e3931aff90183e25037edb7ce6f3be7b02fdb248b98360bf204ae7200a8fc24a

Analysis

max time kernel
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
Size 208KB
Sample261002-v8trssvs4j
SHA256 e3931aff90183e25037edb7ce6f3be7b02fdb248b98360bf204ae7200a8fc24a
MD5 2b21aea605732e07d53ddff60900a14f
SHA1 c104d7a554dd57873260e300e4643be96a57f28c
SHA512 97084a3a129a3a3089a7b7f2064f9b181555401bbed974f115a003ee89231017e416992955ca4b8e8507c3b08ba2aa3027c9914c7d92a1b01c6ef6293275a0a0
SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfM4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOEkEj1
TLSH
T15F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4352	OMXSYL.exe
2088	LXPXLM.exe
2320	IXRAP.exe
2388	FDWXESB.exe
1424	XYA.exe
2520	CDSI.exe
6112	BOV.exe
4744	TRZTO.exe
3924	DPNO.exe
5616	WSQRIF.exe
2568	VDTHJ.exe
4500	XQKJDF.exe
2636	HYMOGKT.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\VDTHJ.exe.bat	WSQRIF.exe
File created	C:\windows\SysWOW64\XQKJDF.exe.bat	VDTHJ.exe
File opened for modification	C:\windows\SysWOW64\ARUZXDJ.exe	HYMOGKT.exe
File opened for modification	C:\windows\SysWOW64\XQKJDF.exe	VDTHJ.exe
File opened for modification	C:\windows\SysWOW64\CDSI.exe	XYA.exe
File created	C:\windows\SysWOW64\TRZTO.exe	BOV.exe
File created	C:\windows\SysWOW64\VDTHJ.exe	WSQRIF.exe
File opened for modification	C:\windows\SysWOW64\VDTHJ.exe	WSQRIF.exe
File created	C:\windows\SysWOW64\ARUZXDJ.exe.bat	HYMOGKT.exe
File created	C:\windows\SysWOW64\XQKJDF.exe	VDTHJ.exe
File created	C:\windows\SysWOW64\XYA.exe.bat	FDWXESB.exe
File created	C:\windows\SysWOW64\CDSI.exe	XYA.exe
File created	C:\windows\SysWOW64\CDSI.exe.bat	XYA.exe
File opened for modification	C:\windows\SysWOW64\TRZTO.exe	BOV.exe
File created	C:\windows\SysWOW64\ARUZXDJ.exe	HYMOGKT.exe
File created	C:\windows\SysWOW64\XYA.exe	FDWXESB.exe
File opened for modification	C:\windows\SysWOW64\XYA.exe	FDWXESB.exe
File created	C:\windows\SysWOW64\TRZTO.exe.bat	BOV.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\windows\system\LXPXLM.exe	OMXSYL.exe
File created	C:\windows\IXRAP.exe.bat	LXPXLM.exe
File opened for modification	C:\windows\FDWXESB.exe	IXRAP.exe
File created	C:\windows\DPNO.exe	TRZTO.exe
File opened for modification	C:\windows\DPNO.exe	TRZTO.exe
File created	C:\windows\system\WSQRIF.exe.bat	DPNO.exe
File opened for modification	C:\windows\HYMOGKT.exe	XQKJDF.exe
File opened for modification	C:\windows\system\LXPXLM.exe	OMXSYL.exe
File opened for modification	C:\windows\IXRAP.exe	LXPXLM.exe
File created	C:\windows\FDWXESB.exe	IXRAP.exe
File created	C:\windows\BOV.exe	CDSI.exe
File created	C:\windows\BOV.exe.bat	CDSI.exe
File created	C:\windows\DPNO.exe.bat	TRZTO.exe
File created	C:\windows\system\WSQRIF.exe	DPNO.exe
File opened for modification	C:\windows\system\WSQRIF.exe	DPNO.exe
File created	C:\windows\OMXSYL.exe.bat	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
File created	C:\windows\system\LXPXLM.exe.bat	OMXSYL.exe
File created	C:\windows\IXRAP.exe	LXPXLM.exe
File created	C:\windows\FDWXESB.exe.bat	IXRAP.exe
File opened for modification	C:\windows\OMXSYL.exe	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
File opened for modification	C:\windows\BOV.exe	CDSI.exe
File created	C:\windows\HYMOGKT.exe	XQKJDF.exe
File created	C:\windows\HYMOGKT.exe.bat	XQKJDF.exe
File created	C:\windows\OMXSYL.exe	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
1340	cmd.exe
4952	cmd.exe
4912	cmd.exe
3120	cmd.exe
6108	cmd.exe
4764	cmd.exe
4204	cmd.exe
1100	cmd.exe
2856	cmd.exe
1632	cmd.exe
2008	cmd.exe
5980	cmd.exe
5116	cmd.exe
256	cmd.exe
4124	cmd.exe
5480	cmd.exe
2368	cmd.exe
6000	cmd.exe
4628	cmd.exe
3468	cmd.exe
6132	cmd.exe
3992	cmd.exe
5144	cmd.exe
1576	cmd.exe
5744	cmd.exe
3108	cmd.exe
2328	cmd.exe
3588	cmd.exe
2468	cmd.exe
3264	cmd.exe
5528	cmd.exe
4452	cmd.exe
2332	cmd.exe
2960	cmd.exe
4644	cmd.exe
5820	cmd.exe
2036	cmd.exe
4724	cmd.exe
4868	cmd.exe
5572	cmd.exe
1128	cmd.exe
1904	cmd.exe
2256	cmd.exe
1172	cmd.exe
5072	cmd.exe
5592	cmd.exe
4508	cmd.exe
2436	cmd.exe
3592	cmd.exe
1256	cmd.exe
5788	cmd.exe
4372	cmd.exe
1752	cmd.exe
2740	cmd.exe
5040	cmd.exe
3640	cmd.exe
2396	cmd.exe
2140	cmd.exe
2940	cmd.exe
2372	cmd.exe
3296	cmd.exe
3452	cmd.exe
3248	cmd.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3640	4588	WerFault.exe	88
4788	4352	WerFault.exe	94
6136	2088	WerFault.exe	100
1664	2320	WerFault.exe	105
4820	2388	WerFault.exe	110
2980	1424	WerFault.exe	115
4972	2520	WerFault.exe	120
6048	6112	WerFault.exe	125
5760	4744	WerFault.exe	130
3628	3924	WerFault.exe	134
6128	5616	WerFault.exe	140
5476	2568	WerFault.exe	145
5884	4500	WerFault.exe	150
2496	2636	WerFault.exe	155
2628	2880	WerFault.exe	160
4916	4848	WerFault.exe	165
4264	1728	WerFault.exe	170
2896	2316	WerFault.exe	175
1688	5792	WerFault.exe	179
2784	5764	WerFault.exe	185
4776	5816	WerFault.exe	190
5512	4164	WerFault.exe	195
5016	608	WerFault.exe	200
3460	3520	WerFault.exe	205
3228	1436	WerFault.exe	210
3220	4336	WerFault.exe	215
1228	1384	WerFault.exe	219
4264	3420	WerFault.exe	225
5036	984	WerFault.exe	230
1868	2868	WerFault.exe	235
1764	4244	WerFault.exe	240
5324	4148	WerFault.exe	245
2468	1776	WerFault.exe	249
4676	2684	WerFault.exe	255
5088	1608	WerFault.exe	260
5292	2708	WerFault.exe	265
6024	5436	WerFault.exe	270
4960	1796	WerFault.exe	275
5820	4428	WerFault.exe	280
5968	3492	WerFault.exe	285
2872	5348	WerFault.exe	290
2356	5100	WerFault.exe	294
4288	3068	WerFault.exe	300
3268	4280	WerFault.exe	305
3376	3096	WerFault.exe	309
5028	5920	WerFault.exe	315
3172	5088	WerFault.exe	320
6024	2528	WerFault.exe	324
4620	2628	WerFault.exe	329
4436	5964	WerFault.exe	335
2488	1228	WerFault.exe	340
1196	4240	WerFault.exe	345
4932	4892	WerFault.exe	350
3456	1332	WerFault.exe	355
3296	948	WerFault.exe	360
2892	5428	WerFault.exe	365
3464	2564	WerFault.exe	369
5788	4908	WerFault.exe	375
5584	1744	WerFault.exe	380
2904	204	WerFault.exe	385
2036	5896	WerFault.exe	390
1200	1092	WerFault.exe	395
5516	5368	WerFault.exe	400
5396	2324	WerFault.exe	405

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BOV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSQRIF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LXPXLM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VDTHJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HYMOGKT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXRAP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDWXESB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TRZTO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPNO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XQKJDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OMXSYL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XYA.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4588	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
4588	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
4352	OMXSYL.exe
4352	OMXSYL.exe
2088	LXPXLM.exe
2088	LXPXLM.exe
2320	IXRAP.exe
2320	IXRAP.exe
2388	FDWXESB.exe
2388	FDWXESB.exe
1424	XYA.exe
1424	XYA.exe
2520	CDSI.exe
2520	CDSI.exe
6112	BOV.exe
6112	BOV.exe
4744	TRZTO.exe
4744	TRZTO.exe
3924	DPNO.exe
3924	DPNO.exe
5616	WSQRIF.exe
5616	WSQRIF.exe
2568	VDTHJ.exe
2568	VDTHJ.exe
4500	XQKJDF.exe
4500	XQKJDF.exe
2636	HYMOGKT.exe
2636	HYMOGKT.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4588	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
4588	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
4352	OMXSYL.exe
4352	OMXSYL.exe
2088	LXPXLM.exe
2088	LXPXLM.exe
2320	IXRAP.exe
2320	IXRAP.exe
2388	FDWXESB.exe
2388	FDWXESB.exe
1424	XYA.exe
1424	XYA.exe
2520	CDSI.exe
2520	CDSI.exe
6112	BOV.exe
6112	BOV.exe
4744	TRZTO.exe
4744	TRZTO.exe
3924	DPNO.exe
3924	DPNO.exe
5616	WSQRIF.exe
5616	WSQRIF.exe
2568	VDTHJ.exe
2568	VDTHJ.exe
4500	XQKJDF.exe
4500	XQKJDF.exe
2636	HYMOGKT.exe
2636	HYMOGKT.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4232	4588	2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe	90
PID 4232 wrote to memory of 4352	4232	cmd.exe	94
PID 4352 wrote to memory of 4568	4352	OMXSYL.exe	96
PID 4568 wrote to memory of 2088	4568	cmd.exe	100
PID 2088 wrote to memory of 3016	2088	LXPXLM.exe	101
PID 3016 wrote to memory of 2320	3016	cmd.exe	105
PID 2320 wrote to memory of 1784	2320	IXRAP.exe	106
PID 1784 wrote to memory of 2388	1784	cmd.exe	110
PID 2388 wrote to memory of 4508	2388	FDWXESB.exe	111
PID 4508 wrote to memory of 1424	4508	cmd.exe	115
PID 1424 wrote to memory of 5936	1424	XYA.exe	116
PID 5936 wrote to memory of 2520	5936	cmd.exe	120
PID 2520 wrote to memory of 6108	2520	CDSI.exe	121
PID 6108 wrote to memory of 6112	6108	cmd.exe	125
PID 6112 wrote to memory of 3108	6112	BOV.exe	126
PID 3108 wrote to memory of 4744	3108	cmd.exe	130
PID 4744 wrote to memory of 3400	4744	TRZTO.exe	131
PID 3400 wrote to memory of 3924	3400	cmd.exe	134
PID 3924 wrote to memory of 2436	3924	DPNO.exe	136
PID 2436 wrote to memory of 5616	2436	cmd.exe	140
PID 5616 wrote to memory of 4868	5616	WSQRIF.exe	141
PID 4868 wrote to memory of 2568	4868	cmd.exe	145
PID 2568 wrote to memory of 5560	2568	VDTHJ.exe	146
PID 5560 wrote to memory of 4500	5560	cmd.exe	150
PID 4500 wrote to memory of 4860	4500	XQKJDF.exe	151
PID 4860 wrote to memory of 2636	4860	cmd.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_2b21aea605732e07d53ddff60900a14f_elex_emotet_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\OMXSYL.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\windows\OMXSYL.exe
    C:\windows\OMXSYL.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\windows\system\LXPXLM.exe
        
        C:\windows\system\LXPXLM.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2088
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\IXRAP.exe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\windows\IXRAP.exe
        
        C:\windows\IXRAP.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FDWXESB.exe.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\windows\FDWXESB.exe
        
        C:\windows\FDWXESB.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYA.exe.bat" "
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\windows\SysWOW64\XYA.exe
        
        C:\windows\system32\XYA.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\windows\SysWOW64\CDSI.exe
        
        C:\windows\system32\CDSI.exe
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BOV.exe.bat" "
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\windows\BOV.exe
        
        C:\windows\BOV.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TRZTO.exe.bat" "
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\windows\SysWOW64\TRZTO.exe
        
        C:\windows\system32\TRZTO.exe
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DPNO.exe.bat" "
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\windows\DPNO.exe
        
        C:\windows\DPNO.exe
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WSQRIF.exe.bat" "
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\windows\system\WSQRIF.exe
        
        C:\windows\system\WSQRIF.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDTHJ.exe.bat" "
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\windows\SysWOW64\VDTHJ.exe
        
        C:\windows\system32\VDTHJ.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "
        24⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\windows\SysWOW64\XQKJDF.exe
        
        C:\windows\system32\XQKJDF.exe
        25⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HYMOGKT.exe.bat" "
        26⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\windows\HYMOGKT.exe
        
