exe	329
4360	3372	WerFault.exe	350
1412	4204	WerFault.exe	351
5696	708	WerFault.exe	358
2888	3296	WerFault.exe	363
4488	4988	WerFault.exe	364
1288	4092	WerFault.exe	367

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CWXIJSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KXHGFQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DLJTOKN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCPOIP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTSIAFL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NACO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FPAJJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LNZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MZFPEQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JRF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPPD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CHUF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DLJTOKN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OGASIM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJYS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VYQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXDEK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CWXIJSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XFJFHLF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBUX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBUX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLLYQNG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLLYQNG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLACL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GSAIS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XFJFHLF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TYUIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NACO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VPUY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EVUUU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MYSS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUTMPLF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KXHGFQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXDEK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MGBQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JUF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUTMPLF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QPQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YYH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GEFWAPX.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
2832	EVUUU.exe
2832	EVUUU.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
3336	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2832	EVUUU.exe
2832	EVUUU.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
4512	WGIXB.exe
4512	WGIXB.exe
2832	EVUUU.exe
2832	EVUUU.exe
5936	NWNAI.exe
5936	NWNAI.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
3336	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
4512	WGIXB.exe
4512	WGIXB.exe
2832	EVUUU.exe
2832	EVUUU.exe
5936	NWNAI.exe
5936	NWNAI.exe
3336	TYUIT.exe
6096	TYUIT.exe
6096	TYUIT.exe
3336	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
4512	WGIXB.exe
5252	WGIXB.exe
5252	WGIXB.exe
4512	WGIXB.exe
5912	EVUUU.exe
5912	EVUUU.exe
2832	EVUUU.exe
2832	EVUUU.exe
5936	NWNAI.exe
5936	NWNAI.exe
6096	TYUIT.exe
6096	TYUIT.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
3336	TYUIT.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
3336	TYUIT.exe
3336	TYUIT.exe
2832	EVUUU.exe
2832	EVUUU.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1844	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
4512	WGIXB.exe
4512	WGIXB.exe
5936	NWNAI.exe
5936	NWNAI.exe
6096	TYUIT.exe
6096	TYUIT.exe
5252	WGIXB.exe
5252	WGIXB.exe
5912	EVUUU.exe
5912	EVUUU.exe
1624	NWNAI.exe
1624	NWNAI.exe
5028	XVY.exe
5028	XVY.exe
1796	FPAJJ.exe
1796	FPAJJ.exe
3672	XVY.exe
3672	XVY.exe
4928	KXHGFQ.exe
4928	KXHGFQ.exe
2036	FPAJJ.exe
2036	FPAJJ.exe
3024	KXHGFQ.exe
3024	KXHGFQ.exe
3136	JUF.exe
3136	JUF.exe
1376	CFFA.exe
1376	CFFA.exe
1280	CFFA.exe
1280	CFFA.exe
4768	JUF.exe
4768	JUF.exe
484	SRR.exe
484	SRR.exe
2912	QPQS.exe
2912	QPQS.exe
4796	QPQS.exe
4796	QPQS.exe
4788	SRR.exe
4788	SRR.exe
1268	RWPH.exe
1268	RWPH.exe
2868	FCCAF.exe
2868	FCCAF.exe
3464	YYH.exe
3464	YYH.exe
2664	RWPH.exe
2664	RWPH.exe
2924	FCCAF.exe
2924	FCCAF.exe
5884	YYH.exe
5884	YYH.exe
3376	CHUF.exe
3376	CHUF.exe
4448	ADB.exe
4448	ADB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3228	2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe	90
PID 3228 wrote to memory of 3336	3228	cmd.exe	92
PID 2132 wrote to memory of 4344	2132	2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe	93
PID 4344 wrote to memory of 2832	4344	cmd.exe	95
PID 3336 wrote to memory of 1580	3336	TYUIT.exe	96
PID 1580 wrote to memory of 4512	1580	cmd.exe	100
PID 2832 wrote to memory of 2848	2832	EVUUU.exe	101
PID 2848 wrote to memory of 5936	2848	cmd.exe	103
PID 1624 wrote to memory of 5076	1624	NWNAI.exe	131
PID 5076 wrote to memory of 5028	5076	cmd.exe	133
PID 5028 wrote to memory of 5480	5028	XVY.exe	136
PID 5480 wrote to memory of 1796	5480	cmd.exe	138
PID 5028 wrote to memory of 2388	5028	XVY.exe	140
PID 2388 wrote to memory of 4928	2388	cmd.exe	143
PID 2036 wrote to memory of 2640	2036	FPAJJ.exe	156
PID 3024 wrote to memory of 5016	3024	KXHGFQ.exe	158
PID 2640 wrote to memory of 3136	2640	cmd.exe	160
PID 5016 wrote to memory of 1376	5016	cmd.exe	161
PID 1376 wrote to memory of 4380	1376	CFFA.exe	169
PID 3136 wrote to memory of 4748	3136	JUF.exe	172
PID 4748 wrote to memory of 484	4748	cmd.exe	175
PID 4380 wrote to memory of 2912	4380	cmd.exe	174
PID 4788 wrote to memory of 1616	4788	SRR.exe	193
PID 1616 wrote to memory of 1268	1616	cmd.exe	195
PID 4788 wrote to memory of 3700	4788	SRR.exe	196
PID 4796 wrote to memory of 4408	4796	QPQS.exe	198
PID 3700 wrote to memory of 2868	3700	cmd.exe	200
PID 4408 wrote to memory of 3464	4408	cmd.exe	201
PID 2924 wrote to memory of 944	2924	FCCAF.exe	220
PID 5884 wrote to memory of 960	5884	YYH.exe	222
PID 944 wrote to memory of 3376	944	cmd.exe	223
PID 960 wrote to memory of 4448	960	cmd.exe	225
PID 3376 wrote to memory of 2000	3376	CHUF.exe	230
PID 4448 wrote to memory of 772	4448	ADB.exe	232
PID 2000 wrote to memory of 4168	2000	cmd.exe	234
PID 772 wrote to memory of 4916	772	cmd.exe	235
PID 5532 wrote to memory of 6092	5532	LNZ.exe	256
PID 1408 wrote to memory of 5456	1408	VBUX.exe	258
PID 6092 wrote to memory of 5108	6092	cmd.exe	260
PID 5456 wrote to memory of 3620	5456	cmd.exe	261
PID 3620 wrote to memory of 4704	3620	DLJTOKN.exe	266
PID 4704 wrote to memory of 3536	4704	cmd.exe	268
PID 3620 wrote to memory of 5080	3620	DLJTOKN.exe	271
PID 5108 wrote to memory of 476	5108	GEFWAPX.exe	275
PID 5080 wrote to memory of 1640	5080	cmd.exe	277
PID 476 wrote to memory of 5160	476	cmd.exe	278
PID 5552 wrote to memory of 3480	5552	WRI.exe	301
PID 5460 wrote to memory of 5804	5460	VCPOIP.exe	302
PID 3480 wrote to memory of 1772	3480	cmd.exe	305
PID 5804 wrote to memory of 5824	5804	cmd.exe	306
PID 5824 wrote to memory of 200	5824	BXDEK.exe	311
PID 200 wrote to memory of 1468	200	cmd.exe	313
PID 5824 wrote to memory of 3784	5824	BXDEK.exe	316
PID 1772 wrote to memory of 600	1772	HTSIAFL.exe	319
PID 3784 wrote to memory of 2096	3784	cmd.exe	322
PID 600 wrote to memory of 5420	600	cmd.exe	323
PID 3880 wrote to memory of 3732	3880	MYSS.exe	346
PID 4292 wrote to memory of 2116	4292	NACO.exe	348
PID 3732 wrote to memory of 3372	3732	cmd.exe	350
PID 2116 wrote to memory of 4204	2116	cmd.exe	351
PID 4204 wrote to memory of 1456	4204	MZFPEQ.exe	356
PID 1456 wrote to memory of 708	1456	cmd.exe	358
PID 4204 wrote to memory of 3908	4204	MZFPEQ.exe	361
PID 3372 wrote to memory of 4932	3372	JRF.exe	365

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe"
1⤵
- Creates a file in the Startup directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\TYUIT.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\windows\TYUIT.exe
    C:\windows\TYUIT.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\WGIXB.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\windows\system\WGIXB.exe
        
        C:\windows\system\WGIXB.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 904
        6⤵
        Program crash
        
        PID:4668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1348
      4⤵
      Program crash
      PID:5788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\EVUUU.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\windows\EVUUU.exe
    C:\windows\EVUUU.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\windows\system\NWNAI.exe
        
        C:\windows\system\NWNAI.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 880
        6⤵
        Program crash
        