        C:\windows\HYMOGKT.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARUZXDJ.exe.bat" "
        28⤵
        
        PID:1560
        
        C:\windows\SysWOW64\ARUZXDJ.exe
        
        C:\windows\system32\ARUZXDJ.exe
        29⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LFB.exe.bat" "
        30⤵
        
        PID:360
        
        C:\windows\system\LFB.exe
        
        C:\windows\system\LFB.exe
        31⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KCMAPK.exe.bat" "
        32⤵
        
        PID:1260
        
        C:\windows\system\KCMAPK.exe
        
        C:\windows\system\KCMAPK.exe
        33⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SIZHAQ.exe.bat" "
        34⤵
        
        PID:4820
        
        C:\windows\SIZHAQ.exe
        
        C:\windows\SIZHAQ.exe
        35⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "
        36⤵
        
        PID:4608
        
        C:\windows\MVYNF.exe
        
        C:\windows\MVYNF.exe
        37⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OJPOR.exe.bat" "
        38⤵
        
        PID:1152
        
        C:\windows\system\OJPOR.exe
        
        C:\windows\system\OJPOR.exe
        39⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\NBAE.exe.bat" "
        40⤵
        
        PID:4752
        
        C:\windows\NBAE.exe
        
        C:\windows\NBAE.exe
        41⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMD.exe.bat" "
        42⤵
        Executes a command shell one-liner
        
        PID:2328
        
        C:\windows\SysWOW64\MMD.exe
        
        C:\windows\system32\MMD.exe
        43⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZPLLWA.exe.bat" "
        44⤵
        
        PID:1472
        
        C:\windows\ZPLLWA.exe
        
        C:\windows\ZPLLWA.exe
        45⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "
        46⤵
        
        PID:4252
        
        C:\windows\ZCLZYNV.exe
        
        C:\windows\ZCLZYNV.exe
        47⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OYVMJ.exe.bat" "
        48⤵
        
        PID:3644
        
        C:\windows\system\OYVMJ.exe
        
        C:\windows\system\OYVMJ.exe
        49⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "
        50⤵
        
        PID:1532
        
        C:\windows\system\KDABQKY.exe
        
        C:\windows\system\KDABQKY.exe
        51⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "
        52⤵
        
        PID:5628
        
        C:\windows\LJTPZWA.exe
        
        C:\windows\LJTPZWA.exe
        53⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QJADI.exe.bat" "
        54⤵
        
        PID:1168
        
        C:\windows\QJADI.exe
        
        C:\windows\QJADI.exe
        55⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "
        56⤵
        
        PID:3448
        
        C:\windows\system\QPASK.exe
        
        C:\windows\system\QPASK.exe
        57⤵
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LCFBUET.exe.bat" "
        58⤵
        
        PID:4988
        
        C:\windows\system\LCFBUET.exe
        
        C:\windows\system\LCFBUET.exe
        59⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "
        60⤵
        Executes a command shell one-liner
        
        PID:2856
        
        C:\windows\system\CPQ.exe
        
        C:\windows\system\CPQ.exe
        61⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "
        62⤵
        Executes a command shell one-liner
        
        PID:4452
        
        C:\windows\SFRSIW.exe
        
        C:\windows\SFRSIW.exe
        63⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "
        64⤵
        Executes a command shell one-liner
        
        PID:5572
        
        C:\windows\DYGDAX.exe
        
        C:\windows\DYGDAX.exe
        65⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQBWAE.exe.bat" "
        66⤵
        
        PID:5656
        
        C:\windows\SysWOW64\OQBWAE.exe
        
        C:\windows\system32\OQBWAE.exe
        67⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PTFS.exe.bat" "
        68⤵
        
        PID:5488
        
        C:\windows\system\PTFS.exe
        
        C:\windows\system\PTFS.exe
        69⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "
        70⤵
        
        PID:5016
        
        C:\windows\system\ZRTM.exe
        
        C:\windows\system\ZRTM.exe
        71⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "
        72⤵
        Executes a command shell one-liner
        
        PID:3588
        
        C:\windows\system\FMEN.exe
        
        C:\windows\system\FMEN.exe
        73⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EXH.exe.bat" "
        74⤵
        Executes a command shell one-liner
        
        PID:2332
        
        C:\windows\EXH.exe
        
        C:\windows\EXH.exe
        75⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "
        76⤵
        
        PID:5660
        
        C:\windows\SysWOW64\RIPUYI.exe
        
        C:\windows\system32\RIPUYI.exe
        77⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "
        78⤵
        Executes a command shell one-liner
        
        PID:2960
        
        C:\windows\SysWOW64\DLAHHUG.exe
        
        C:\windows\system32\DLAHHUG.exe
        79⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "
        80⤵
        
        PID:2364
        
        C:\windows\SysWOW64\SBNZW.exe
        
        C:\windows\system32\SBNZW.exe
        81⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "
        82⤵
        
        PID:356
        
        C:\windows\TEEUL.exe
        
        C:\windows\TEEUL.exe
        83⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WMNJSFU.exe.bat" "
        84⤵
        
        PID:1880
        
        C:\windows\WMNJSFU.exe
        
        C:\windows\WMNJSFU.exe
        85⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "
        86⤵
        
        PID:5916
        
        C:\windows\BNJMF.exe
        
        C:\windows\BNJMF.exe
        87⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "
        88⤵
        Executes a command shell one-liner
        
        PID:1128
        
        C:\windows\SysWOW64\DDKA.exe
        
        C:\windows\system32\DDKA.exe
        89⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LIW.exe.bat" "
        90⤵
        Executes a command shell one-liner
        
        PID:3248
        
        C:\windows\system\LIW.exe
        
        C:\windows\system\LIW.exe
        91⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "
        92⤵
        
        PID:5536
        
        C:\windows\system\ELALCDW.exe
        
        C:\windows\system\ELALCDW.exe
        93⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZFU.exe.bat" "
        94⤵
        
        PID:2596
        
        C:\windows\system\ZZFU.exe
        
        C:\windows\system\ZZFU.exe
        95⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XOQ.exe.bat" "
        96⤵
        
        PID:4596
        
        C:\windows\XOQ.exe
        
        C:\windows\XOQ.exe
        97⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "
        98⤵
        
        PID:2156
        
        C:\windows\SysWOW64\WHBFIOP.exe
        
        C:\windows\system32\WHBFIOP.exe
        99⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "
        100⤵
        
        PID:5644
        
        C:\windows\XCF.exe
        
        C:\windows\XCF.exe
        101⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "
        102⤵
        
        PID:5968
        
        C:\windows\SysWOW64\YAK.exe
        
        C:\windows\system32\YAK.exe
        103⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNPMF.exe.bat" "
        104⤵
        
        PID:2092
        
        C:\windows\SysWOW64\TNPMF.exe
        
        C:\windows\system32\TNPMF.exe
        105⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "
        106⤵
        
        PID:2128
        
        C:\windows\OJUWPM.exe
        
        C:\windows\OJUWPM.exe
        107⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "
        108⤵
        
        PID:4828
        
        C:\windows\WOUKRZF.exe
        
        C:\windows\WOUKRZF.exe
        109⤵
        
        PID:948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJDPC.exe.bat" "
        110⤵
        
        PID:3668
        
        C:\windows\SysWOW64\LJDPC.exe
        
        C:\windows\system32\LJDPC.exe
        111⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "
        112⤵
        
        PID:5652
        
        C:\windows\SysWOW64\LPEDLZ.exe
        
        C:\windows\system32\LPEDLZ.exe
        113⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUCATIL.exe.bat" "
        114⤵
        
        PID:5884
        
        C:\windows\SysWOW64\HUCATIL.exe
        
        C:\windows\system32\HUCATIL.exe
        115⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "
        116⤵
        
        PID:4788
        
        C:\windows\SysWOW64\EAHXASN.exe
        
        C:\windows\system32\EAHXASN.exe
        117⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\PTK.exe.bat" "
        118⤵
        
        PID:4804
        
        C:\windows\PTK.exe
        
        C:\windows\PTK.exe
        119⤵
        
        PID:204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "
        120⤵
        
        PID:4264
        
        C:\windows\EYIFP.exe
        
        C:\windows\EYIFP.exe
        121⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MJRHD.exe.bat" "
        122⤵
        
        PID:5164
        
        C:\windows\system\MJRHD.exe
        
        C:\windows\system\MJRHD.exe
        123⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "
        124⤵
        
        PID:2944
        
        C:\windows\XBUZDV.exe
        
        C:\windows\XBUZDV.exe
        125⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "
        126⤵
        Executes a command shell one-liner
        
        PID:2468
        
        C:\windows\DCBN.exe
        
        C:\windows\DCBN.exe
        127⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\DHUC.exe.bat" "
        128⤵
        Executes a command shell one-liner
        
        PID:3592
        
        C:\windows\DHUC.exe
        
        C:\windows\DHUC.exe
        129⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MUEUL.exe.bat" "
        130⤵
        
        PID:624
        
        C:\windows\system\MUEUL.exe
        
        C:\windows\system\MUEUL.exe
        131⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "
        132⤵
        Executes a command shell one-liner
        
        PID:3264
        
        C:\windows\system\LFCJL.exe
        
        C:\windows\system\LFCJL.exe
        133⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\UTN.exe.bat" "
        134⤵
        
        PID:4132
        
        C:\windows\system\UTN.exe
        
        C:\windows\system\UTN.exe
        135⤵
        
        PID:120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "
        136⤵
        
        PID:4916
        
        C:\windows\SysWOW64\QYL.exe
        
        C:\windows\system32\QYL.exe
        137⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "
        138⤵
        Executes a command shell one-liner
        
        PID:5528
        
        C:\windows\WLKZMC.exe
        
        C:\windows\WLKZMC.exe
        139⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "
        140⤵
        
        PID:4432
        
        C:\windows\system\FZURUH.exe
        
        C:\windows\system\FZURUH.exe
        141⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "
        142⤵
        Executes a command shell one-liner
        
        PID:1904
        
        C:\windows\RRX.exe
        
        C:\windows\RRX.exe
        143⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CKAD.exe.bat" "
        144⤵
        
        PID:1672
        
        C:\windows\CKAD.exe
        
        C:\windows\CKAD.exe
        145⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "
        146⤵
        Executes a command shell one-liner
        
        PID:5040
        
        C:\windows\system\ZPYAS.exe
        
        C:\windows\system\ZPYAS.exe
        147⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\KIBTA.exe.bat" "
        148⤵
        
        PID:2444
        
        C:\windows\KIBTA.exe
        
        C:\windows\KIBTA.exe
        149⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "
        150⤵
        Executes a command shell one-liner
        
        PID:3640
        
        C:\windows\SysWOW64\STKMGRJ.exe
        
        C:\windows\system32\STKMGRJ.exe
        151⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "
        152⤵
        
        PID:3384
        
        C:\windows\GYQJVB.exe
        
        C:\windows\GYQJVB.exe
        153⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XJGHVVH.exe.bat" "
        154⤵
        Executes a command shell one-liner
        
        PID:3084
        
        C:\windows\system\XJGHVVH.exe
        
        C:\windows\system\XJGHVVH.exe
        155⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWL.exe.bat" "
        156⤵
        Executes a command shell one-liner
        
        PID:2256
        
        C:\windows\SysWOW64\ZWL.exe
        
        C:\windows\system32\ZWL.exe
        157⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ZPTKLH.exe.bat" "
        158⤵
        Executes a command shell one-liner
        
        PID:4644
        
        C:\windows\ZPTKLH.exe
        
        C:\windows\ZPTKLH.exe
        159⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BNNM.exe.bat" "
        160⤵
        Executes a command shell one-liner
        
        PID:1256
        
        C:\windows\BNNM.exe
        
        C:\windows\BNNM.exe
        161⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YKSJYG.exe.bat" "
        162⤵
        
        PID:4540
        
        C:\windows\system\YKSJYG.exe
        
        C:\windows\system\YKSJYG.exe
        163⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDTDMK.exe.bat" "
        164⤵
        
        PID:5848
        
        C:\windows\SysWOW64\YDTDMK.exe
        
        C:\windows\system32\YDTDMK.exe
        165⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "
        166⤵
        
        PID:3792
        
        C:\windows\system\ABUFSHR.exe
        
        C:\windows\system\ABUFSHR.exe
        167⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HLDGYLG.exe.bat" "
        168⤵
        
        PID:5000
        
        C:\windows\system\HLDGYLG.exe
        
        C:\windows\system\HLDGYLG.exe
        169⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HRV.exe.bat" "
        170⤵
        Executes a command shell one-liner
        
        PID:1340
        
        C:\windows\HRV.exe
        
        C:\windows\HRV.exe
        171⤵
        
        PID:972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\EWBK.exe.bat" "
        172⤵
        
        PID:768
        
        C:\windows\system\EWBK.exe
        
        C:\windows\system\EWBK.exe
        173⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\SCHHWK.exe.bat" "
        174⤵
        
        PID:3652
        
        C:\windows\system\SCHHWK.exe
        
        C:\windows\system\SCHHWK.exe
        175⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUCAE.exe.bat" "
        176⤵
        
        PID:5036
        
        C:\windows\SysWOW64\EUCAE.exe
        
        C:\windows\system32\EUCAE.exe
        177⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XSNXQX.exe.bat" "
        178⤵
        
        PID:5956
        
        C:\windows\system\XSNXQX.exe
        
        C:\windows\system\XSNXQX.exe
        179⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RQOAXU.exe.bat" "
        180⤵
        Executes a command shell one-liner
        
        PID:1172
        
        C:\windows\RQOAXU.exe
        
        C:\windows\RQOAXU.exe
        181⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PGNCBG.exe.bat" "
        182⤵
        
        PID:2612
        
        C:\windows\system\PGNCBG.exe
        
        C:\windows\system\PGNCBG.exe
        183⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RDOFHDA.exe.bat" "
        184⤵
        Executes a command shell one-liner
        
        PID:256
        
        C:\windows\system\RDOFHDA.exe
        
        C:\windows\system\RDOFHDA.exe
        185⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ROPGVHH.exe.bat" "
        186⤵
        
        PID:6024
        
        C:\windows\ROPGVHH.exe
        
        C:\windows\ROPGVHH.exe
        187⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NUV.exe.bat" "
        188⤵
        Executes a command shell one-liner
        
        PID:5072
        
        C:\windows\system\NUV.exe
        
        C:\windows\system\NUV.exe
        189⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PROX.exe.bat" "
        190⤵
        
        PID:2404
        
        C:\windows\SysWOW64\PROX.exe
        
        C:\windows\system32\PROX.exe
        191⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\DUS.exe.bat" "
        192⤵
        
        PID:3484
        
        C:\windows\system\DUS.exe
        
        C:\windows\system\DUS.exe
        193⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\RAYTU.exe.bat" "
        194⤵
        Executes a command shell one-liner
        
        PID:4628
        
        C:\windows\RAYTU.exe
        
        C:\windows\RAYTU.exe
        195⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFWQ.exe.bat" "
        196⤵
        
        PID:5028
        
        C:\windows\SysWOW64\OFWQ.exe
        
        C:\windows\system32\OFWQ.exe
        197⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KLBNIA.exe.bat" "
        198⤵
        
        PID:5556
        
        C:\windows\system\KLBNIA.exe
        
        C:\windows\system\KLBNIA.exe
        199⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QLJ.exe.bat" "
        200⤵
        Executes a command shell one-liner
        
        PID:4764
        
        C:\windows\QLJ.exe
        
        C:\windows\QLJ.exe
        201⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HWZR.exe.bat" "
        202⤵
        
        PID:5052
        
        C:\windows\system\HWZR.exe
        
        C:\windows\system\HWZR.exe
        203⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QBKJ.exe.bat" "
        204⤵
        Executes a command shell one-liner
        
        PID:5820
        
        C:\windows\system\QBKJ.exe
        
        C:\windows\system\QBKJ.exe
        205⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NHQGWV.exe.bat" "
        206⤵
        
        PID:2696
        
        C:\windows\system\NHQGWV.exe
        
        C:\windows\system\NHQGWV.exe
        207⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\DSOEVQ.exe.bat" "
        208⤵
        
        PID:2472
        
        C:\windows\system\DSOEVQ.exe
        
        C:\windows\system\DSOEVQ.exe
        209⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\JSORES.exe.bat" "
        210⤵
        
        PID:3140
        
        C:\windows\system\JSORES.exe
        
        C:\windows\system\JSORES.exe
        211⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EFT.exe.bat" "
        212⤵
        
        PID:3192
        
        C:\windows\EFT.exe
        
        C:\windows\EFT.exe
        213⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\PYWT.exe.bat" "
        214⤵
        
        PID:5668
        
        C:\windows\PYWT.exe
        
        C:\windows\PYWT.exe
        215⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\GLGMNWB.exe.bat" "
        216⤵
        
        PID:4900
        
        C:\windows\GLGMNWB.exe
        
        C:\windows\GLGMNWB.exe
        217⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XWWBMQW.exe.bat" "
        218⤵
        Executes a command shell one-liner
        
        PID:5788
        
        C:\windows\system\XWWBMQW.exe
        
        C:\windows\system\XWWBMQW.exe
        219⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCCYTAY.exe.bat" "
        220⤵
        
        PID:3292
        
        C:\windows\SysWOW64\TCCYTAY.exe
        
        C:\windows\system32\TCCYTAY.exe
        221⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHIW.exe.bat" "
        222⤵
        
        PID:1816
        
        C:\windows\SysWOW64\QHIW.exe
        
        C:\windows\system32\QHIW.exe
        223⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BALOI.exe.bat" "
        224⤵
        Executes a command shell one-liner
        
        PID:2036
        
        C:\windows\SysWOW64\BALOI.exe
        
        C:\windows\system32\BALOI.exe
        225⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BKMIW.exe.bat" "
        226⤵
        Executes a command shell one-liner
        
        PID:1576
        
        C:\windows\BKMIW.exe
        
        C:\windows\BKMIW.exe
        227⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MDPBXL.exe.bat" "
        228⤵
        
        PID:4156
        
        C:\windows\SysWOW64\MDPBXL.exe
        
        C:\windows\system32\MDPBXL.exe
        229⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XVSTFSB.exe.bat" "
        230⤵
        Executes a command shell one-liner
        
        PID:3468
        
        C:\windows\XVSTFSB.exe
        
        C:\windows\XVSTFSB.exe
        231⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOS.exe.bat" "
        232⤵
        
        PID:6032
        
        C:\windows\SysWOW64\FOS.exe
        
        C:\windows\system32\FOS.exe
        233⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABXE.exe.bat" "
        234⤵
        
        PID:5200
        
        C:\windows\SysWOW64\ABXE.exe
        
        C:\windows\system32\ABXE.exe
        235⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFSMYG.exe.bat" "
        236⤵
        
        PID:720
        
        C:\windows\system\GBFSMYG.exe
        
        C:\windows\system\GBFSMYG.exe
        237⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AZGMK.exe.bat" "
        238⤵
        Executes a command shell one-liner
        
        PID:2396
        
        C:\windows\system\AZGMK.exe
        
        C:\windows\system\AZGMK.exe
        239⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKGNYZC.exe.bat" "
        240⤵
        
        PID:2624
        
        C:\windows\SysWOW64\IKGNYZC.exe
        
        C:\windows\system32\IKGNYZC.exe
        241⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TCJG.exe.bat" "
        242⤵
        
        PID:4876
        
        C:\windows\system\TCJG.exe
        
        C:\windows\system\TCJG.exe
        243⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EVMZP.exe.bat" "
        244⤵
        Executes a command shell one-liner
        
        PID:1632
        
        C:\windows\EVMZP.exe
        
        C:\windows\EVMZP.exe
        245⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVUNY.exe.bat" "
        246⤵
        Executes a command shell one-liner
        
        PID:6132
        
        C:\windows\SysWOW64\KVUNY.exe
        
        C:\windows\system32\KVUNY.exe
        247⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MTNHEF.exe.bat" "
        248⤵
        Executes a command shell one-liner
        
        PID:5592
        
        C:\windows\MTNHEF.exe
        
        C:\windows\MTNHEF.exe
        249⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MEWIKJ.exe.bat" "
        250⤵
        Executes a command shell one-liner
        
        PID:4124
        
        C:\windows\system\MEWIKJ.exe
        
        C:\windows\system\MEWIKJ.exe
        251⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPSPPBA.exe.bat" "
        252⤵
        
        PID:3396
        
        C:\windows\system\ZPSPPBA.exe
        
        C:\windows\system\ZPSPPBA.exe
        253⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VUYEEKC.exe.bat" "
        254⤵
        Executes a command shell one-liner
        
        PID:2008
        
        C:\windows\SysWOW64\VUYEEKC.exe
        
        C:\windows\system32\VUYEEKC.exe
        255⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XKZGCHK.exe.bat" "
        256⤵
        Executes a command shell one-liner
        
        PID:2140
        
        C:\windows\system\XKZGCHK.exe
        
        C:\windows\system\XKZGCHK.exe
        257⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XCA.exe.bat" "
        258⤵
        Executes a command shell one-liner
        
        PID:3992
        
        C:\windows\system\XCA.exe
        
        C:\windows\system\XCA.exe
        259⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\KFEG.exe.bat" "
        260⤵
        
        PID:5600
        
        C:\windows\system\KFEG.exe
        
        C:\windows\system\KFEG.exe
        261⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WYZZD.exe.bat" "
        262⤵
        
        PID:1336
        
        C:\windows\system\WYZZD.exe
        
        C:\windows\system\WYZZD.exe
        263⤵
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HQCS.exe.bat" "
        264⤵
        
        PID:2552
        
        C:\windows\system\HQCS.exe
        
        C:\windows\system\HQCS.exe
        265⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QEMKUWM.exe.bat" "
        266⤵
        Executes a command shell one-liner
        
        PID:4952
        
        C:\windows\QEMKUWM.exe
        
        C:\windows\QEMKUWM.exe
        267⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BWP.exe.bat" "
        268⤵
        
        PID:4880
        
        C:\windows\BWP.exe
        
        C:\windows\BWP.exe
        269⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVERVQL.exe.bat" "
        270⤵
        
        PID:2916
        
        C:\windows\SysWOW64\IVERVQL.exe
        
        C:\windows\system32\IVERVQL.exe
        271⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\TNZ.exe.bat" "
        272⤵
        
        PID:1768
        
        C:\windows\TNZ.exe
        
        C:\windows\TNZ.exe
        273⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQDQIOV.exe.bat" "
        274⤵
        Executes a command shell one-liner
        
        PID:4372
        
        C:\windows\SysWOW64\HQDQIOV.exe
        
        C:\windows\system32\HQDQIOV.exe
        275⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\GJMKWTJ.exe.bat" "
        276⤵
        Executes a command shell one-liner
        
        PID:2940
        
        C:\windows\GJMKWTJ.exe
        
        C:\windows\GJMKWTJ.exe
        277⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGF.exe.bat" "
        278⤵
        
        PID:1940
        
        C:\windows\SysWOW64\IGF.exe
        
        C:\windows\system32\IGF.exe
        279⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QRO.exe.bat" "
        280⤵
        
        PID:3676
        
        C:\windows\system\QRO.exe
        
        C:\windows\system\QRO.exe
        281⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ORWBR.exe.bat" "
        282⤵
        Executes a command shell one-liner
        
        PID:5480
        
        C:\windows\ORWBR.exe
        
        C:\windows\ORWBR.exe
        283⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\QPPVYL.exe.bat" "
        284⤵
        
        PID:2964
        
        C:\windows\QPPVYL.exe
        
        C:\windows\QPPVYL.exe
        285⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YAXXMP.exe.bat" "
        286⤵
        
        PID:3504
        
        C:\windows\system\YAXXMP.exe
        
        C:\windows\system\YAXXMP.exe
        287⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXRRKM.exe.bat" "
        288⤵
        
        PID:3308
        
        C:\windows\SysWOW64\AXRRKM.exe
        
        C:\windows\system32\AXRRKM.exe
        289⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDWORV.exe.bat" "
        290⤵
        Executes a command shell one-liner
        
        PID:4912
        
        C:\windows\SysWOW64\WDWORV.exe
        
        C:\windows\system32\WDWORV.exe
        291⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CGAUENR.exe.bat" "
        292⤵
        Executes a command shell one-liner
        
        PID:2372
        
        C:\windows\CGAUENR.exe
        
        C:\windows\CGAUENR.exe
        293⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YLYJLXT.exe.bat" "
        294⤵
        Executes a command shell one-liner
        
        PID:3120
        
        C:\windows\system\YLYJLXT.exe
        
        C:\windows\system\YLYJLXT.exe
        295⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\VREG.exe.bat" "
        296⤵
        
        PID:6136
        
        C:\windows\VREG.exe
        
        C:\windows\VREG.exe
        297⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\LHD.exe.bat" "
        298⤵
        Executes a command shell one-liner
        
        PID:1752
        
        C:\windows\SysWOW64\LHD.exe
        
        C:\windows\system32\LHD.exe
        299⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGC.exe.bat" "
        300⤵
        
        PID:4340
        
        C:\windows\system\WZGC.exe
        
        C:\windows\system\WZGC.exe
        301⤵
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YXHEL.exe.bat" "
        302⤵
        
        PID:5724
        
        C:\windows\system\YXHEL.exe
        
        C:\windows\system\YXHEL.exe
        303⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\VDFBS.exe.bat" "
        304⤵
        Executes a command shell one-liner
        
        PID:4204
        
        C:\windows\VDFBS.exe
        
        C:\windows\VDFBS.exe
        305⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\VNNVFKQ.exe.bat" "
        306⤵
        
        PID:4476
        
        C:\windows\system\VNNVFKQ.exe
        
        C:\windows\system\VNNVFKQ.exe
        307⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLHXM.exe.bat" "
        308⤵
        
        PID:3328
        
        C:\windows\SysWOW64\XLHXM.exe
        
        C:\windows\system32\XLHXM.exe
        309⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\IEKQMGN.exe.bat" "
        310⤵
        
        PID:1800
        
        C:\windows\IEKQMGN.exe
        
        C:\windows\IEKQMGN.exe
        311⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRUI.exe.bat" "
        312⤵
        Executes a command shell one-liner
        
        PID:2740
        
        C:\windows\system\ZRUI.exe
        
        C:\windows\system\ZRUI.exe
        313⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BHV.exe.bat" "
        314⤵
        Executes a command shell one-liner
        
        PID:5980
        
        C:\windows\system\BHV.exe
        
        C:\windows\system\BHV.exe
        315⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZQV.exe.bat" "
        316⤵
        
        PID:2196
        
        C:\windows\SysWOW64\MZQV.exe
        
        C:\windows\system32\MZQV.exe
        317⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFCAD.exe.bat" "
        318⤵
        Executes a command shell one-liner
        
        PID:2368
        
        C:\windows\SysWOW64\XFCAD.exe
        
        C:\windows\system32\XFCAD.exe
        319⤵
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZVVVJL.exe.bat" "
        320⤵
        