        PID:4328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 1012
      4⤵
      Program crash
      PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 984
  2⤵
  - Program crash
  PID:4948

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-29_6c0ed4fc57344bff92339fb40a63f8a0_elex_emotet_stop.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 804
  2⤵
  - Program crash
  PID:1472

C:\windows\TYUIT.exe
C:\windows\TYUIT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 812
  2⤵
  - Program crash
  PID:1448

C:\windows\EVUUU.exe
C:\windows\EVUUU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 808
  2⤵
  - Program crash
  PID:4932

C:\windows\system\WGIXB.exe
C:\windows\system\WGIXB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 812
  2⤵
  - Program crash
  PID:4888

C:\windows\system\NWNAI.exe
C:\windows\system\NWNAI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\XVY.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\windows\system\XVY.exe
    C:\windows\system\XVY.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPAJJ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\windows\SysWOW64\FPAJJ.exe
        
        C:\windows\system32\FPAJJ.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 840
        6⤵
        Program crash
        
        PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\KXHGFQ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\windows\KXHGFQ.exe
        
        C:\windows\KXHGFQ.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 892
        6⤵
        Program crash
        
        PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1000
      4⤵
      Program crash
      PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 952
  2⤵
  - Program crash
  PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2132 -ip 2132
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3336 -ip 3336
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2832 -ip 2832
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1844 -ip 1844
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4512 -ip 4512
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5936 -ip 5936
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6096 -ip 6096
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5252 -ip 5252
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5912 -ip 5912
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1624 -ip 1624
1⤵
PID:1996

C:\windows\system\XVY.exe
C:\windows\system\XVY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 812
  2⤵
  - Program crash
  PID:1504

C:\windows\SysWOW64\FPAJJ.exe
C:\windows\SysWOW64\FPAJJ.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\windows\SysWOW64\JUF.exe
    C:\windows\system32\JUF.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\SRR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\windows\SRR.exe
        
        C:\windows\SRR.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 844
        6⤵
        Program crash
        
        PID:2700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1400
      4⤵
      Program crash
      PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1360
  2⤵
  - Program crash
  PID:4164

C:\windows\KXHGFQ.exe
C:\windows\KXHGFQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\CFFA.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\windows\CFFA.exe
    C:\windows\CFFA.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\QPQS.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\windows\QPQS.exe
        
        C:\windows\QPQS.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 916
        6⤵
        Program crash
        
        PID:2364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1372
      4⤵
      Program crash
      PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 1324
  2⤵
  - Program crash
  PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5028 -ip 5028
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1796 -ip 1796
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3672 -ip 3672
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4928 -ip 4928
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2036 -ip 2036
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3024 -ip 3024
1⤵
PID:3048

C:\windows\CFFA.exe
C:\windows\CFFA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 808
  2⤵
  - Program crash
  PID:2892

C:\windows\SysWOW64\JUF.exe
C:\windows\SysWOW64\JUF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 832
  2⤵
  - Program crash
  PID:912

C:\windows\SRR.exe
C:\windows\SRR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\RWPH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\windows\system\RWPH.exe
    C:\windows\system\RWPH.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 884
      4⤵
      Program crash
      PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FCCAF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\windows\FCCAF.exe
    C:\windows\FCCAF.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 840
      4⤵
      Program crash
      PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1336
  2⤵
  - Program crash
  PID:5940

C:\windows\QPQS.exe
C:\windows\QPQS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\windows\SysWOW64\YYH.exe
    C:\windows\system32\YYH.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 888
      4⤵
      Program crash
      PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 944
  2⤵
  - Program crash
  PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3136 -ip 3136
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1376 -ip 1376
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1280 -ip 1280
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4768 -ip 4768
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 484 -ip 484
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2912 -ip 2912
1⤵
PID:5196

C:\windows\system\RWPH.exe
C:\windows\system\RWPH.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 820
  2⤵
  - Program crash
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4796 -ip 4796
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4788 -ip 4788
1⤵
PID:5104

C:\windows\SysWOW64\YYH.exe
C:\windows\SysWOW64\YYH.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ADB.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\windows\system\ADB.exe
    C:\windows\system\ADB.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\LNZ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:772
    - - C:\windows\LNZ.exe
        
        C:\windows\LNZ.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 844
        6⤵
        Program crash
        
        PID:5984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1372
      4⤵
      Program crash
      PID:4128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1368
  2⤵
  - Program crash
  PID:2892

C:\windows\FCCAF.exe
C:\windows\FCCAF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHUF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\windows\SysWOW64\CHUF.exe
    C:\windows\system32\CHUF.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\VBUX.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\windows\VBUX.exe
        
        C:\windows\VBUX.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 892
        6⤵
        Program crash
        
        PID:2508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1400
      4⤵
      Program crash
      PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 944
  2⤵
  - Program crash
  PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1268 -ip 1268
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2868 -ip 2868
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3464 -ip 3464
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2664 -ip 2664
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2924 -ip 2924
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5884 -ip 5884
1⤵
PID:5720

C:\windows\system\ADB.exe
C:\windows\system\ADB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 804
  2⤵
  - Program crash
  PID:3624

C:\windows\SysWOW64\CHUF.exe
C:\windows\SysWOW64\CHUF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 824
  2⤵
  - Program crash
  PID:4176

C:\windows\LNZ.exe
C:\windows\LNZ.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\GEFWAPX.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\windows\system\GEFWAPX.exe
    C:\windows\system\GEFWAPX.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\WRI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:476
    - - C:\windows\WRI.exe
        
        C:\windows\WRI.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 840
        6⤵
        Program crash
        
        PID:3708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 1052
      4⤵
      Program crash
      PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 944
  2⤵
  - Program crash
  PID:5584

C:\windows\VBUX.exe
C:\windows\VBUX.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\DLJTOKN.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\windows\system\DLJTOKN.exe
    C:\windows\system\DLJTOKN.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\OGASIM.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\windows\OGASIM.exe
        
        C:\windows\OGASIM.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:3536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 892
        6⤵
        Program crash
        
        PID:724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\VCPOIP.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\windows\VCPOIP.exe
        
        C:\windows\VCPOIP.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 888
        6⤵
        Program crash
        
        PID:1684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1396
      4⤵
      Program crash
      PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1336
  2⤵
  - Program crash
  PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3376 -ip 3376
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4448 -ip 4448
1⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4168 -ip 4168
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4916 -ip 4916
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5572 -ip 5572
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4452 -ip 4452
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5532 -ip 5532
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1408 -ip 1408
1⤵
PID:1692

C:\windows\system\GEFWAPX.exe
C:\windows\system\GEFWAPX.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 808
  2⤵
  - Program crash
  PID:4888

C:\windows\system\DLJTOKN.exe
C:\windows\system\DLJTOKN.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 796
  2⤵
  - Program crash
  PID:1156

C:\windows\OGASIM.exe
C:\windows\OGASIM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 812
  2⤵
  - Program crash
  PID:3052

C:\windows\VCPOIP.exe
C:\windows\VCPOIP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\BXDEK.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\windows\BXDEK.exe
    C:\windows\BXDEK.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\MOP.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:200
    - - C:\windows\MOP.exe
        
        C:\windows\MOP.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 880
        6⤵
        Program crash
        
        PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NACO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\windows\SysWOW64\NACO.exe
        
        C:\windows\system32\NACO.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 844
        6⤵
        Program crash
        
        PID:2444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1336
      4⤵
      Program crash
      PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 952
  2⤵
  - Program crash
  PID:2076

C:\windows\WRI.exe
C:\windows\WRI.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HTSIAFL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\windows\HTSIAFL.exe
    C:\windows\HTSIAFL.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\MYSS.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:600
    - - C:\windows\system\MYSS.exe
        
        C:\windows\system\MYSS.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:5420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 912
        6⤵
        Program crash
        
        PID:3708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 1020
      4⤵
      Program crash
      PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 944
  2⤵
  - Program crash
  PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5108 -ip 5108
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3620 -ip 3620
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3536 -ip 3536
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5592 -ip 5592
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2892 -ip 2892
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1640 -ip 1640
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5160 -ip 5160
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2820 -ip 2820
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5460 -ip 5460
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5552 -ip 5552
1⤵
PID:4204

C:\windows\HTSIAFL.exe
C:\windows\HTSIAFL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 800
  2⤵
  - Program crash
  PID:5640

C:\windows\BXDEK.exe
C:\windows\BXDEK.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 796
  2⤵
  - Program crash
  PID:1572

C:\windows\MOP.exe
C:\windows\MOP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 804
  2⤵
  - Program crash
  PID:1288

C:\windows\system\MYSS.exe
C:\windows\system\MYSS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRF.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\windows\SysWOW64\JRF.exe
    C:\windows\system32\JRF.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJYS.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4932
    - - C:\windows\SysWOW64\NJYS.exe
        