        PID:3916
        
        C:\windows\system\ZVVVJL.exe
        
        C:\windows\system\ZVVVJL.exe
        321⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGZBO.exe.bat" "
        322⤵
        
        PID:4832
        
        C:\windows\SysWOW64\FGZBO.exe
        
        C:\windows\system32\FGZBO.exe
        323⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\SIVZTT.exe.bat" "
        324⤵
        
        PID:3800
        
        C:\windows\system\SIVZTT.exe
        
        C:\windows\system\SIVZTT.exe
        325⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OOBXA.exe.bat" "
        326⤵
        
        PID:4488
        
        C:\windows\system\OOBXA.exe
        
        C:\windows\system\OOBXA.exe
        327⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\UZFVGU.exe.bat" "
        328⤵
        
        PID:1400
        
        C:\windows\UZFVGU.exe
        
        C:\windows\UZFVGU.exe
        329⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\LEPNVRQ.exe.bat" "
        330⤵
        
        PID:2456
        
        C:\windows\system\LEPNVRQ.exe
        
        C:\windows\system\LEPNVRQ.exe
        331⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\WXK.exe.bat" "
        332⤵
        
        PID:4572
        
        C:\windows\SysWOW64\WXK.exe
        
        C:\windows\system32\WXK.exe
        333⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVLI.exe.bat" "
        334⤵
        
        PID:612
        
        C:\windows\SysWOW64\YVLI.exe
        
        C:\windows\system32\YVLI.exe
        335⤵
        
        PID:884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNMJ.exe.bat" "
        336⤵
        Executes a command shell one-liner
        
        PID:6000
        
        C:\windows\SysWOW64\YNMJ.exe
        
        C:\windows\system32\YNMJ.exe
        337⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ADNEW.exe.bat" "
        338⤵
        
        PID:1288
        
        C:\windows\ADNEW.exe
        
        C:\windows\ADNEW.exe
        339⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVWFK.exe.bat" "
        340⤵
        
        PID:1224
        
        C:\windows\SysWOW64\HVWFK.exe
        
        C:\windows\system32\HVWFK.exe
        341⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JTPZIP.exe.bat" "
        342⤵
        Executes a command shell one-liner
        
        PID:5116
        
        C:\windows\JTPZIP.exe
        
        C:\windows\JTPZIP.exe
        343⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRVWP.exe.bat" "
        344⤵
        
        PID:4332
        
        C:\windows\SysWOW64\YRVWP.exe
        
        C:\windows\system32\YRVWP.exe
        345⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LCRDCQ.exe.bat" "
        346⤵
        Executes a command shell one-liner
        
        PID:1100
        
        C:\windows\LCRDCQ.exe
        
        C:\windows\LCRDCQ.exe
        347⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YMVBHH.exe.bat" "
        348⤵
        
        PID:4448
        
        C:\windows\SysWOW64\YMVBHH.exe
        
        C:\windows\system32\YMVBHH.exe
        349⤵
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSF.exe.bat" "
        350⤵
        
        PID:3340
        
        C:\windows\SysWOW64\HSF.exe
        
        C:\windows\system32\HSF.exe
        351⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JQZV.exe.bat" "
        352⤵
        
        PID:2104
        
        C:\windows\JQZV.exe
        
        C:\windows\JQZV.exe
        353⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAD.exe.bat" "
        354⤵
        
        PID:3372
        
        C:\windows\SysWOW64\XAD.exe
        
        C:\windows\system32\XAD.exe
        355⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TYARQ.exe.bat" "
        356⤵
        
        PID:2992
        
        C:\windows\system\TYARQ.exe
        
        C:\windows\system\TYARQ.exe
        357⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\YJEQ.exe.bat" "
        358⤵
        
        PID:2416
        
        C:\windows\system\YJEQ.exe
        
        C:\windows\system\YJEQ.exe
        359⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MMA.exe.bat" "
        360⤵
        
        PID:5904
        
        C:\windows\system\MMA.exe
        
        C:\windows\system\MMA.exe
        361⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XRMU.exe.bat" "
        362⤵
        Executes a command shell one-liner
        
        PID:3296
        
        C:\windows\system\XRMU.exe
        
        C:\windows\system\XRMU.exe
        363⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NCCS.exe.bat" "
        364⤵
        Executes a command shell one-liner
        
        PID:4724
        
        C:\windows\system\NCCS.exe
        
        C:\windows\system\NCCS.exe
        365⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\VNLTAQ.exe.bat" "
        366⤵
        
        PID:2648
        
        C:\windows\system\VNLTAQ.exe
        
        C:\windows\system\VNLTAQ.exe
        367⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XKMN.exe.bat" "
        368⤵
        
        PID:3364
        
        C:\windows\XKMN.exe
        
        C:\windows\XKMN.exe
        369⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MQKKNO.exe.bat" "
        370⤵
        
        PID:3548
        
        C:\windows\MQKKNO.exe
        
        C:\windows\MQKKNO.exe
        371⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\UBSMBS.exe.bat" "
        372⤵
        
        PID:4932
        
        C:\windows\UBSMBS.exe
        
        C:\windows\UBSMBS.exe
        373⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGY.exe.bat" "
        374⤵
        
        PID:5396
        
        C:\windows\SysWOW64\QGY.exe
        
        C:\windows\system32\QGY.exe
        375⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEYP.exe.bat" "
        376⤵
        Executes a command shell one-liner
        
        PID:5744
        
        C:\windows\system\FMEYP.exe
        
        C:\windows\system\FMEYP.exe
        377⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "
        378⤵
        
        PID:4404
        
        C:\windows\SysWOW64\HBX.exe
        
        C:\windows\system32\HBX.exe
        379⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SUAL.exe.bat" "
        380⤵
        
        PID:1592
        
        C:\windows\SUAL.exe
        
        C:\windows\SUAL.exe
        381⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFWRJH.exe.bat" "
        382⤵
        
        PID:3472
        
        C:\windows\SysWOW64\FFWRJH.exe
        
        C:\windows\system32\FFWRJH.exe
        383⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\FPFTPM.exe.bat" "
        384⤵
        Executes a command shell one-liner
        
        PID:3452
        
        C:\windows\system\FPFTPM.exe
        
        C:\windows\system\FPFTPM.exe
        385⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SABRC.exe.bat" "
        386⤵
        
        PID:4224
        
        C:\windows\SysWOW64\SABRC.exe
        
        C:\windows\system32\SABRC.exe
        387⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RQIU.exe.bat" "
        388⤵
        
        PID:756
        
        C:\windows\system\RQIU.exe
        
        C:\windows\system\RQIU.exe
        389⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HGHFRI.exe.bat" "
        390⤵
        
        PID:5640
        
        C:\windows\SysWOW64\HGHFRI.exe
        
        C:\windows\system32\HGHFRI.exe
        391⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JEIZY.exe.bat" "
        392⤵
        
        PID:5032
        
        C:\windows\JEIZY.exe
        
        C:\windows\JEIZY.exe
        393⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\OPEFDW.exe.bat" "
        394⤵
        
        PID:5564
        
        C:\windows\system\OPEFDW.exe
        
        C:\windows\system\OPEFDW.exe
        395⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BRIEI.exe.bat" "
        396⤵
        Executes a command shell one-liner
        
        PID:5144
        
        C:\windows\BRIEI.exe
        
        C:\windows\BRIEI.exe
        397⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\JKIFWSC.exe.bat" "
        398⤵
        
        PID:1492
        
        C:\windows\system\JKIFWSC.exe
        
        C:\windows\system\JKIFWSC.exe
        399⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AAPIZMR.exe.bat" "
        400⤵
        
        PID:1060
        
        C:\windows\system\AAPIZMR.exe
        
        C:\windows\system\AAPIZMR.exe
        401⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLGGHGM.exe.bat" "
        402⤵
        
        PID:5876
        
        C:\windows\SysWOW64\QLGGHGM.exe
        
        C:\windows\system32\QLGGHGM.exe
        403⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BIRMUNN.exe.bat" "
        404⤵
        
        PID:2488
        
        C:\windows\system\BIRMUNN.exe
        
        C:\windows\system\BIRMUNN.exe
        405⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1376
        404⤵
        
        PID:244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 980
        402⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1336
        400⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 980
        398⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 980
        396⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1344
        394⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 1364
        392⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 1368
        390⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1000
        388⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1328
        386⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1336
        384⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 788
        382⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1012
        380⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 1336
        378⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 1016
        376⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1328
        374⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 1016
        372⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 852
        370⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 784
        368⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1016
        366⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 1012
        364⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 996
        362⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 980
        360⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1012
        358⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 1376
        356⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 1020
        354⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 984
        352⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1016
        350⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1004
        348⤵
        
        PID:956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1364
        346⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1016
        344⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 1364
        342⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1368
        340⤵
        
        PID:852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 984
        338⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1368
        336⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 992
        334⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1000
        332⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1344
        330⤵
        
        PID:252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 980
        328⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1012
        326⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 984
        324⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1004
        322⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1336
        320⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 1000
        318⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 980
        316⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1020
        314⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1344
        312⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1016
        310⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 980
        308⤵
        
        PID:700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1352
        306⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1380
        304⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1344
        302⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 1000
        300⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1368
        298⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1364
        296⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 1000
        294⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1332
        292⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1368
        290⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 1020
        288⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 984
        286⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 1364
        284⤵
        
        PID:920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1012
        282⤵
        
        PID:612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 1012
        280⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1016
        278⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 744
        276⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 1368
        274⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 1332
        272⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 984
        270⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1336
        268⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 1020
        266⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 784
        264⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 1368
        262⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 1016
        260⤵
        
        PID:920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 984
        258⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1008
        256⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 1020
        254⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 1344
        252⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 1376
        250⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 840
        248⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1368
        246⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1336
        244⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1020
        242⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1368
        240⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1020
        238⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 1336
        236⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 980
        234⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 1020
        232⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 1364
        230⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 1376
        228⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1364
        226⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1368
        224⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1368
        222⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1360
        220⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1376
        218⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1360
        216⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 1000
        214⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1304
        212⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1020
        210⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1384
        208⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1012
        206⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1376
        204⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1376
        202⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1356
        200⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1376
        198⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 1020
        196⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 1016
        194⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 788
        192⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 980
        190⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 1368
        188⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 784
        186⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1004
        184⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 1344
        182⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1336
        180⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1364
        178⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1016
        176⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 1020
        174⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1368
        172⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1364
        170⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1344
        168⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 1376
        166⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1012
        164⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1020
        162⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 1364
        160⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1356
        158⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1308
        156⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 984
        154⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1316
        152⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1368
        150⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 988
        148⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1376
        146⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 1012
        144⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1020
        142⤵
        
        PID:988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1348
        140⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 1364
        138⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 120 -s 1368
        136⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1384
        134⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1328
        132⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1020
        130⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 1364
        128⤵
        Program crash
        
        PID:5396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 856
        126⤵
        Program crash
        
        PID:5516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1020
        124⤵
        Program crash
        
        PID:1200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 976
        122⤵
        Program crash
        
        PID:2036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 1324
        120⤵
        Program crash
        
        PID:2904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1364
        118⤵
        Program crash
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1016
        116⤵
        Program crash
        
        PID:5788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1340
        114⤵
        Program crash
        
        PID:3464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 1320
        112⤵
        Program crash
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 1000
        110⤵
        Program crash
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1324
        108⤵
        Program crash
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1356
        106⤵
        Program crash
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 1016
        104⤵
        Program crash
        
        PID:1196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1368
        102⤵
        Program crash
        
        PID:2488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1016
        100⤵
        Program crash
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1328
        98⤵
        Program crash
        
        PID:4620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1364
        96⤵
        Program crash
        
        PID:6024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1376
        94⤵
        Program crash
        
        PID:3172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 1376
        92⤵
        Program crash
        
        PID:5028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 1328
        90⤵
        Program crash
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 1344
        88⤵
        Program crash
        
        PID:3268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1364
        86⤵
        Program crash
        
        PID:4288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 980
        84⤵
        Program crash
        
        PID:2356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 1012
        82⤵
        Program crash
        
        PID:2872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 1000
        80⤵
        Program crash
        
        PID:5968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1008
        78⤵
        Program crash
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1336
        76⤵
        Program crash
        
        PID:4960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 940
        74⤵
        Program crash
        
        PID:6024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1000
        72⤵
        Program crash
        
        PID:5292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 992
        70⤵
        Program crash
        
        PID:5088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1016
        68⤵
        Program crash
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1368
        66⤵
        Program crash
        
        PID:2468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1016
        64⤵
        Program crash
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1320
        62⤵
        Program crash
        
        PID:1764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1016
        60⤵
        Program crash
        
        PID:1868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 1376
        58⤵
        Program crash
        
        PID:5036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1012
        56⤵
        Program crash
        
        PID:4264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 948
        54⤵
        Program crash
        
        PID:1228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1332
        52⤵
        Program crash
        
        PID:3220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1012
        50⤵
        Program crash
        
        PID:3228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1336
        48⤵
        Program crash
        
        PID:3460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 1012
        46⤵
        Program crash
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1364
        44⤵
        Program crash
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 1020
        42⤵
        Program crash
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 980
        40⤵
        Program crash
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 980
        38⤵
        Program crash
        
        PID:1688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1332
        36⤵
        Program crash
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 1356
        34⤵
        Program crash
        
        PID:4264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1280
        32⤵
        Program crash
        
        PID:4916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1012
        30⤵
        Program crash
        
        PID:2628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 1336
        28⤵
        Program crash
        
        PID:2496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1332
        26⤵
        Program crash
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1368
        24⤵
        Program crash
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 980
        22⤵
        Program crash
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1376
        20⤵
        Program crash
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 992
        18⤵
        Program crash
        