        C:\windows\system32\NJYS.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        
        PID:4068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 880
        6⤵
        
        PID:5300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1384
      4⤵
      Program crash
      PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 1304
  2⤵
  - Program crash
  PID:3224

C:\windows\SysWOW64\NACO.exe
C:\windows\SysWOW64\NACO.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\MZFPEQ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\windows\MZFPEQ.exe
    C:\windows\MZFPEQ.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSO.exe.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\windows\SysWOW64\FSO.exe
        
        C:\windows\system32\FSO.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        
        PID:708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 892
        6⤵
        Program crash
        
        PID:5696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNCUL.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:3908
    - - C:\windows\SysWOW64\RNCUL.exe
        
        C:\windows\system32\RNCUL.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 888
        6⤵
        Program crash
        
        PID:1288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1060
      4⤵
      Program crash
      PID:1412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1356
  2⤵
  - Program crash
  PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1772 -ip 1772
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5824 -ip 5824
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1468 -ip 1468
1⤵
PID:576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 732 -ip 732
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1812 -ip 1812
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2096 -ip 2096
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5420 -ip 5420
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4668 -ip 4668
1⤵
PID:252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3880 -ip 3880
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4292 -ip 4292
1⤵
PID:4492

C:\windows\SysWOW64\JRF.exe
C:\windows\SysWOW64\JRF.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 824
  2⤵
  - Program crash
  PID:2888

C:\windows\MZFPEQ.exe
C:\windows\MZFPEQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 812
  2⤵
  - Program crash
  PID:4488

C:\windows\SysWOW64\FSO.exe
C:\windows\SysWOW64\FSO.exe
1⤵
- Executes dropped EXE
PID:4880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 832
  2⤵
  PID:3108

C:\windows\SysWOW64\NJYS.exe
C:\windows\SysWOW64\NJYS.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\CWXIJSE.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5044
- - C:\windows\CWXIJSE.exe
    C:\windows\CWXIJSE.exe
    3⤵
    - Creates a file in the Startup directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\VPUY.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4948
    - - C:\windows\system\VPUY.exe
        
        C:\windows\system\VPUY.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:3124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 880
        6⤵
        
        PID:3108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 1064
      4⤵
      PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 972
  2⤵
  PID:3920

C:\windows\SysWOW64\RNCUL.exe
C:\windows\SysWOW64\RNCUL.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\NPMO.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:1508
- - C:\windows\NPMO.exe
    C:\windows\NPMO.exe
    3⤵
    - Creates a file in the Startup directory
    - Drops file in Windows directory
    PID:4744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\GZFR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:1728
    - - C:\windows\GZFR.exe
        
        C:\windows\GZFR.exe
        5⤵
        Creates a file in the Startup directory
        Adds Run key to start application
        
        PID:1388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 844
        6⤵
        
        PID:4108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\PNGXL.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:1036
    - - C:\windows\system\PNGXL.exe
        
        C:\windows\system\PNGXL.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:4680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 844
        6⤵
        
        PID:2076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1020
      4⤵
      PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 972
  2⤵
  PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3372 -ip 3372
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4204 -ip 4204
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 708 -ip 708
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3296 -ip 3296
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4988 -ip 4988
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4092 -ip 4092
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4068 -ip 4068
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4880 -ip 4880
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4348 -ip 4348
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1528 -ip 1528
1⤵
PID:4972

C:\windows\NPMO.exe
C:\windows\NPMO.exe
1⤵
PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 812
  2⤵
  PID:5708

C:\windows\CWXIJSE.exe
C:\windows\CWXIJSE.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 828
  2⤵
  PID:912

C:\windows\GZFR.exe
C:\windows\GZFR.exe
1⤵
PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 808
  2⤵
  PID:2844

C:\windows\system\PNGXL.exe
C:\windows\system\PNGXL.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPD.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2352
- - C:\windows\system\XPPD.exe
    C:\windows\system\XPPD.exe
    3⤵
    - Creates a file in the Startup directory
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUTMPLF.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:4072
    - - C:\windows\SysWOW64\PUTMPLF.exe
        
        C:\windows\system32\PUTMPLF.exe
        5⤵
        Creates a file in the Startup directory
        System Location Discovery: System Language Discovery
        
        PID:5584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 840
        6⤵
        
        PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 1364
      4⤵
      PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 944
  2⤵
  PID:576

C:\windows\system\VPUY.exe
C:\windows\system\VPUY.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBLIFL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6044
- - C:\windows\SysWOW64\HBLIFL.exe
    C:\windows\system32\HBLIFL.exe
    3⤵
    - Creates a file in the Startup directory
    - Drops file in Windows directory
    PID:2652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\MGBQ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:3396
    - - C:\windows\MGBQ.exe
        
        C:\windows\MGBQ.exe
        5⤵
        Creates a file in the Startup directory
        System Location Discovery: System Language Discovery
        
        PID:1916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 836
        6⤵
        
        PID:584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1412
      4⤵
      PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 976
  2⤵
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5104 -ip 5104
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4744 -ip 4744
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1388 -ip 1388
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4180 -ip 4180
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1328 -ip 1328
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4680 -ip 4680
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3124 -ip 3124
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4356 -ip 4356
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2428 -ip 2428
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 360 -ip 360
1⤵
PID:3152

C:\windows\SysWOW64\HBLIFL.exe
C:\windows\SysWOW64\HBLIFL.exe
1⤵
- Adds Run key to start application
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 764
  2⤵
  PID:5708

C:\windows\system\XPPD.exe
C:\windows\system\XPPD.exe
1⤵
PID:5808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 812
  2⤵
  PID:4196

C:\windows\MGBQ.exe
C:\windows\MGBQ.exe
1⤵
PID:5996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 804
  2⤵
  PID:1316

C:\windows\SysWOW64\PUTMPLF.exe
C:\windows\SysWOW64\PUTMPLF.exe
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\OJTD.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4392
- - C:\windows\system\OJTD.exe
    C:\windows\system\OJTD.exe
    3⤵
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:5876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\GSAIS.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4176
    - - C:\windows\system\GSAIS.exe
        
        C:\windows\system\GSAIS.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:1568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 844
        6⤵
        
        PID:3340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\KUIIC.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5696
    - - C:\windows\KUIIC.exe
        
        C:\windows\KUIIC.exe
        5⤵
        Creates a file in the Startup directory
        
        PID:2604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 832
        6⤵
        
        PID:5200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 1396
      4⤵
      PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 972
  2⤵
  PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 560 -ip 560
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2652 -ip 2652
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1916 -ip 1916
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5584 -ip 5584
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5808 -ip 5808
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1748 -ip 1748
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 720 -ip 720
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5996 -ip 5996
1⤵
PID:5448

C:\windows\system\OJTD.exe
C:\windows\system\OJTD.exe
1⤵
PID:5636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 808
  2⤵
  PID:3832

C:\windows\KUIIC.exe
C:\windows\KUIIC.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:5132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\TLACL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5568
- - C:\windows\TLACL.exe
    C:\windows\TLACL.exe
    3⤵
    - Creates a file in the Startup directory
    PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\XFJFHLF.exe.bat" "
      4⤵
      Executes a command shell one-liner
      PID:992
    - - C:\windows\XFJFHLF.exe
        
        C:\windows\XFJFHLF.exe
        5⤵
        Creates a file in the Startup directory
        System Location Discovery: System Language Discovery
        
        PID:2076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 1048
      4⤵
      PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 960
  2⤵
  PID:2468

C:\windows\system\GSAIS.exe
C:\windows\system\GSAIS.exe
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\GLLYQNG.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5196
- - C:\windows\system\GLLYQNG.exe
    C:\windows\system\GLLYQNG.exe
    3⤵
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYQ.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1416
    - - C:\windows\SysWOW64\VYQ.exe
        
        C:\windows\system32\VYQ.exe
        5⤵
        Creates a file in the Startup directory
        System Location Discovery: System Language Discovery
        
        PID:1156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1408
      4⤵
      PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 1328
  2⤵
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5876 -ip 5876
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1568 -ip 1568
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2604 -ip 2604
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5636 -ip 5636
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5132 -ip 5132
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5772 -ip 5772
1⤵
PID:5684

C:\windows\system\GLLYQNG.exe
C:\windows\system\GLLYQNG.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4900

C:\windows\TLACL.exe
C:\windows\TLACL.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3484

C:\windows\XFJFHLF.exe
C:\windows\XFJFHLF.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5964

C:\windows\SysWOW64\VYQ.exe
C:\windows\SysWOW64\VYQ.exe
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3964 -ip 3964
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2548 -ip 2548
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4900 -ip 4900
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BXDEK.exe.bat

Path C:\Windows\BXDEK.exe.bat
Size 56B
SHA256 a012876e3f2c09fd89aca29963e1d96c70a9ce579d404f600ca72a4625156062
MD5 c1b8803b6c48b61dff7b2175215c7d83
SHA1 3479a0bd3defee7142c6613d497c69f6bc0a3567
SHA512 ab1f778f9a390bc38a25cce4afceee66fbb27c1c6d717bc76146d1f52802ffb227026d9c649bb179a8a7a52f5359d417b11e3ec0227a5e42f11cd9b5d5b41f92
MD5 SHA1 SHA512

Submit Download

CFFA.exe.bat

Path C:\Windows\CFFA.exe.bat
Size 54B
SHA256 74ead074fd8b5d08fa7b2b1f8dfef603c86133c469437028dc06b2bd1b2d6c15
MD5 72e80dbf8ebcd4df077bb8430804b9d7
SHA1 48849af77247e31736324755b410b239de78429f
SHA512 84a298797310d779018cc0880a79d5857c9447b09c6ac3aa7e59f7cde9d3934281a06903ba790330bc799938354af637892534a31addc84539cd70c9d9359e86
MD5 SHA1 SHA512

Submit Download

CWXIJSE.exe.bat

Path C:\Windows\CWXIJSE.exe.bat
Size 60B
SHA256 9559d2236a4920c59fa51a9b3247734c99139adac8dbee72de358d5f76fc91c9
MD5 5d81fc7d67c94b90c7cad1de085fd415
SHA1 ff9484c3a9da15c30b2967bcad3837c737ffc4d9
SHA512 47a237cec6eda547afd5cacb8811bf0ba8bf39b7ee2fd33d0aa2566767da9bfb4f6f8e10cfd04a51f96219eb24b41b9f07ca45d88316c452ceb50818f50c8d6d
MD5 SHA1 SHA512

Submit Download

EVUUU.exe.bat

Path C:\Windows\EVUUU.exe.bat
Size 56B
SHA256 32534e47db08f18be6520d065b5aae376ec0410c97a22d98a25d71c0c02c9321
MD5 4570d13439ed7690bf627fb31d5113c8
SHA1 72a9c06dfd7637fc04e6b39e9426b250975fd90c
SHA512 e9b0f11b1295548b597c406460c4cac557a528c834393c7b26a9654846a71d9e48b34adf9cecdc508f690cad9431156e14ea30818e1df5d5c790a35f23945d53
MD5 SHA1 SHA512

Submit Download

FCCAF.exe.bat

Path C:\Windows\FCCAF.exe.bat
Size 56B
SHA256 3704dec832345eb7287493840a36a16345b7487a57aab4b65ed84602e86c21b9
MD5 c204b369f00be8426f800d8a860fd03e
SHA1 69e2c5faed1c1c589bc500460cd0161e58b9e523
SHA512 45a3366c4f7c452e431b86ae4facc2bb5b2b67f9013671d3157cbf89b9a290d6d1595e18366bd617ebb71e4db789674ffcd9e102018360583fe3ec65c8d9b5b8
MD5 SHA1 SHA512

Submit Download

GZFR.exe.bat

Path C:\Windows\GZFR.exe.bat
Size 54B
SHA256 060a77e64b0ae20f55317af2e866eb36c4bddc4d91b65d1b61b5655fab62510a
MD5 e8c83c0156f520964f3256fd437290aa
SHA1 bc1691c5f1f2a811817f0bd213055f3c59a8fc2f
SHA512 52f8b8b9c3648c5cdb7b8daf52752e945dc48f20d05d385107e4852f62e30e241bc169aa03be1d8c7313ec33c01290cc34a964395857d2ba1e75086582f9de41
MD5 SHA1 SHA512

Submit Download

HTSIAFL.exe.bat

Path C:\Windows\HTSIAFL.exe.bat
Size 60B
SHA256 9d597bb609c6f133d9ff9f3de06ea68e169f7b96797acef222bffe8943e25ba5
MD5 c0cebc9fce2ab1625e8922f3404e808f
SHA1 99fb6bd645678986141ffdc97d774916ed943f99
SHA512 3d2ab480863f8849e34072a575ec9c2215f031065b24ed40d0edb3cc2cbbdd58c12a9e4f833925b63ed7d3d2b93958fac3c2e951e6c3c1f020a2167d01fb97b9
MD5 SHA1 SHA512

Submit Download

KUIIC.exe.bat

Path C:\Windows\KUIIC.exe.bat
Size 56B
SHA256 7d4a9b1fc9b8c28c4d33aa7c0b226172e239dba4c2470e95358f74286d35568a
MD5 9d40b241d4e568d81fff81a99bbb6764
SHA1 6c9555cad54e418f1e0f913b75aec9e218e4c38a
SHA512 c620db4c86df069febba62946cc261e0b44b148c90cf40b665b8c901a3cc308c4598eb21e052ed810f355c884118339d75562770b2da085ff482550ed8a11267
MD5 SHA1 SHA512

Submit Download

KXHGFQ.exe.bat

Path C:\Windows\KXHGFQ.exe.bat
Size 58B
SHA256 9a93b63b0bd5f48472f19fe44f8daf7c437f1644dfc3c2ebfd9d981ffa8ddbea
MD5 d14ad7e3f9d82407fd4c08218b337707
SHA1 d81ce43b9f80208f11da914fe709fd071a70a849
SHA512 446de25f0d81e327e34411de58a025f51a73e425377326c15cf627770658f6f1c82817575b185eebe97626f1a0adc499c57a1dac7718225fcaa2838e6c8eebc2
MD5 SHA1 SHA512

Submit Download

LNZ.exe.bat

Path C:\Windows\LNZ.exe.bat
Size 52B
SHA256 b0b53197c9755b7c9ab8d6e93c3d297a91d0600e0705df35ffebd86440c4746e
MD5 cdfe7386418e9d0d01b03443fcd711ec
SHA1 dd38b4840892e22bed4a2aa7d48cb1bf9c4f8f51
SHA512 5e5b3e927b460323d9e52acc4e4c0f54203cd164d11bce97e251aab1676ee7ee43ed10d89a275d9a3402ee2622556a4cfb5e7c8962aba014d693d39d8fa86c7f
MD5 SHA1 SHA512

Submit Download

MGBQ.exe.bat

Path C:\Windows\MGBQ.exe.bat
Size 54B
SHA256 ff467b6904382c471f5ade3c0f50814035efef0a5617c1bdfcc051971e954a76
MD5 6ceb4f0b3a292d1b342ce43e4f17c839
SHA1 036f67f8889e8e1cf0eaf64ca1a22bc8a84af5e3
SHA512 14bfb8637bb51be3ef6427e819782443611bbb66eb7334730df3a0d8766f33f882b4f1fc9486a0c4fe87aa80e5b5016266ba41a6bb27dfd26aba1d7c79a88b05
MD5 SHA1 SHA512

Submit Download

MOP.exe.bat

Path C:\Windows\MOP.exe.bat
Size 52B
SHA256 8bb40c5e9c6331f8cbf5d5f1c5cdb276d68264f3d658323e6fa7eba04188cce5
MD5 eaa19e37050028057a03b799e144a1be
SHA1 f5aea06daee5844a1076d6121f268f46db94763b
SHA512 1d3919e30271b6d2e1343e8bdfb6248a9792b9960d36de31213b272433eb4d1d0e2be4bf120f3ebf75b76cc13e0e0bb96ed81980d35cbdb0b6227f74231baede
MD5 SHA1 SHA512

Submit Download

MZFPEQ.exe.bat

Path C:\Windows\MZFPEQ.exe.bat
Size 58B
SHA256 1f383778e9b46882944995915c29e1d7f5d63db25a24993ed17f447d40f95b38
MD5 60826fb2525ee3deea0c7a3a63a04e31
SHA1 7c2b0aeb21d362ce1960ad3a7ed5e561dc280ccf
SHA512 8e32909b130e7cc427d54189458ee5c5c1e71ce5725aec8e4a49aa36241f5aaa43b29931608dbb7b7d37c5e4bd292e61002a931f266bcdedfcbc948db0fc177e
MD5 SHA1 SHA512

Submit Download

NPMO.exe.bat

Path C:\Windows\NPMO.exe.bat
Size 54B
SHA256 06d89da56ccb14e369b34dcf1b699c8ce8b548dfc121f9bc056ed655734c1c10
MD5 835cc12b33f765d9ca097b10e3988251
SHA1 3b88dee8020e4c8d7a99b4a0703ffe11c5f834cf
SHA512 8495d5a93972f26d875b2fd1b16638fcf607e11e0632374b928211a37b95490b28a733f9e6bafa6c04ab234a6e9920ac2d02a21bf1c78df9e741e1ca64d3066b
MD5 SHA1 SHA512