        PID:5760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 1016
        16⤵
        Program crash
        
        PID:6048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1360
        14⤵
        Program crash
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 980
        12⤵
        Program crash
        
        PID:2980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 992
        10⤵
        Program crash
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 984
        8⤵
        Program crash
        
        PID:1664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 1000
        6⤵
        Program crash
        
        PID:6136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 980
      4⤵
      Program crash
      PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1368
  2⤵
  - Program crash
  PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4588 -ip 4588
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4352 -ip 4352
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2088 -ip 2088
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2320 -ip 2320
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2388 -ip 2388
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1424 -ip 1424
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2520 -ip 2520
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6112 -ip 6112
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4744 -ip 4744
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3924 -ip 3924
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5616 -ip 5616
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2568 -ip 2568
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4500 -ip 4500
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2636 -ip 2636
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2880 -ip 2880
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4848 -ip 4848
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1728 -ip 1728
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2316 -ip 2316
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5792 -ip 5792
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5764 -ip 5764
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5816 -ip 5816
1⤵
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4164 -ip 4164
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 608 -ip 608
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3520 -ip 3520
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1436 -ip 1436
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4336 -ip 4336
1⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1384 -ip 1384
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3420 -ip 3420
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 984 -ip 984
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2868 -ip 2868
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4244 -ip 4244
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4148 -ip 4148
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1776 -ip 1776
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2684 -ip 2684
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1608 -ip 1608
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2708 -ip 2708
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5436 -ip 5436
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1796 -ip 1796
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4428 -ip 4428
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3492 -ip 3492
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5348 -ip 5348
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5100 -ip 5100
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3068 -ip 3068
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4280 -ip 4280
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3096 -ip 3096
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5920 -ip 5920
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5088 -ip 5088
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2528 -ip 2528
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2628 -ip 2628
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5964 -ip 5964
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1228 -ip 1228
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4240 -ip 4240
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4892 -ip 4892
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1332 -ip 1332
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 948 -ip 948
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5428 -ip 5428
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2564 -ip 2564
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4908 -ip 4908
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1744 -ip 1744
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 204 -ip 204
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5896 -ip 5896
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1092 -ip 1092
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5368 -ip 5368
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2324 -ip 2324
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4440 -ip 4440
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2268 -ip 2268
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1364 -ip 1364
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 120 -ip 120
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5736 -ip 5736
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1956 -ip 1956
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2432 -ip 2432
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5828 -ip 5828
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2604 -ip 2604
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3240 -ip 3240
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2304 -ip 2304
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3228 -ip 3228
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5196 -ip 5196
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1460 -ip 1460
1⤵
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3500 -ip 3500
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1960 -ip 1960
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2664 -ip 2664
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2264 -ip 2264
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3172 -ip 3172
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2496 -ip 2496
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2408 -ip 2408
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 972 -ip 972
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5500 -ip 5500
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4564 -ip 4564
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3428 -ip 3428
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3376 -ip 3376
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2480 -ip 2480
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3464 -ip 3464
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3816 -ip 3816
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5584 -ip 5584
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2980 -ip 2980
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2896 -ip 2896
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5868 -ip 5868
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3436 -ip 3436
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3776 -ip 3776
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3224 -ip 3224
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3332 -ip 3332
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3388 -ip 3388
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4400 -ip 4400
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4516 -ip 4516
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4560 -ip 4560
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1180 -ip 1180
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3460 -ip 3460
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4984 -ip 4984
1⤵
PID:252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3416 -ip 3416
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3960 -ip 3960
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1972 -ip 1972
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1196 -ip 1196
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2356 -ip 2356
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3236 -ip 3236
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4956 -ip 4956
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5900 -ip 5900
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4688 -ip 4688
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1876 -ip 1876
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2608 -ip 2608
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3404 -ip 3404
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2892 -ip 2892
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3612 -ip 3612
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2312 -ip 2312
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4632 -ip 4632
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5796 -ip 5796
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4884 -ip 4884
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5532 -ip 5532
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1268 -ip 1268
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4960 -ip 4960
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2752 -ip 2752
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5332 -ip 5332
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 716 -ip 716
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1416 -ip 1416
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2084 -ip 2084
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3884 -ip 3884
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1072 -ip 1072
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5680 -ip 5680
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1788 -ip 1788
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1456 -ip 1456
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1564 -ip 1564
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5856 -ip 5856
1⤵
PID:296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5988 -ip 5988
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1764 -ip 1764
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5352 -ip 5352
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4936 -ip 4936
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1232 -ip 1232
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 836 -ip 836
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4504 -ip 4504
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2888 -ip 2888
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5852 -ip 5852
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 960 -ip 960
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2492 -ip 2492
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3732 -ip 3732
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5276 -ip 5276
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4612 -ip 4612
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3184 -ip 3184
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 804 -ip 804
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1204 -ip 1204
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4472 -ip 4472
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 920 -ip 920
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3844 -ip 3844
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5960 -ip 5960
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2044 -ip 2044
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2560 -ip 2560
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4296 -ip 4296
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5092 -ip 5092
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4388 -ip 4388
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 884 -ip 884
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5636 -ip 5636
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4236 -ip 4236
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3360 -ip 3360
1⤵
PID:108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1240 -ip 1240
1⤵
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3852 -ip 3852
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2824 -ip 2824
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 700 -ip 700
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2780 -ip 2780
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1868 -ip 1868
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2240 -ip 2240
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2772 -ip 2772
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3424 -ip 3424
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1296 -ip 1296
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2680 -ip 2680
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4436 -ip 4436
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1368 -ip 1368
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4676 -ip 4676
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5512 -ip 5512
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4760 -ip 4760
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4532 -ip 4532
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5760 -ip 5760
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1544 -ip 1544
1⤵
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2056 -ip 2056
1⤵
PID:296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 2692 -ip 2692
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 3764 -ip 3764
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5020 -ip 5020
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 3268 -ip 3268
1⤵
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5204 -ip 5204
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2244 -ip 2244
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3596 -ip 3596
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2360 -ip 2360
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4184 -ip 4184
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 108 -ip 108
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2652 -ip 2652
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADNEW.exe.bat

Path C:\Windows\ADNEW.exe.bat
Size 56B
SHA256 5dc59b963d9ccbf776cd698139e00258569355fbb7a58b057274b2aa45f1a1a6
MD5 ef74f0d716870e8d9439920700f841bc
SHA1 f2484778adb4421dc33f769f1d8e2d364625fcba
SHA512 e48c3fea7cc3b242323116e6c7f2b02422ebcdb6c93ad6931f54f83cdba494f0f1422d7d98d0e464ce6a7d944f6bde776e282c2ec5c37d309e62dce9a98f548f
MD5 SHA1 SHA512

Submit Download

BKMIW.exe.bat

Path C:\Windows\BKMIW.exe.bat
Size 56B
SHA256 a4c0e3f7a66a9d1f897edb0f53ca23c6ed7dbd41c35a2e6434430756ffb50fd2
MD5 54c097f8cfa88ee357bd19ea09e046f0
SHA1 14a52f9aaec03fda8cadc895d1fd4560d5970cd6
SHA512 d675dbe2adb7bb5bd43af57982edbb7b3d534b4e39beb21b3a7258f5240869db52f33f934bc4a4673afdcba46c68e4f5cd505919112ca52007c524cfc59eb774
MD5 SHA1 SHA512

Submit Download

BNJMF.exe.bat

Path C:\Windows\BNJMF.exe.bat
Size 56B
SHA256 445851e91f305dcfbdad3144faf245cb6ebe52b59cb1e976dfb5adf05223cfc3
MD5 fdb68f4feb0bcadadb9750a03a83d6ab
SHA1 a93a951c6a66533feef451e5ffec8ff9d07b30f0
SHA512 31ba0582f67fa3fd812d56bc4d485ec4c00685217e2f3f82cff7fb48b1e651a718ade36c1524c95068dd32492bf98f36c40e5867003ce49eed734c17a0e5981a
MD5 SHA1 SHA512

Submit Download

BNNM.exe.bat

Path C:\Windows\BNNM.exe.bat
Size 54B
SHA256 0daea698deff37e6db506a597710b855f092821e26ad98c215d47687112c5b79
MD5 73604ca1c001eec1e02653a7fdede35e
SHA1 bab02542e59edd685f0ca9826695b5beeb942378
SHA512 e5745dd3b411f388ac6cc0e59d2407302a632ddd5a0a9a7fee3d70950fb1ea69c5bf67254a4270794fca6965e888d5f05c4eeaeb3d25be8628b0452e189124bc
MD5 SHA1 SHA512

Submit Download

BOV.exe.bat

Path C:\Windows\BOV.exe.bat
Size 52B
SHA256 001f8293a353c0e6c128aee5175301513fb0c2542f5a9b4ffd414d3141b80ad3
MD5 997fa4e8ac98fbb850b42e291767a3b7
SHA1 02808587e7b3c7668054e23446c6e4118a52ba21
SHA512 08c965c3aa7199bd72ed16802f96885c4b0cd08ade7fc914d3772b128160af6176333bdb511a96307dd84a70619e524b17599609676d9efa61694ee81b1d551b
MD5 SHA1 SHA512

Submit Download

BRIEI.exe.bat

Path C:\Windows\BRIEI.exe.bat
Size 56B
SHA256 691f97ea39e08e4be9f448cb5d79a5f28454e6576cd248b0b0560100562976f6
MD5 f95fa68d58980bc0849083d0ba9ee048
SHA1 168f5b5e24daeae976db7cbf82bbb9c4bd2ab1fa
SHA512 829a82f1e2ac61b409bf17382d69a28196a10d0b847819139144e0557d1b3e770e439f2780db5fdf05b267bf41803689e04530be2d8a132217ed52ad7ace453d
MD5 SHA1 SHA512

Submit Download

BWP.exe.bat

Path C:\Windows\BWP.exe.bat
Size 52B
SHA256 ddd34b234a584ef05483ca8b0dd4d3e397f3a61ededc01210e94d8f52569dab3
MD5 1e13efe6803d429efbcb0e06ba389b35
SHA1 e8ad03a66784237a512cbf7cebb656f375bb593f
SHA512 a41d6aa76d1904d48b127ce47d4912315ba3e3503491f05fe5f8e2a2444d16f45e44541aef6f03ceb3964e5946cfb44bf56c81697701425a4690a212289d7eaf
MD5 SHA1 SHA512

Submit Download

CGAUENR.exe.bat

Path C:\Windows\CGAUENR.exe.bat
Size 60B
SHA256 8a07a172b8b3fae9ddd8f8a0d7f4f77f9e8477b01bd0df91cb0f98d5284bcb8e
MD5 a3d2a58f68f80b344afddaa3957832b9
SHA1 e71a5550f26299f5d7abc3397b4b93844c8ac631
SHA512 6caa2d760276c0441c14d31c4d901cc905083f5b70b0b596e314bd4e4fbe69bfd3e7e71ae51fc334efef90642da7c57f7e35a293337ea18aa8108b386cb85f07
TLSH
T164A0023C0AC130C38A2C40494B4A3F00060AF448031028309A950080608C4EB88220FC
MD5 SHA1 SHA512 TLSH

Submit Download

CKAD.exe.bat

Path C:\Windows\CKAD.exe.bat
Size 54B
SHA256 b05950c1cfe248981060825a135b6b73ebb2fe6ab1d6af1656b4bed89eee2ad3
MD5 6e50f2e3a6f6cdfcffeff460b6ff749b
SHA1 c6c6b34ed1fe22e96c09cb74ed4fefec5c1ecc84
SHA512 3716a610f8e6239d908db447808503d675bbb7f4357f5823e47813fc4a3459c74c355d80471cfa7a4d7badf9b7cc8857d306cd609f7e149e52bda498d0daa54d
MD5 SHA1 SHA512

Submit Download

DCBN.exe.bat

Path C:\Windows\DCBN.exe.bat
Size 54B
SHA256 391f2ef6797e27f675be970b2fd73f9926e4cff020dad252cc135f0d5743e486
MD5 d9ffc9aea168341af9e7ec34f81437fa
SHA1 5d8ced904ad6c7c31dd73f48953fbfda605fbc18
SHA512 f0632cb730ca3fbe1274507d2643139669ee9ec7d55d46132a09008e8ebba165713ebab796ce6848680ad13d05db143cc04c2a5463e575e86dcf8a9050dbf1c6
MD5 SHA1 SHA512

Submit Download

DHUC.exe.bat

Path C:\Windows\DHUC.exe.bat
Size 54B
SHA256 380323ffc9d24effd701e8cf5e748e7c4fa4b2bfd8fd24a18d65f5f1bd61bbf3
MD5 a63e42520cb01f78e7be22863fc030ca
SHA1 fecf63ff9a0d9264b3760ced5864d87a680b89e4
SHA512 3dba59c04ef2dfb3c58318620236bb7e8e1d408d88fadad6370ed74d62f34508b8a324497b39ecb225b2c1fb6217bbdf199d1add8784bbe1b94ec5c972491ee8
MD5 SHA1 SHA512

Submit Download

DPNO.exe.bat

Path C:\Windows\DPNO.exe.bat
Size 54B
SHA256 ea2cfe74602258f3774a040057078a173c846a69b522a987c05078e20bb6fd7e
MD5 9ba9003a12714173386baf530b3b26e7
SHA1 a4ba66791f349c7d230bb3c241d4aebab37d4241
SHA512 429c24997e3c9e0d1312cbd32ab9bc3d40cc4dc17d41b08815b100f0aeea70dd21acda9e5d4c77ec734c13b03dd5c99c13de23a46f2fed13d8e90fa1624b3c19
MD5 SHA1 SHA512