Submit Download

OGASIM.exe.bat

Path C:\Windows\OGASIM.exe.bat
Size 58B
SHA256 50b23289bcc823da1968f1c798f63c2992ee8a0fa6a0797b97ff42be611533e9
MD5 8ca0d4fd22eb37fc0509b5a4d7243b9f
SHA1 d67c81bd1a2c5c35a467ed8db2fa0a7e72103fec
SHA512 dc2ee3e9b4caf4855ac3320b583b990733c856e240f2a023fa612f68823199219791da4b803e665437cd56bc528459c78f46577522a2443ce1e1c7bd790ac226
MD5 SHA1 SHA512

Submit Download

QPQS.exe.bat

Path C:\Windows\QPQS.exe.bat
Size 54B
SHA256 3d00d1fe29e5e1bbeb00b73f0f8960a5f1122bc1232937fb5c1739e2ecf11ff7
MD5 5d6e315c9c6df2f5e67b0010d027a98f
SHA1 20b8737dab7476824c2d18189af1b43fe8489e96
SHA512 4764077d839589f4d770ec2a614140c741261ae7eedfa2fb5487078bad29b9cfa74f9c35d012c29f5f79a0e46566a2518fe9a7bfb78146ff22a8c78efdbe14ac
MD5 SHA1 SHA512

Submit Download

SRR.exe.bat

Path C:\Windows\SRR.exe.bat
Size 52B
SHA256 3616d0f461cf899b22ad1f350f76e69b49b38688b0228db2792b9fc5c0615ebd
MD5 32c8823259c13ed5511564d1a9185557
SHA1 7a47a5df130e8b4f14e7f04429621092b7939d21
SHA512 861b101e7dbb23a3d26e72c27bfb8266e59d10c860187d82c894f2f834924a585c87701b3d44e019ef07b314cc2c12039d19e1f69616e8e8523fd78595706be9
MD5 SHA1 SHA512

Submit Download

CHUF.exe.bat

Path C:\Windows\SysWOW64\CHUF.exe.bat
Size 72B
SHA256 d5ed5084fc0ebe0ba4c2b6657fe46af75a6f2f956e68edf632fcb1ce8810ff20
MD5 655dc2e8b7bba31f21faad7c7bc9492f
SHA1 af220df1de67f5934413e2e46a79bcef2bf54e97
SHA512 946fce95a9247692fe6485389f3554f6fa564a6fedad9068ccffe71e1eae9033545d0431f0f904e60cf9e335468ee02c85696d20aed8f8e30b6c007a02fd1778
TLSH
T1BCA002B00AC132E2C824406DC34A372286AAF4CA031080209295E0C2E00444B8AA0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

FPAJJ.exe.bat

Path C:\Windows\SysWOW64\FPAJJ.exe.bat
Size 74B
SHA256 df53b41b8c4b10aa9c73cfd186ef589428a3af36d17eb5761e783e6fe7e19a26
MD5 6537d2ea4837a9603ae8fc84be844e7e
SHA1 52b39d3b652e76e3baaa859bc9404d23aa355949
SHA512 fd8478c0d1ffb252bd736e37942bc155d1165497326067d2b4bb1616fa226b741cbff9797d4928c90c5a7feb717e6f31d65e99a4f76c5f0b9a2f2ed077b909a7
TLSH
T16FA002300AC328F0882C40EFE3CAB72B0E2BFC4A033020281A9520C2E20444B8A30EB8
MD5 SHA1 SHA512 TLSH

Submit Download

FSO.exe.bat

Path C:\Windows\SysWOW64\FSO.exe.bat
Size 70B
SHA256 d5ffc57c324047b23a0064f230bd2d5bfe32404d6eed661519762f2b7227e6b0
MD5 d5ea76d9a253b260f661d748c8ec0137
SHA1 b935b0e1d9b0b11a63cf01ab6d4b8960879def17
SHA512 7fa39a0fd23617c07bde44fb0ec5f12837ec260d62e5410ecadb9284846883f34697f64d7ec978da0e26e02f099feeeffe0d01ad2de4ae99bc0e49df5b5d488a
TLSH
T10BA002380AC12AF88A24427DCF4AF728042AF44A83102020129522C3F00444B8A30CBC
MD5 SHA1 SHA512 TLSH

Submit Download

HBLIFL.exe.bat

Path C:\Windows\SysWOW64\HBLIFL.exe.bat
Size 76B
SHA256 8543e1102a2fc487a9584d5a7080a31a7883c10e8405036ac32b04095a5cfdaf
MD5 f7a42f3ab368307685d7109818aea0e6
SHA1 2e50f015665a0366161c78f29899022a5d25feae
SHA512 10d08677e58a5b88458e8113ee5fabd11c24c68affd3e70935b09397db2b3e1b511f0e88553829224edf64d66ef49687aa0b217744a06f55ec3c086a786a6eeb
TLSH
T1DBA002300EE120FC8824ECEDC34A3720042AFC4A2B320022129520C2E20644BEA23CF8
MD5 SHA1 SHA512 TLSH

Submit Download

JRF.exe.bat

Path C:\Windows\SysWOW64\JRF.exe.bat
Size 70B
SHA256 c124388234f7d7caf1a5bd834b17c5ef5ccacdd520265c38b63a3dad5676e1a0
MD5 16720236ca6e0351f89541c06900e60c
SHA1 d096ed3cb47a2f5f876ee6009200842be4f2cfab
SHA512 451ad634861e4f2ff4485dae967c14ceb4bd886634fe03c2238e306beb056dfbabf8d7986b8cc77077040633354deaf964701827a0e818dd4fded8d5e1081500
TLSH
T137A002300AE130E0C824406DC34B372B04BAF66B0310022092B520C2E00444B8AA0CBE
MD5 SHA1 SHA512 TLSH

Submit Download

JUF.exe.bat

Path C:\Windows\SysWOW64\JUF.exe.bat
Size 70B
SHA256 a1c3231c6e6c6af35896edd1d00af6eee79a2a9e4e0f4f715020846e2852c58d
MD5 d00bd537d8d99408a5d72556c51e62a4
SHA1 d41715cd7dbd11bad743cd9bdce51a18fec6f952
SHA512 ed39f8352212f70187c4003b742da0fcc494cc38888a5e108dc0b2c259cf0243e4a05d8d0c4d2c154137eee00b8f18aa9756d7517c5dedcdbb253f7d0b8c1786
TLSH
T19CA002300AE130F0C824406DC34A372204AAF64B039000209295A0C2E00444B8AA0CBE
MD5 SHA1 SHA512 TLSH

Submit Download

NACO.exe.bat

Path C:\Windows\SysWOW64\NACO.exe.bat
Size 72B
SHA256 32c38ac4c87015c81320af06bf4c098b19890609d12802a0b0d0151f64bb34b8
MD5 773267409e43cd768c218214c75d5e2d
SHA1 d9eb87a6167a4434aacf0948ccc2c087573ac4fa
SHA512 b0725f103e9048b9639e3f10d4e38237476802620d205f7af07b6c57f003bc5cbd42ca0a6c9df0fa8c5f1478541bb5260b6ba122a0f240fb4e9d06b318968a1a
TLSH
T1E5A002380AC122E08A24406DC34AB730843BFC4A831000A0939D20C2E00444BCAE0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NJYS.exe.bat

Path C:\Windows\SysWOW64\NJYS.exe.bat
Size 72B
SHA256 167c59901f7a5654167d093aa673de8915e1784cd2800f15778922827eac153e
MD5 24aec50361c5f14c1317262ef2a01eeb
SHA1 92d45fae25e0cdc4e5b3a7db680b57d63446971e
SHA512 1ee5edda06f51f222ae5f84879c1dc72bce4c138c4332d523d90eb329fc4e340248d1054c9518c19172ce92edee01513047f4c350865f059a503cce4842ad6b7
TLSH
T132A002308AEB20E08824406DE34A37202C3AF44E231000A01295E0C2F00C46BCAB0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

PUTMPLF.exe.bat

Path C:\Windows\SysWOW64\PUTMPLF.exe.bat
Size 78B
SHA256 a4bc7773d28985df2bdf8645f4fbbf2db87a19829ebcf7d1062545eb1a7a134f
MD5 6e59d89788a3c3171c9d2e45453cddf0
SHA1 3f70324fbd628a6ced1e9c01106ba645720ba601
SHA512 9a942b69b61a0bfee35e124bbe319d1fc2263f436f16cc08df60149c09493de6be5de90fa580398940dd0c445b34993866e919bc457f8ebd98a179abf2248106
TLSH
T1C9A002300AC330F0C824406DE34F3F3A242AFCEB0B328020129522C2E004C4B8EE8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