Submit Download

DYGDAX.exe.bat

Path C:\Windows\DYGDAX.exe.bat
Size 58B
SHA256 bdc7ab33486cae6fa84296060c7a51e72827f9651bcf61b4a7a4d91a8c8d7b51
MD5 420923781a5cbd0e17d50c10ed44a06f
SHA1 90ab262ebbf72c52a1d2f7563676e76c181aeb76
SHA512 644ee872cdb9a296c72062647312ee94e148b5a339ab6728a392c412568b7c5443b31df61ab03f484b72803c433f516640f9320f2011baa1acd6a030180eb64d
MD5 SHA1 SHA512

Submit Download

EFT.exe.bat

Path C:\Windows\EFT.exe.bat
Size 52B
SHA256 c15dbf94db054819d36e2678c59f120f8e628886512001c9ff8aef03d92ed046
MD5 37c418dec410e8da6e6cb92316f5a79c
SHA1 38394514e8c759a0c1e7e0901e8a114010b7eaae
SHA512 3fff0d8c9257259207f2eb85bf3614ec3d152818a35ea1fd89b5680e5a442321c97a7dff4679ff3266cdea60e7bdc305bc92db20b8cd6264abb9cb6f18e5ba81
MD5 SHA1 SHA512

Submit Download

EVMZP.exe.bat

Path C:\Windows\EVMZP.exe.bat
Size 56B
SHA256 5b6d1ad277f6d9b490caca0c6d49be7022bd65d8bb3aba9614289c288503556e
MD5 ac5078cda36b77d78f01b6ffb23b5be6
SHA1 7634fc19d7c7e0c663ac823a754475a73848ca15
SHA512 ab866ad67f6fcf5a9078ef3248b262bc730994f26b1ed3a25278ca57c7ce556535f2d76738fbde1e6cb740f5208aef9991cf66696ee9908108bac04aaa3053bc
MD5 SHA1 SHA512

Submit Download

EXH.exe.bat

Path C:\Windows\EXH.exe.bat
Size 52B
SHA256 f6feeedab32a167639f3b6f954dc4abb1a2b8a54eea5d3d8e35c8df563043343
MD5 9f0ffccb38698e2fa343934b820d6c9b
SHA1 9b54534e4a6a9513328e28610d429b17fdd6e939
SHA512 eb9481b5d4ffd49f71692f5fdca69b4c5015c80baf77c0109b3a881cc7074d2a0183eb965638923b64e366c1bb8c987ba5026cb72654a309cc7cb65d6f30c5cb
MD5 SHA1 SHA512

Submit Download

EYIFP.exe.bat

Path C:\Windows\EYIFP.exe.bat
Size 56B
SHA256 ba04cc1edf2d890413e514460fdaa1386f6d96a3ce12f5525f245cbe318c2b7c
MD5 3b1e74f373fc711e6e72075ac42e3f82
SHA1 e87b53c9abfa10f46eefc415d83056708662432c
SHA512 a3d5a2a867b515689b5e4c49d4a7ed1f4e9d4165cd6ef909684861f2edd892a66e21c8ebf066087839cd2e181fff7709b142d1bc99136bbdbe1be41469e229ce
MD5 SHA1 SHA512

Submit Download

FDWXESB.exe.bat

Path C:\Windows\FDWXESB.exe.bat
Size 60B
SHA256 0d6599011929de13562c1c5e5e0c2ec1b8b8ba411c258bd0feb1d042e3f3b7dd
MD5 673c440c7c03f816874c9198501581b9
SHA1 2f86df5a344076c6853be66f345787f82101103c
SHA512 dd49ed71d4100097098bd18d762cddf81806fc3409f386d8c54c00cc483d0fd7965651c011d2dee064e98f268912b43ffb2078d0018d2b78a1562107ceab696e
MD5 SHA1 SHA512

Submit Download

GJMKWTJ.exe.bat

Path C:\Windows\GJMKWTJ.exe.bat
Size 60B
SHA256 626b10b8fa58fee2d7a0cef9f4a86249a78e50647073454438623550d79f69e9
MD5 580d1cd23df3d79673a1b33113c69f17
SHA1 450c612fa7c09f8eb59f8096aee9e06a50bcdae2
SHA512 dc3a698dc81c5b72e98b35de004937314b644875e614ebd81a2fa7d43123a13a1c6b45837869b5d243dff9d6ee09ec538ba49566f363e14829180c3cebbdb306
TLSH
T1BFA002300AC1A2E0882442E9E36A3700260FFC400A100008D215828070044638A280F0
MD5 SHA1 SHA512 TLSH

Submit Download

GLGMNWB.exe.bat

Path C:\Windows\GLGMNWB.exe.bat
Size 60B
SHA256 d4cfc6185dbd3d2a7ce78fd361b4408d41e8fce67ab9b9354f431976b54ba788
MD5 e5d665d645323b54755adfd99c8b29e2
SHA1 964db1d7977df53ad9621cebfcc6c1cb692c0516
SHA512 6a2562543eb7af8ee967b29892c8ebeddcf07969f37a59455c8ae71c98c64bbb37c3d71e8e8d6669403f9763d645d8a50fb418b86b51e236865042ef462f6e50
MD5 SHA1 SHA512

Submit Download

GYQJVB.exe.bat

Path C:\Windows\GYQJVB.exe.bat
Size 58B
SHA256 b6bd0e0b56be851b211ac1c6d61593bb6e45dac9e849ff8a61eb5d97ab04ecee
MD5 6c93f0617c3d11bc091b32b66452ad1c
SHA1 104942dc69e5c68c3b823d015dab2f2ece25fbe0
SHA512 7b66c5ee726821c95eec1d4738426d8695d85ad9bf4656d5adb8d726ba84a6d15d209a7fb24c72961d6a4bbf6dfbe2945ecfcf7aa3435a5cd312e63523036b9a
TLSH
T10AA0023808E1A0C088A6E249434AB702040EF44A82900080121500807004CC3AE022B0
MD5 SHA1 SHA512 TLSH

Submit Download

HRV.exe.bat

Path C:\Windows\HRV.exe.bat
Size 52B
SHA256 be2a4362c666864a2613a50ab2d9ec8a27293ece4dca874995a7994a22ab1d4b
MD5 81ab47f3e4f4c365f61e19983aea074a
SHA1 de727e5c344ed03cf8cb7e7e52d7ee218f8620e3
SHA512 ee1da341093b0a898c60deb9425c91750f2fd27cdec519ea3375ad8182ab8ab62f1b477a8e8f51f2c197d31d4d638d3572d834f0dc4e2adef2b0684dde03bda3
MD5 SHA1 SHA512

Submit Download

HYMOGKT.exe.bat

Path C:\Windows\HYMOGKT.exe.bat
Size 60B
SHA256 9a8c70c260fd7c76409d0d782558ad0c264790b7a81facca895af106a6e7a0c3
MD5 4ab75d64e7367fbd8548009ac8631da3
SHA1 55ad761d386b05ef16ef3f0218ca610f4b42b1c4
SHA512 5e85d0964d0290aba9898fceef8e00afef79affcdab9fc05c7df6feae878838b350f114ebe725179c100eaa69fe5608410611bd57420e1139060b62c913536a2
TLSH
T113A0023008E120C28826404F434EB7A0060AF4420230A30012370282600444380A38BA
MD5 SHA1 SHA512 TLSH

Submit Download

IEKQMGN.exe.bat

Path C:\Windows\IEKQMGN.exe.bat
Size 60B
SHA256 39178daa909b3463e4f9210e9d0cfa66244ade51f20bed25da6d73c2a191b2c9
MD5 bcddc28ced14a6c3b7340ebea0700a13
SHA1 9cbb4aff0068848426e64e7b999919fdf5a7051a
SHA512 963209ac8b733896a70299f596fb85a55ec49e7330d6a9ad13b8023e11a09699f9affe15a2cb92a81701ec245eca280cf13d0798c3d9a864b9e2b0534a23e7d4
TLSH
T154A0023208E320C08824626F6B6A3720048EF4C30A92028093150CC0708C443A0080F0
MD5 SHA1 SHA512 TLSH

Submit Download

IXRAP.exe.bat

Path C:\Windows\IXRAP.exe.bat
Size 56B
SHA256 ade38168b74a6888dde6524f0b8ecb1a9eeea59e77a898f73f52fccb8557195d
MD5 0286206f89d52ae47568b7fce07db8e8
SHA1 e748e6ec668c1dc573e5050af3296d5a0606b7b0
SHA512 1cfd1ae0f8c5b4a6e75c8b9c963c5577b1b62fa072a74473beafbfa9f9b8733eb0f356b54264d176aab0b2cf9ac0d54f666dce049c64d96298df8b43c6bc353b
MD5 SHA1 SHA512

Submit Download

JEIZY.exe.bat

Path C:\Windows\JEIZY.exe.bat
Size 56B
SHA256 bbc6e8eccb86f6ebc1a8b704f98d73ea8e04360f5102fbd25e7304e6388ddf85
MD5 c90b93c0127acbe149048aeba987f0d0
SHA1 bbae916a2571d007224aaa0ca4d231c76bc67bb7
SHA512 445ad2adb3a0baae3ce558e072b475a87627a231fd530efaee74f0886930e9cffe56743c74dfcd89da1eee7b4f781cae90fb6d0b3c7d79baf1a38f97ca9bc663
TLSH
T1FC9002B00AC130E08A244269434A3700042AF4420A1000A09217A080E08444388A00B2
MD5 SHA1 SHA512 TLSH

Submit Download

JQZV.exe.bat

Path C:\Windows\JQZV.exe.bat
Size 54B
SHA256 8623ae6ad21bcb021f545c7bdc13882b757a2d7d6a1d4746c7ba5da46c3c627d
MD5 33ac606a6f445996a39bc8162157ef74
SHA1 dd01e1dfb63345be7714a413a74f8a5fc555c2ae
SHA512 c680a9539a8245842562c81f183851fff8995442729df5a3420455f8fc1e6a89056868d85538e0584e8f429e369f6ec408abf17c87e800bc04a7799393647d01
MD5 SHA1 SHA512

Submit Download

JTPZIP.exe.bat

Path C:\Windows\JTPZIP.exe.bat
Size 58B
SHA256 35755713866ffd600c0dc49740d04f48f7a7e6e3bb7403f245fb95109a9f0922
MD5 c8ea1393573a9bd1baeacdbb2ec91dcb
SHA1 763cc77fcf7ad12b11e2697675198fd1bcc1947e
SHA512 722b9659686c6c4cb86477e70c338e9f8c73312c5ae7f9a4cc89284fbdaa2f2895918a0f1268324d5736de346b109facc6acac0dd6ede700c9c5e9deee106b96
MD5 SHA1 SHA512

Submit Download

KIBTA.exe.bat

Path C:\Windows\KIBTA.exe.bat
Size 56B
SHA256 8ebc34e30a2065ef67bc3c5877a3fce1b344146d7ae3fca4edcff9884d322279
MD5 bc375535936cced9983add52c5afabde
SHA1 e1cd0270fc65dcb17227b94c1d32121cfb699378
SHA512 c9be146bdbc5b211208f8e1a35825f290140ac308c20d5c1b275c19ce2143eeb175ea9750522198247b06c5b727a8f3183ecbfccdb06a4db5170887a2b3580af
MD5 SHA1 SHA512

Submit Download

LCRDCQ.exe.bat

Path C:\Windows\LCRDCQ.exe.bat
Size 58B
SHA256 91df9b5b3f618c2d9cfe62b21d06da3e9438c6d9ca206ac6b78b6593893ae52c
MD5 61f1f45742259f9b7f344c68c2e0f35f
SHA1 579b5e94b40cb9ed6e98d1dfa7f79eb67008a273
SHA512 f24ef1f006d82e5f3981dcf17ddac3d0219a9576a41495793d65de463495d0613079d42e79b80653644f6b64336e79255693b8a3cfa36920affacb0865573ba4
MD5 SHA1 SHA512

Submit Download

LJTPZWA.exe.bat

Path C:\Windows\LJTPZWA.exe.bat
Size 60B
SHA256 19a15d3fac5490e0c8563d8c8cdc16d4003de8c01fc242366ef93a7d6c579702
MD5 1668a29298ededab764cfcb64cd7f5ce
SHA1 589e3ef934e9207252ee117dee238307a50f2f31
SHA512 62714d4ec753491c30c08c64d07469797c6430297397ab88cc15e19093b6b949f96e7310d2c597dfe197e765ca07a4604861d93460b58578905b7c31a48392e6
MD5 SHA1 SHA512

Submit Download

MQKKNO.exe.bat

Path C:\Windows\MQKKNO.exe.bat
Size 58B
SHA256 e964fdf4adc3ce7bd1fe1fc8d173d990d821a9f3fc9fd51563850778c4a84d91
MD5 86d6702d2547b22e5e6cb8a8c981a471
SHA1 ac7ff1bfadbae419591eb9f5e5f45d91e095fce1
SHA512 6a9a2a6e51c6837af3723a62e49850979e76d7556ea5eb1cc130026699f2a45595c52f0b6adf093a12d82a0702134215327c89e14b44a783909581a1e5e478b1
TLSH
T123A0023828C32AC08C24C8C94BEAB7200C0EF4C0A21200201A150082E88444388200F0
MD5 SHA1 SHA512 TLSH