RNCUL.exe.bat

Path C:\Windows\SysWOW64\RNCUL.exe.bat
Size 74B
SHA256 9f2d81dffdf18174acec17ea3e72f3541be00e54c78ec0d266693bb37f64283c
MD5 4ab8853499e4f48af5eb6986248f8c87
SHA1 91c66d03a91795bb9fb5ec4b07f6bbb7976b016e
SHA512 4c854d02c52e23de064a946ac635cc9532f28c903d67494276d16d6980c2940785eb8264ed7fd90881b668ee47138cdf79eccfc117c472512b25df7c1d6073b0
TLSH
T11CA002300AC120EA882CC86DC34A3720042BF64A0312002892D5E0C2E0044CB8E28CBC
MD5 SHA1 SHA512 TLSH

Submit Download

VYQ.exe.bat

Path C:\Windows\SysWOW64\VYQ.exe.bat
Size 70B
SHA256 a1cabd3f320a867a7c5177a2d20b1de2983c359faa0d7894fea822b368032109
MD5 3b9f5625a3163a9b97ea9a099cf0f931
SHA1 3d96ffa33f9e88358b52861ea52bf9d7923c4e83
SHA512 4ac34e8d95678f145a59ee828979c02c592d769b9704f9fba2327d5588dd15035057c49bf0a4702c3c7c42a6d845a59d554287c54028745a632b3ccada458a78
TLSH
T1A0A002300AC120E08824426FC34B37A0242EF44A031000281B9520CAF0064CB8A28EB8
MD5 SHA1 SHA512 TLSH

Submit Download

YYH.exe.bat

Path C:\Windows\SysWOW64\YYH.exe.bat
Size 70B
SHA256 0b4d912d459fb7aa5b8573871815791a16057eda9f026a4396d4bc9780d10ba2
MD5 8abe54dbffb759c30e9b5048baa5ed9f
SHA1 32c0655339decdeb493b9b6f805acd2d9f7367f2
SHA512 da71b0ec4ffcc267488a028d3b22faaff7d29cb339bba17abda15ff4ffece114fa7e6ff80bb8ba505be8589445228ff280ecc4e1b4b6c7460b25e3b15d61533b
TLSH
T12DA002300AC120EC8824406DC34A3730242AF44A03102020139530C2E08446F8A28EB8
MD5 SHA1 SHA512 TLSH

Submit Download

ADB.exe.bat

Path C:\Windows\System\ADB.exe.bat
Size 66B
SHA256 a7bd53bfd5635d5ae4b805eb4e5b227a99df1c9c6405e7de4dc872460550aec1
MD5 d79a912b9904173d538ffda91bffb134
SHA1 1eba1b855f4fdff801d74c424cb6f588c4d77bfd
SHA512 d733adddc214e0ba6dbd09bbf7b3acb66171f8780bc2bc443a27a9737ac6a99aaf1822aab4f0a73782d056198038fd680ad88f5f1c548aeb13c260e75dd2a77d
TLSH
T1E7A002300FCB2CF28826406FC34A3700042AFC420318002813950082E0064E38F208B8
MD5 SHA1 SHA512 TLSH

Submit Download

DLJTOKN.exe.bat

Path C:\Windows\System\DLJTOKN.exe.bat
Size 74B
SHA256 03497578b1e860af6185d635b35a6ddfdfcaeff36dd028a26d4f05b38f0fe33c
MD5 34b95cae46e7d17940e53f47d3c79f0a
SHA1 fcbaacf8514aa1ffb6112e8f9b51c7c1253ca26c
SHA512 418034661ebe9400914040a4a2678620c373bfb1c1bdf446e8615b0c1a5b6267f810f510920f0ca0b707eaf3d11e2adb40c6fe6fc1eaafd8b4e83187ee4c11ec
TLSH
T1BAA002300EE320E2A83442FF434A370004AEFC6303B28022BED70CA3F0044738A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

GEFWAPX.exe.bat

Path C:\Windows\System\GEFWAPX.exe.bat
Size 74B
SHA256 76fac3a9551b52996245f9812cb73a881fab316d6454de830a6946b25d814f70
MD5 c133b1cb82459da49ce4e3be108d449e
SHA1 c017271449116384b91d366bf324f414d4ab94e6
SHA512 36b3b2b3ec9618b225ed6f7a90d18923b9c7c2f89a74e6d7c08cf1e5ad7be879b4240b98525f1b3b7fc9d80c01dd4cc8490ae1ee3c4dd08a3a665cb40e0cdb0f
TLSH
T110A002300EC922EAACA4406D634A3F08842BF4C2031002A092970082E024C638A30EBA
MD5 SHA1 SHA512 TLSH

Submit Download

GLLYQNG.exe.bat

Path C:\Windows\System\GLLYQNG.exe.bat
Size 74B
SHA256 3777a20d51f2dd3df8abb7e759eeb82b739e01f4cc51756ffe2364aed77b8a79
MD5 f6f65f6a43149eeedad909cd177b35e4
SHA1 f3533b33d50faa142b7e74e4822bdb0ef03ba2e0
SHA512 7d8dce04eb25095b6d3e4a5b74e2d5c3f0aa4b931985513940789295a7aa9074f512cf5c08ce22a9bc61ac7158df2e9bd01ce1d7572d5394366d122846eb1113
TLSH
T150A002320EC9A0E28C36606DE34A37000C2BF443233880201AD5008BF084463CA28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GSAIS.exe.bat

Path C:\Windows\System\GSAIS.exe.bat
Size 70B
SHA256 7ea1ff9e9eb819ebe2a750e343b858c2878b29daf622f535898b5bbb628b0108
MD5 0c995361d2c948eef4d205b092e2312a
SHA1 0a4bae147625829a2a0747523fed0ac8b9221614
SHA512 d789aee9f72629a3374f815ba4bd358730e35c621d624908594581ccc1133dbfc32eb7ba75c59899653cf983d91e7c5e54c6e3410644aff5765664446dcccc10
TLSH
T15DA002300EC130E28C24406D734B3700042BF442833088201295C283E02C4638E308F8
MD5 SHA1 SHA512 TLSH

Submit Download

MYSS.exe.bat

Path C:\Windows\System\MYSS.exe.bat
Size 68B
SHA256 5ed718da4854fe107e52baa4ce5835725d7c6c762fe65f187c7b83060fdab850
MD5 6aa6bb3dfd5245468f9df037bdeb0f38
SHA1 772e2e1d3dbcef0dd41bca745cfde6451436a9f8
SHA512 fec4de9babe588b6a1ce5ffeefafe881a755a3c1cc4cad5772b7765220e2d00c06e282ee4189ff4ee3b1b8c6f55bfcca687cf4f08b89d40c0a3c9bf138334021
TLSH
T16DA002308EC128FE8A24406D434A3700042BF44203900020129DC0A2F80C4E38A20BB8
MD5 SHA1 SHA512 TLSH

Submit Download

NWNAI.exe.bat

Path C:\Windows\System\NWNAI.exe.bat
Size 70B
SHA256 80bc1c24dadc926f56a38611420bb01f68ab66b36e3a252af42321d58cf8ed66
MD5 63a267a66bd88b2522a536c423bb415a
SHA1 023de9419a94b42b65b77f248864465b48578758
SHA512 c13b5405fda8898ff737a0d8bb2773c1a5cf4fc6fedb0a03c4fb1c2b032cb77ee122fa2781c02935d1dcb40a1bab32e48afdd4916b0ac4a66202ec4fb96debd3
TLSH
T18BA002B28FE322EA882440ED4B6A370084AEF4420398083012958082E0044638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

OJTD.exe.bat

Path C:\Windows\System\OJTD.exe.bat
Size 68B
SHA256 80fa48013c0303fc25056b8c4d3610f83825eedca92d4bd0244f27bfa3eac65f
MD5 be03b7d4b37cab6cf386af41254ade80
SHA1 90c272494995a70561b63a88811949cd26c430ba
SHA512 11933b8b8ce6c5cd8f795961f278e75ffd53080c03003a6a135c8d4f3f4a98960127db308b6e20789b96780b4e19e643ebdc6a0e67956f8584f0965df23c20da
TLSH
T115A002300FE3A2E2C826406F434A37000C2AFC620310083013950082F204463CB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

PNGXL.exe.bat

Path C:\Windows\System\PNGXL.exe.bat
Size 70B
SHA256 e82856e0344c49c1efda58cc8aa3a0e43f4f50df2aaed06bd06fd54473ae2973
MD5 4c1b6ecde8bb1376f149cf451fff62fb
SHA1 073cd786c9aa7d8dc6a38a4321928c0032a7c658
SHA512 6472cc7ec5a02923017e2c5693d51556240479ccf795f896be67b5c0e6784d9516f0b99a5f740a12dfc1a5f06f25afdeed76928486553e30732be65ad976bf21
TLSH
T1A4A002B80EC320E28824C86D43CA3700042AF462231000E8129D0082E00C6638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