Submit Download

MTNHEF.exe.bat

Path C:\Windows\MTNHEF.exe.bat
Size 58B
SHA256 6f1abef2601b5bd688d116d45923c928cf89601a016a6f1d4eadc6b5e0ba84df
MD5 e10d84d589806802ab402ea76dd7a86a
SHA1 77abdba97eabc321e44f51274022ff97ca2436de
SHA512 f66ba890c4a0f1c01ea8fc496a82bf87f9451bf8a9c8efcface6edb2e3de07356b33fa18568c70c9bbc5a06527d18200f77bf8838866b6fee32d640cde3fe4ce
MD5 SHA1 SHA512

Submit Download

MVYNF.exe.bat

Path C:\Windows\MVYNF.exe.bat
Size 56B
SHA256 e3d11330915a7947185d2ebd2ef6903e23a18c638dd276e755b06a1130883a79
MD5 a400121ddcf5bec0fffffed2abbefd83
SHA1 7c95e6326e4dcbb4553ebebbd7363092e01e036d
SHA512 2455477f9e019a6bddcf8f2f939b260cc528d16a76a8f00eb3d1192bd2dc9e51b7980fd631b97ef07f6a02ce3cf0483090c78022f832f535dae8b617ada182de
MD5 SHA1 SHA512

Submit Download

NBAE.exe.bat

Path C:\Windows\NBAE.exe.bat
Size 54B
SHA256 aba242c19ccb87eceb24550a2a775e98ac83b9d343d076f9e6259d2232efbba6
MD5 ad95709aec40bb5c9194c492080f7518
SHA1 80a1575613eedbdb21bbef800a70783c8c08dca3
SHA512 55d117302227d6eac8d03d53209199c2485db7fe8196e234c5b5ae7588b2809078e8864d8acaefc5eeec87fa0a68d494d1e6f4a0523a8c34a057a20a2f4cbe08
MD5 SHA1 SHA512

Submit Download

OJUWPM.exe.bat

Path C:\Windows\OJUWPM.exe.bat
Size 58B
SHA256 586ac125ac7b70546f2b07717006bd37cdeb272360dc0620b722d6d83b95e9e4
MD5 d94f29058ccb293573ddb83d8dda80e2
SHA1 1e098032e2785fd5b4dce53f9e71597b6131a1b7
SHA512 d01e1286c7cf84b08f5c55e461fd802b007cc203fd46ec8444f50f17e8329bb155975ea56a7b53f131e08ef4d95cda5b524dab26d80aea9b1ef76a579724558c
MD5 SHA1 SHA512

Submit Download

OMXSYL.exe.bat

Path C:\Windows\OMXSYL.exe.bat
Size 58B
SHA256 89a08aa2a3dc58c970d13af65b19215fcf52653f62ebec342012bf8340c1ec69
MD5 d250fbc6d6ed4c167aa99f07b86f4822
SHA1 61b771b077ba835818979f655500315999385218
SHA512 ad45453c3c6ccab5b9209421d8375b97d08df7be095c9aa41e7df38d041842b00e647607d93bc9d931605c1cef10b6305d41585b5fec1f96c17ff456079e3716
MD5 SHA1 SHA512

Submit Download

ORWBR.exe.bat

Path C:\Windows\ORWBR.exe.bat
Size 56B
SHA256 2cc2391b36e37a8adaa9de9e637a5d75330aea2bf139c5d28aa797cc4d514709
MD5 ee4ab7ae36dae07f91e9c01a9d05d855
SHA1 8c816617f458e0e93137cd6263486a479c0176a5
SHA512 4d628555c83d08bbc4bdb9564a403c42836bcdd2e1b3c922b24626b8466763e6986a6432b30bcfee5c6b22299a2b2a76f8c39b4a74c2a0ad38cc6b44a23d6731
MD5 SHA1 SHA512

Submit Download

PTK.exe.bat

Path C:\Windows\PTK.exe.bat
Size 52B
SHA256 7a40e21160cda3cc1a080957aac1da6b5fedfd095ffcadec863702901f33452c
MD5 e8bca9fd457750a86e51f858832a5703
SHA1 6ce43772be86d559f04bb23eab9ce24e45a0ea87
SHA512 9e657157f783052e3c2b00eec9f0208caf54cb5a12c643dcdb80c69fd7efced6353d69a636945b0b600bb5764d36502831e646aa352d34f6a55a82660705ce88
MD5 SHA1 SHA512

Submit Download

PYWT.exe.bat

Path C:\Windows\PYWT.exe.bat
Size 54B
SHA256 77ae374f142e063f35c9c2af4a28e9db5d61a9c5374e398fc39575b8fefff113
MD5 0257a49403a501d5a2850046ce185d24
SHA1 30ab58a0c74b8948f1071a29297d8b17da16987f
SHA512 bcd343676ffd60cefcc52da1eae1ae5a5187ee5fb539511b911866b3ea10bd4fb9c1b309963895b2b9ff2b473114237fb8c2f6f10cd35e020b3930e02921b19f
MD5 SHA1 SHA512

Submit Download

QEMKUWM.exe.bat

Path C:\Windows\QEMKUWM.exe.bat
Size 60B
SHA256 fde696f95546b2ca91ea0629a11eb90cb0de98858fec90d51f9ab368ed93cbe4
MD5 89b393782742ca8d43e47695e88584c7
SHA1 a5f0b7753ad294cf4a9b4583581080369733b62a
SHA512 9edfc7921a6c58cc35a4ed493acfc1af2d83edf64c691c1d457ff4ff535be0a985b0f07d4c6a1fc097ff0eb30df7020d19594bea43b52e2dc45238b0a927e726
TLSH
T174A002B08AC1A0CACC244049734AB702040AF4CA0A30A00012950C80702444B82000B0
MD5 SHA1 SHA512 TLSH

Submit Download

QJADI.exe.bat

Path C:\Windows\QJADI.exe.bat
Size 56B
SHA256 ca99f8187f1d1f7ff038739082b229b37c675626462b97eee89833105b3a9b8a
MD5 33997c9dfb7ec149a13edcc307c78354
SHA1 0837fd16d246d16ea4e0c74562b6724fc6156140
SHA512 52aaffc04d3bab87e1a7b6e85a598f63403f7eb9e73b425e58858fcbb95012e91662634572073657ffffcdfe502ed051cee8360adb29ae91431096f321296a5a
MD5 SHA1 SHA512

Submit Download

QLJ.exe.bat

Path C:\Windows\QLJ.exe.bat
Size 52B
SHA256 ff48b43adfc1dd50994a6f1c990604219f58fc3d54ab15ac05b60cdbe33d666f
MD5 03d1676feea9dab9912ab59c880b37c2
SHA1 5a505ea4e82e524c52f74f37dd8570ba72c9e63e
SHA512 a5c1c96ac672eb9e8146678b8ae6539e379e2481e2f03556ab40b8aa7804f121a7c4ee82106556cde30399d1802a61aec2018e8bcc652d462ac37d138df21691
MD5 SHA1 SHA512

Submit Download

QPPVYL.exe.bat

Path C:\Windows\QPPVYL.exe.bat
Size 58B
SHA256 0c711bc0b32fca40638cf58544e4e17fdfc5aa6fe1f6e99ce2a91795f3d0aece
MD5 9f3f83a9e4176b9d69205483a8373832
SHA1 7fa90ba0dcc3f0c2968ec7ed7efdd7a1438b8b0a
SHA512 308463516590efdb85de2c6e27a25b3fb322198b4c67b42bfd6e73518f438fcab0e9ad72b365b632c6c090c60b20dba7b970b9393bec3843f6e2bd506cd3d10d
MD5 SHA1 SHA512

Submit Download

RAYTU.exe.bat

Path C:\Windows\RAYTU.exe.bat
Size 56B
SHA256 d106dc6587c830981d60e2bac1b16f816f704ef55e873255d410580aa0f6adc8
MD5 f41343b58767bd2be48a0b0e7ad7a1c2
SHA1 7602f6c4342c6501df25ae8de831ca21ca51d44a
SHA512 352c368923213c4de26e513e5a12eaa60cd426cb9d74ffafd643e728193835b67af202d8b87b11b0e3af39edf70d50f63a828071b1ec865a14079482f9c8261d
MD5 SHA1 SHA512

Submit Download

ROPGVHH.exe.bat

Path C:\Windows\ROPGVHH.exe.bat
Size 60B
SHA256 f4b00921496e0783865ec4a988e5504b1a4c6de108a5cf30df5550aa0b39478b
MD5 1b3c9e9782d7b50025fa1ce5e8220b51
SHA1 87c2164755256a741a8669ec4350f24fc9bb8900
SHA512 9676a0561914a6680dc0815ec0bc16dd88d59c621217c2ae2bd868a873e96fc78261126d7397927cd5f5c83d8b4441ce3cb5b26073c368155cda548ee7e0f6da
TLSH
T100A0023808C120C8C8A44849CBCBB720060AF6420290000013152A8070A446B80000B8
MD5 SHA1 SHA512 TLSH

Submit Download

RQOAXU.exe.bat

Path C:\Windows\RQOAXU.exe.bat
Size 58B
SHA256 445f7b6c3a9a2695a1fe9e4aa87fcf55555d0561dbcf33b4a14ba6181d4f8946
MD5 8c18392f0056a8092c9df79d58f45d51
SHA1 8bb0412241391b76484a0cd8d2debeb1bb2492f4
SHA512 ccaf2b6059bb042c98c44f13a06bc5f7fb9db4c12c04d33e78860660ec76eab25d394d471ca14f30ae4628e63965877a51f94f58d32c3332db598b6b0d2407a2
MD5 SHA1 SHA512

Submit Download

RRX.exe.bat

Path C:\Windows\RRX.exe.bat
Size 52B
SHA256 6e2c3612090ff12520d653f2f255bbb2173b2c1519ce899adf112ad835bd1be1
MD5 d997863fb663a65831450b5676da5b55
SHA1 93f8cffb6bcc41668b382c97552e1db38e3a8b04
SHA512 bf1cab49dfe94f94bc43b51d84feb8499a8a62426e39c667ba3de0e07eae5164a37b7b6b2d7a7ef8531068de69f041790fe54b481f7bb9b5dfdc3e03a8c651c8
MD5 SHA1 SHA512

Submit Download

SFRSIW.exe.bat

Path C:\Windows\SFRSIW.exe.bat
Size 58B
SHA256 4f1b7a5c82784a19c9d7866d892b495b81d4695866a25d02c39ff716b33d2aaa
MD5 377e9d794dee55b9ad4b05cdbbc0924f
SHA1 6b61b78a6581657b8365a010c4efd2a3b191bf18
SHA512 50589071a8c95e9e290f0ea7ab5091d9321ea0785e14268bb511b1cd1d11805127f75164b7dff540181834d3ccc3af235ef23d2c9efeea32ae68c727f48c54f1
TLSH
T15CA002F028E320C088344049434A3788840AF46082100822129528A2608C46B80302B2
MD5 SHA1 SHA512 TLSH

Submit Download

SIZHAQ.exe.bat

Path C:\Windows\SIZHAQ.exe.bat
Size 58B
SHA256 64827ac31fde4e694d48cdc7e3c71ab33dab206d218ddf13984968b6a0e2cede
MD5 cbb1a86d046c3cebeace0e1e00414495
SHA1 90c5c5d963b6b87cd09d4639b5c13544082cd2a1
SHA512 6670840f24cf550fd49874fca53a3b0ed39234f01a3ee6f7b484cff06d5060e8aed6497f41702e32d8c2759562341168be90c7fa1fab7695ec6a3ff2b3a7cf8d
MD5 SHA1 SHA512

Submit Download

SUAL.exe.bat

Path C:\Windows\SUAL.exe.bat
Size 54B
SHA256 bd86899a959e5f3a036bca26325715dd4113cef12e1692732e5db17aad2151e6
MD5 853402996b2a65b89dbbf99ddd23b165
SHA1 fe0c380781a7024613d95fb00d0524b63406197b
SHA512 211e60a0de058cae1321f857150abf68a6d1bb9d27e35ee891fa388d6b63fe19de6913ad01d410f21da82b925279becd775202e0706762a900416d1e8a90ab58
MD5 SHA1 SHA512

Submit Download

ABXE.exe.bat

Path C:\Windows\SysWOW64\ABXE.exe.bat
Size 72B
SHA256 db7e4dbea19d549d0e7d6f2c2d19348b3fdff980691bb4b998e94c4bb9692b6c
MD5 3bfc2185ca36c4e4feab959c8dd9fd42
SHA1 10e2f741236804d8b76e2e721e2c06d3024c9a51
SHA512 39c9cfe8ef14737f37e577021c1b18d81af843cb433ceebc065c8fbebdd1ebc79ebf979f8db6673bde7cb5528d80089ef6c7f1f63d5c71604d64c3d09bef9650
TLSH
T12AA002300BE322F08A24407DC34A3730042AF64A0312A02012DD20C3E00646BCE22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ARUZXDJ.exe.bat

Path C:\Windows\SysWOW64\ARUZXDJ.exe.bat
Size 78B
SHA256 091f7fc28928d694686e52dbdb3f79430dba2a0beef29dab9fe421fa6e1adbc9
MD5 d4281c45eae6a0ea98fde1a15cb62cd9
SHA1 cc10728ebbc272ae163f6ce16a655c047ca433e7
SHA512 f1bc732268a23c8c930b15b8273c34ba61d0978dfbf7d0295d3f92678530e71b804f34a9546e8ddff7b26827c6d5b275ac5cb9e12965a9b00a13ca03377d1417
TLSH
T1D7A0043445D114F04C1450DDD3C577130517F4C503110410515554C5D5144FF4D11C74
MD5 SHA1 SHA512 TLSH