RWPH.exe.bat

Path C:\Windows\System\RWPH.exe.bat
Size 68B
SHA256 73dee97a75c95b9ee0d0eea21ce12c3ff5dabec3828fe0cba067d342b21c02b8
MD5 1281437e0e31d765139cb0ad1c6ccbe0
SHA1 7d1953f806e30e1f85790d7f61e5b052ffd5aa2f
SHA512 2b3a180b766ec4aecaa6e3cfe14ce5768a6683f6f28a808a9573536122e87a815d74c74cbdc7d6cd2c40aab89c982d97d425ad466a13cb5f930f1c71d08c8439
TLSH
T107A002382EC120EA8824626D43CA3720242AF4420310002013F580C2E0844738A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

VPUY.exe.bat

Path C:\Windows\System\VPUY.exe.bat
Size 68B
SHA256 21339464690ed1b6704e9e7154deda5e094aa9eef75212da4011baad686bdb66
MD5 a29a35d26f20e64bcf0193cfcfedc159
SHA1 4fb11c114a46f1799c6902eb454db1a564500377
SHA512 ab17680bcdac7d072749c8259a3c4378ce1f156148fb0fde085c178658bd7afb1a0af18b81e23d36004189e02e2c1533ce2a873c4648ecdfdc5c13aff2863346
TLSH
T1F2A002300EC122E28824C06D436AB700042BF4420B3803209B978082E0044738AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

WGIXB.exe.bat

Path C:\Windows\System\WGIXB.exe.bat
Size 70B
SHA256 09004c324efc433d999237cec66410418d6562321f6a3c68644f26b8d9dbef8f
MD5 7dc6c3b15c2a2b59f091372e798b56a9
SHA1 3850bd08e430d6c6875a8c6d6bc48afa6e67d7d7
SHA512 213cfd7d66bf9c8220979b65128210756654a76ec7be35a453d7cf528f29d0f04525a76c4d0ba4623b82edf5d6f9db04000e60f1bb06195a60167c98871392c7
TLSH
T13EA002302EC920E2C826607D43CB3F20242AF64203120030129500C2E004473AE20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

XPPD.exe.bat

Path C:\Windows\System\XPPD.exe.bat
Size 68B
SHA256 284c35f69d9e0dcaa2ea6527b9de87351fe04739d3a20f23685f43eda42e679f
MD5 ca15c93d33c49585b4f64b2d17d72aa3
SHA1 8b38629525125a175eecf1ecb29bc1aee231f7b0
SHA512 80ad862f6809fa90431eef336495c982fc9c91eca7f5395a1b4a781a78349502a317820f585cebb3753d7f726a1eec50dbbcf53ab81c41127b9f512c4ec24649
TLSH
T10EA002320EC1B0E2A82C606DC34A3702242EFF420330003013970082E2246738B208B8
MD5 SHA1 SHA512 TLSH

Submit Download

XVY.exe.bat

Path C:\Windows\System\XVY.exe.bat
Size 66B
SHA256 adbacffe923eee6f6976f0823f8fa80ed9a2b1862cf271ea0b5de80b2d9f5f7b
MD5 edaa276378daf4295b9c73abf9d17d9c
SHA1 46369740d6e0b44008db0eb5191363d28d9fefcb
SHA512 8eeb8e2541a71b98c9f27d23b89b40aa45a63e435eff71d80e0223e9b7307c8b204f1ad9e30643bdcd3ca93da8c4e6c1162b313474bcb992f89abd77607447e6
TLSH
T119A002300EC120E28C3440ED4B4A3700343EF44A031020B813950082F2A466B8AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

TLACL.exe.bat

Path C:\Windows\TLACL.exe.bat
Size 56B
SHA256 acde6a81f1d994d1b2a1eed4d2c8f16971dfa1ecc0834de8ac50bbacb8e4cb89
MD5 ff2ebd6a16dce8cd61d0f705fb5a2c28
SHA1 2424b90c2c50a0fd431435da2ad22da48c0258ff
SHA512 011af027abde877e2d44fcdbe33dc4f927c7344ee4bae8d195c966cccb26e66326b300db3fb80227d7ccf502edd4199d99917174b5d4d4d96d77d46048c15136
MD5 SHA1 SHA512

Submit Download

TYUIT.exe.bat

Path C:\Windows\TYUIT.exe.bat
Size 56B
SHA256 9f7aa7f8f25117632d3b3107816689843979a29d3d100bb9e50419e6cdd4bbc2
MD5 f6796f654434defd08af7a27740d115d
SHA1 7b2934333a273493c44fbac2a8bd4b045dd4b291
SHA512 594e11a957c9fea4a388023fb21870b4494763bb0a43e3e6de208c9e1c6f5c0ba176a7e163a406d67d8b07f93fe974102794abc9bec8d1c3360d8ddfb90c8904
TLSH
T1EB9002308AC128E088244869434AB7A0240AF642821003E0121720827004C4380202B0
MD5 SHA1 SHA512 TLSH

Submit Download

VBUX.exe.bat

Path C:\Windows\VBUX.exe.bat
Size 54B
SHA256 a6065600f0f2007fa8ad47341ea5c2005f96bd7a01b906e3ba9ec3659cd2a57f
MD5 a1641d20907b02cb3f282a87a25154c4
SHA1 2f89126a351336d7728b6bbf6f53cf9eb9fb8f9c
SHA512 81304bd51e55a68a59c14992672e6b7fa67ff2bb0da6ddc338bcfc52f6a0415c2698f0bc0d8f7295178058fd470eb15f794306a6fd647e9da31e24eb78b09c7a
MD5 SHA1 SHA512

Submit Download

VCPOIP.exe.bat

Path C:\Windows\VCPOIP.exe.bat
Size 58B
SHA256 9dbd6332f3d9bf17365b278684ead18c95bc8a642866717aac10f4a434ef2249
MD5 a3088d9dd07cb6557e22c3897e80841d
SHA1 133969e106e6439b352f52ccf5627d5f06c9b96e
SHA512 12a334d94ce2648ec7d7f712672ea5ae15b5c9fafc90087daca652cfba879ce3e7a3334b311bfa9546d3403d55754fd2f1a737c8c9a176618e78acf6d504ae0d
TLSH
T1B1A0023A08C32ACAA824404B434B3700860AF448C232200A123520BAE0044C3C020CF2
MD5 SHA1 SHA512 TLSH

Submit Download

WRI.exe.bat

Path C:\Windows\WRI.exe.bat
Size 52B
SHA256 bed3dd4c2a3af1ccb2248d482132327fedfcda88f458419aa0372efc98e39c5e
MD5 025863114244ddd03d1191204d132da7
SHA1 b1e6eb43215571dbd280dc224ab9315d685f0708
SHA512 5e5318fd102cadff3d40b3bdd1b0374cab302b3d1fdc889b71dec977016be542343f2d100e9cba16aae022ab9138e470f368819bc7fb8e96a89c3c7a5044ae8c
MD5 SHA1 SHA512

Submit Download

XFJFHLF.exe.bat

Path C:\Windows\XFJFHLF.exe.bat
Size 60B
SHA256 ff598d532d09fadad4189e0d59def3a5fe153c4c7f4574932ac8fcaa867dbd87
MD5 50383ecaf7803ea7c7abb4d0838bd631
SHA1 d6a3012703d44355dc1ca0ec093bfe0c0709935e
SHA512 6ea6b4de7fabb21d77bc479d4b763c0ce35f0a497c4ca0c4d056a31dfddbd2177bfd12f4def2b4269cbd4f3fb9b529adec785f5ace55a7610d0f18f1e5bac691
TLSH
T123A0023008CBB0C888A440497B4AB72B848BF44002B00000331500826A8644380808FA
MD5 SHA1 SHA512 TLSH

Submit Download

KXHGFQ.exe

Path C:\windows\KXHGFQ.exe
Size 208KB
SHA256 1277a9c3dfcc0ed2f3e7c29dee6f89341b49ff5ee97ca96ec182e8cf6b40b88b
MD5 501be9834626a5974b1646df769b815a
SHA1 9fb1edf600bc55bc81fa093a31ddad2b82b71c8e
SHA512 41dddb632c8f7b9c13a765eff62792f6e5757d5e92e39f20856086e67796971a3dfad0d452ae0d561f7f5d19a402d682bace75a2262f40f161f8a259f5b2577b
SSDEEP 3072:aHNaCbAaPLHUQxXYILRc1bfmw97cOdWjhqg7no4pLthEjQT6j:2NaCbAuI1f57aqxkEj1
TLSH
T1DB248D3C76D68942F87746315AE9ABBC0EBA3C16FBE5420F6AC2372E44F315189157E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRR.exe

Path C:\windows\SRR.exe
Size 208KB
SHA256 b0328ed25bb1c9f94372a8da810d23c7c0593d3842cd89b8642adc9dbd9a20d8
MD5 91dfbff60cca73a2e17f96e2cc46f755
SHA1 b4b817d788a12712b5db86af167a547101b77131
SHA512 cfa9f26052a6e4742b181dd5d624ab9c9a46699546458553dd90d53957b7f26242b1b4efb03ed9692b66cb65f89237bd1c2f98c86ceea0b4bef271e94b9eef88
SSDEEP 6144:Lr+7LD4A5oS71l27Y8Es1h4BC5RFv2skEj1:LHKZsfTkC
TLSH
T1A4246D01BA56ED06E8F74670C5EAC5A48FB5FD31ABE1431FA780735D1A326628B1CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHUF.exe

Path C:\windows\SysWOW64\CHUF.exe
Size 208KB
SHA256 96778b3f66f8c4088c0517849bd8084fb352407afea9b8048de1f3a66ae8c745
MD5 05599339b8039620715cb8bbbb136f6b
SHA1 515dc84355aa5a0462f387ac5f3e26cf9f235cc5
SHA512 f7cc68fc76918e4ad2b90e2914606c141f9e838da6bba1d395f84b682d331bc9f8a05d8131944ed74ebf8fd639fc7a084286f223fd1f9390523d110243765476
SSDEEP 3072:ewHBsjJyVoVVR3cn4ZTTIq7G6w63ldT6QjwIKguvGYgGg620g4Zim22xE6Au4pLe:hyIVsSngv/w6V9wIKg/GM0g4jE6LkEj1
TLSH
T1EE248C07B9868847C56B9FB418E149E03FA67E219FED220BF984B76C7F780744D98670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JUF.exe

Path C:\windows\SysWOW64\JUF.exe
Size 208KB
SHA256 5f84523be56fce3bd279e913893b1f017502e255af4af807c86bff33bad4a29f
MD5 c67717aed7a14930e4b857097c3fbd62
SHA1 bd3f58552a4d11188f2bdc97ebd7091dc7485c4e
SHA512 2af8a9b6655b784cdf709b37c859f6c82fc8eca191b519bbc6c654c0a541185b43347010aed0879c0b44aabb324f306b2971c30d8bb12d46295b500649786a61
SSDEEP 3072:Q8OCPfwkpdtCUDTYZFV1AUBDPKu6aMaF9ZE2+64pLthEjQT6j:MGOU/WHBjKu6aMaF9Z9+6kEj1
TLSH
T134248C41739E9463E5EB03320BF8E7641EE5FC516BB6526BFA40739E7872D680D013A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TYUIT.exe

Path C:\windows\TYUIT.exe
Size 208KB
SHA256 c3220d60477ae7c2cc2733feb06c9b1503dab7c3017ef24e85ebff2e7491d920
MD5 9123a2e9506ff067c36546f20206d18e
SHA1 5124e33ea3499e67939bb54ca909ebf16a04bdcc
SHA512 2fe55031fea8815fc37fd195674a88ab155efd4b8d140ad6b4de974697b0cfd251419ec88fc68b47f15d16e75cb5dbad4904e4c16db5cb0d87eab2fb65c7b78a
SSDEEP 3072:LUDo245Af/LNM0jkb0ujcUhOVgT6OgMWz1V+q+4pLthEjQT6j:in7NM0wb0zUhOVW6XekEj1
TLSH
T12C249E46F2D680C1E4B717F08CDA82D4396DBC7FAEAACD4FB590739D56BA6900C14329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBUX.exe

Path C:\windows\VBUX.exe
Size 208KB
SHA256 f0056eff7a3226e8d12f50d097b4190ba1be4ed32b42d27c13b4a81210573a12
MD5 6fd29a0ecfeb94bd5b79f21cf5815f56
SHA1 d353b725111aa2a9bd187587565856879a7e45b0
SHA512 4a42544d7b88e42671c8be46902c21cadb131ba783efbad40e98cd14c27249b63cbca0423a95aceb10e31b8f0a7af1e69897bb1b5fca1ab26bb5952c56c220b2
SSDEEP 3072:Tfwzc1dOhQzBEs/4zZ20Ch88QvLUAq0Gza0pvEpzu4pLthEjQT6j:rU73qy+hjQv4AqRa0pvEpakEj1
TLSH
T121247C02B7D4C863E02F477994E697645B7B7C21AFB6415FA9603B9C2EB034A18337B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RWPH.exe

Path C:\windows\system\RWPH.exe
Size 208KB
SHA256 576f63d44a7fe1fe3853c98410b1683070ced3a044640e06060b6876fe378b1c
MD5 ccaaeb88edd7d589cf7d6d4d2f75740a
SHA1 81df40ed22a0e03c665c7fdbfe7aafdba2a76579
SHA512 7ac405a6a5072ab3bc9efc7ca530e22ed5638a2b5639ee635441161494358953106b6a851b1f2ad2dda0ac976ce4416f97a6e2f1c403897323635f1ab0449d40
SSDEEP 3072:5O9BAALAretcPXu3yR/mubt2dJ8P5a/u5xs+w1E4V7yH4pLthEjQT6j:KAALseT3pubtS8Po/MO+vHkEj1
TLSH
T1E7249D426B9DD817E07B2B31A8F5C8A4AA337CE18B76431F7559332EB870BD12944793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WGIXB.exe

Path C:\windows\system\WGIXB.exe
Size 208KB
SHA256 28faf1c7c3ba74465848e796e0cf38f11a45aadee74e873b1603ba9961472350
MD5 f9471a02fd9901e6cc9ec2465819c0d6
SHA1 11c39741935d4256213a8ae7efe3cbe5969ac334
SHA512 de9a91014d9a78c72b4bc314fdafd8e171e2a784107074be121e282021ff7bd3345b05a6aef8728d1daf4d97d9b349db654438cdc1ec789598650ca6a123b0d6
SSDEEP 3072:/+WifC+J+EEur3UqZDgI+uSJDznen3fgaTgDwv4pLthEjQT6j:L+J+Or3UqOI+uieP0wkEj1
TLSH
T1A9247D1332A4E443E8EF9738CAE58EF11EA6BDD25FB1234B3682337DD931A450825765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XVY.exe

Path C:\windows\system\XVY.exe
Size 208KB
SHA256 f4b356a07c8d80c63dc8cc101bbc332e5787b7a6e68a2e196bc96daca5598d68
MD5 8975fa747de7c6223d0266caf3591be3
SHA1 c734cb237570a082714767e15083a740098d9e97
SHA512 9b39476ef0eb66697a054fae959f0a0574bf7b4b233adaa090a93e39aa18800da010af5cfe286cf3926dd6fc99cb269b54ac81eb5dcdebbb1068e1d09c450bac
SSDEEP 3072:hOj/hMcfgbhbnOAhvAH3BS+WvDtWG67cCLrMw4pLthEjQT6j:Mj/hMckSAhIH3BSZvpH3CLrMwkEj1
TLSH
T197247C097381CD76E193223F49E345E50EBBFC26DB69173B7684B76DA933224B912780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-190-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/484-180-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/732-433-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1268-205-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1268-242-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1280-188-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1376-187-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1408-328-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1468-405-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1468-432-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1624-63-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1624-87-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1640-369-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1772-392-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1772-430-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1796-120-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1812-434-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1844-48-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1844-67-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2036-151-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2096-426-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2096-435-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2132-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2132-64-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2664-269-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2664-235-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2820-391-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2832-66-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2868-229-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2868-243-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2892-368-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2912-201-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2912-181-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2924-274-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2924-241-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3024-150-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3024-118-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3136-186-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3136-148-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3336-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3336-65-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3372-458-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3376-301-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3376-268-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3464-233-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3464-244-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3536-366-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3536-340-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3620-365-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3672-121-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3880-428-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4168-303-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4168-298-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4204-459-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4292-429-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4448-273-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4448-302-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4452-305-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4512-68-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4512-50-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4668-445-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4768-189-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4788-236-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4788-183-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4796-237-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4796-185-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4916-304-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4916-299-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4928-115-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4928-122-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5028-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5028-86-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5108-364-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5108-327-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5160-370-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5252-61-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5252-71-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5420-436-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5420-427-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5460-393-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5460-362-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5532-300-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5532-333-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5552-363-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5552-396-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5572-306-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5592-367-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5592-359-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5824-431-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5884-240-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5884-283-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5912-76-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5912-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5936-69-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5936-56-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6096-70-0x0000000000400000-0x0000000000438000-memory.dmp

Download