Submit Download

AXRRKM.exe.bat

Path C:\Windows\SysWOW64\AXRRKM.exe.bat
Size 76B
SHA256 973cad2904bb76ddb20c52519c7b5b1983c48346cdb6faac90e55ff3975136f0
MD5 5755b5c7868012c34efe9259125f5d28
SHA1 06b62c10ebe172889aacd24b0f3f31ec6f139b6d
SHA512 1f657a76d51f0f1d38bb62505aae75870741f414c8d69d022c8dc87f5b46dda166f5e3342db6d044a4b2bfd42ba7ff56c0653314ac88ede036ae351ebe153ecc
TLSH
T171A002308AC3A2F08C24406DC34E3720043AF44A033280A0129528C2F2044FF8E3BCB8
MD5 SHA1 SHA512 TLSH

Submit Download

BALOI.exe.bat

Path C:\Windows\SysWOW64\BALOI.exe.bat
Size 74B
SHA256 e8cf81a489d80aeed93a0194cff273f9fe6acac352badfe5adcc57cb83f63234
MD5 a627bbc827d60ea30fb1341fff342f8d
SHA1 d8a489e5ab6065ee04b74db012b9edb410a0823b
SHA512 e2ceed74a4651254dc324bab0ca635231fc3269cda7be5e56ab27bb8c8d8fc7644e046014f5d25d996e5f61f1d4f4b48f1c6ffb56d9dab2ced90616a7baca7fd
TLSH
T194A002300AC120E8A824406DCB4AB7208CABF4CA23300028129720C2E0044CB8EB0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CDSI.exe.bat

Path C:\Windows\SysWOW64\CDSI.exe.bat
Size 72B
SHA256 76efb132364e93a22649b86d8a84dbf847f2c5f3b26e962151b0209da84ed813
MD5 b906233174806bc29f358f63a03fcb58
SHA1 9bc60ee9b95558a866f7333618417c47b6f20bd2
SHA512 75ecaee031923ffd942a7a17c74c17284969a25aea36841a208c5b5397ee6da71add3bfb1ab0c8056f33f40db1bce705d356c3c3b138105e1985c683229f638a
TLSH
T11BA002300AC130E88C24406DCB4A372006AEF46A239000201395E0C2E00C44B8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DDKA.exe.bat

Path C:\Windows\SysWOW64\DDKA.exe.bat
Size 72B
SHA256 33c2fd27c0b9620ad7570ca5d809734ba19beb1fc6903b8b296c3db207e515f1
MD5 c4148e4139c6b21720808a1e4674977e
SHA1 6b9843f9499f377f279e9dae2576db18bdba11b8
SHA512 eee6dee70f796c6563d35557fa3b5fa5f7661dbe6595bf1d5edf2fdf17580f15212cc3b15f6b0bbcaca0149e01f431c75b68046b88d7c805a4befa8002244bf3
TLSH
T1A2A002320BF120E08824406FC3CA37200C3EF44A83B0832012BF20E2E00C46BAA20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

DLAHHUG.exe.bat

Path C:\Windows\SysWOW64\DLAHHUG.exe.bat
Size 78B
SHA256 7748cb6dc5a141f30256663386c439f561e46ccb61b249db638447826505293e
MD5 14dcdea219d0dab720334f153102c32c
SHA1 dfa64581befdc7f27154259633fb9fc1d7e2731b
SHA512 7deb527979f6d82ca80be468b70d740e6786fe651074948eb604456e22b9c834ccc1e7e72e9cc06ba969003fe7f0f26c33a6dfbbaf498671eecb7741e478ffb2
TLSH
T140A0043405D550F04C1CC05DC3473F10047DF44D53101150D15754C3D0454474514CF4
MD5 SHA1 SHA512 TLSH

Submit Download

EAHXASN.exe.bat

Path C:\Windows\SysWOW64\EAHXASN.exe.bat
Size 78B
SHA256 829dd1229937680c2c57c96b31fc6ecfa12705fbe48208ca2572658a73e548f5
MD5 94fc6c2c490c51a09474e399fa400963
SHA1 e114042a63584660532dee0fa519a3a7466ec5af
SHA512 2b390624637c2c4e9fa3e2cec72b97b22ff56b2756cfe2311f5b2823e211b82f6d86000c7c3e26c5b402940a04b0b96f6b683944fab05ca59fecb2d6329c6d72
TLSH
T1AAA002B00AC3A8ECA8A4406FC34E37220C2FF44A03F0002092952CC2E02644BAA28CF8
MD5 SHA1 SHA512 TLSH

Submit Download

EUCAE.exe.bat

Path C:\Windows\SysWOW64\EUCAE.exe.bat
Size 74B
SHA256 f47721fdd0579409670d9a37ee701070645ce3598f69f9f5688e57f07eb24cda
MD5 c0139dd67b14aa7e19d39038bcba2f80
SHA1 1f6510018bacb7784e9169fb8528233ceebb71f8
SHA512 5e65247d68eeb5e6755206edbcec1f1e43b25cee06a6b7fde434f5a71a95dbaa4079ca272c6c4c95e8a28c2bd615fb1d829f566cf087f5c177607d7f3203fc02
TLSH
T1A3A0023C0BC3A2F0A8A4406FC34A37200CAEF44E039280A032B530C2E00444BAA2CCF8
MD5 SHA1 SHA512 TLSH

Submit Download

FFWRJH.exe.bat

Path C:\Windows\SysWOW64\FFWRJH.exe.bat
Size 76B
SHA256 f4b87af9bf3f3c4906d335be44ffcdb9a8ac1fc31070f400cb2b4dd71aa0cdfe
MD5 be2afbc42f41ebc08325e3743c2f01df
SHA1 03867352cdc6e0d7a36e16bef2286f032e0482f9
SHA512 37c5c6c2e317f11477dc96669c866eb0c64c4fc5021b662c7e61ac0bc4247da2fe30912e943d248b20e9a4cdf21f6ace9103281d52c5935d0729fea8d72722a3
TLSH
T1A1A002308AC928F8CC26706DC36E3738042AFC6AA31020201B95B0C2E8C466B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FGZBO.exe.bat

Path C:\Windows\SysWOW64\FGZBO.exe.bat
Size 74B
SHA256 b3321e86e84f70131f2d50d0f51d9596d2a811d538da6f56ea1a4fd058665dee
MD5 ecf3df9b2fcaf52e5e217cdd8f5042e0
SHA1 d488f88c7864b833b3f343cde9472926d49617d7
SHA512 8b99a43ed69b0dcf4b16fd8f3e60f049587996f77ce53656476e309a590ac6bb80eb3b97ddf98b15247f57b749d45b30fe3956cbfb8729ee9eadf353e94068bb
TLSH
T1A6A0023C0AE1AAF0C824406DC34EB728042AF44B8318202C129520C3F20444B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FOS.exe.bat

Path C:\Windows\SysWOW64\FOS.exe.bat
Size 70B
SHA256 1a0c0da2bc553abc850a8760b93adcae9041d658d5099024418ccac72bad9bd7
MD5 f04071cf4e557cb7a0abb70ce850539a
SHA1 40d90cf627bd5ebd3aa9eb1a624bea567fe80c56
SHA512 1d06b0a273c699090814c8c38bb50cc7097a3d5849e65571db6da5c655ce3b229ffcc92314bb5e5ed971a1756540f49d67edbc0e5a6dc2882c99e4707b879d79
TLSH
T16AA002300AC128F08824606DE34A3738042AF44A039020201297A0CAE00C44B8B30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

HBX.exe.bat

Path C:\Windows\SysWOW64\HBX.exe.bat
Size 70B
SHA256 6ea01f5295edfa30b13cfa4baef562decf348fb55909eebc971211f381b9eee5
MD5 daed5d1b5e25d960b787691d3aa4e534
SHA1 c6ab34b8cad5fded84898f62e30a35b47468b95c
SHA512 235cfadec48fe7d558eaa2aeae9188d906fb2c4ae932c2aa7b974300922c575d8212774daf3db5f304a95e76abc4f90c0ffee57396310494a318ad14befb3e9a
TLSH
T118A002300EC1A0E08C24486DC3CA3720842AFCCA031000A0329D20C2E00644BCA2ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

HGHFRI.exe.bat

Path C:\Windows\SysWOW64\HGHFRI.exe.bat
Size 76B
SHA256 5d03b7a173d71554fcabae62459a9588a48d9a250518c6b07f086484fc2a8898
MD5 8da250a8f3f28f7fd73d30e4090954c9
SHA1 2192882d47b08c1fc78646556e82d7b1cd82f46a
SHA512 2f99c0938f526e8aa3254938805748e6d1c55a1854410bd87254e1b14285650dd4e8895f5c8e2a956f0036e1fa962f452d1dba852af136e80cb89d73ecff453f
TLSH
T12DA002300BE120E08824406DCBCF37200CEEFC4A0B102228129D20C2E00444B8A22CBA
MD5 SHA1 SHA512 TLSH

Submit Download

HQDQIOV.exe.bat

Path C:\Windows\SysWOW64\HQDQIOV.exe.bat
Size 78B
SHA256 36070125ae6f69467489f5bd73365b06011b0adc748ec275153737bf7bf2d2a2
MD5 d053252769f60326f73208e572f26702
SHA1 d314860aa55b73000be0cf16a2b569b62ed4de61
SHA512 64f3536285d38f6b083b18ff65d2065bbef8359778be527638c60db1fff7a3ea9f736c59924f6d2f716fb6fc3c0fb0a238529366f74beb887b12c69ee9bd8ec8
TLSH
T168A002F00EE320E0A8A440FDEBCA37202C2AFF4A0B100028129720C2E02444B8A22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

HSF.exe.bat

Path C:\Windows\SysWOW64\HSF.exe.bat
Size 70B
SHA256 715d7aad99696a4f45d9b582a6e1c12ec556f0ccf5fef737660d46650b01f9c8
MD5 bc7e8c261ec9874b7fc1d90a2cb442c0
SHA1 0f5cfc116557e562df4371f3c6f7706c9ac7efdc
SHA512 71690ebc616f51b4491b96108da30a50a5372d953f322f55aff6d3ecb44da2d0a0bc788ea61b1dc80d5ae6b98d4ba5056331570feb664e1feac9ffb2f02ef0ad
TLSH
T1ECA002300AC132E88824426DC34A3722242BFC4B03100020329530C2E00444B8AA2CB8
MD5 SHA1 SHA512 TLSH

Submit Download

HUCATIL.exe.bat

Path C:\Windows\SysWOW64\HUCATIL.exe.bat
Size 78B
SHA256 bef4066080573df35ff99dd5c74fbdf4e2ced597c4d8a0bc78d8e0cef2b5258a
MD5 de91ee03c1c5fe3c488d14af2cf55e97
SHA1 0da2a5471edccd9d1a29e5ce804c657a4e15c7cf
SHA512 ced346ef074d534f374df4a31aa82280839e0ac3f904bab6481abb891b03799b0dd72ea5da4ce6215145ee4f476a89094fdb8142a472e5034409dcc2357a6c05
TLSH
T162A0022007C110B04438807D86452610045DF95F43144330515A31C3D045457D531C75
MD5 SHA1 SHA512 TLSH

Submit Download

HVWFK.exe.bat

Path C:\Windows\SysWOW64\HVWFK.exe.bat
Size 74B
SHA256 2d0237b9b55a7bf59636b105e4aa35b93a73a3c793dc9721db12f371317cbc6b
MD5 fca8220116aed6194112d31b6a5fcd71
SHA1 a5801d9961bdae42f0341ce4383e654a42947d3c
SHA512 7daba28beae0c8e92a26757a6979becd5df59590d1f4d5e5b919c46c8831d9d30263a0edb383cd681def2804d093a36a1dbf4e2710e1c3ae5957994f81dfc80b
TLSH
T13FA002300AC120E888BEC06DC34E37B00E2FFC4A83188020129520C2E80644B8A22CFC
MD5 SHA1 SHA512 TLSH

Submit Download

IGF.exe.bat

Path C:\Windows\SysWOW64\IGF.exe.bat
Size 70B
SHA256 75d31a42bfc8a179808b92c5e3109b760b3ee6e68cefde1db0c856f4dd62a87f
MD5 278b742988a993941e57497237ff508a
SHA1 2c26f8611fda3e984fa007842311fab34530f831
SHA512 c489c17add5d1c3751a82cc246bf13021846ec3aaace8b23b362cc510c82ea5926899c51d25e8d46f66d7b1577e189869e725f4a6d7e4a73422b12ca812e8234
TLSH
T1BDA002302AE130E0A8A4406FC34AB72204AAF44B0310002812F528C2E00444B8AA0EB8
MD5 SHA1 SHA512 TLSH

Submit Download

IKGNYZC.exe.bat

Path C:\Windows\SysWOW64\IKGNYZC.exe.bat
Size 78B
SHA256 96f8292ad1580eb255e0f247d314104d51d11f8bd46bba84eba85de8b752b68c
MD5 25fc8b86570586e950e2b5f59db97a53
SHA1 fc4e1de4c69731f693e0d078554a5cc2fac19158
SHA512 5f91758057c8fefd153263945bfdcbbf67f9a4c895a2e30225b8c7b39b5de3027469acd3503e336b4332cd5cd0c90ba71d9dfa6629d0eec39fa6e91d47d4fad5
TLSH
T138A002B0AAE132F088246E6FE3CA373004AAF6CE0310022212D728C2E00444B8E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IVERVQL.exe.bat

Path C:\Windows\SysWOW64\IVERVQL.exe.bat
Size 78B
SHA256 55a7e2b0f53b866482ab476c5af08f05342587423b7c3d9ae2e6b50b122ee418
MD5 877221207ad2e577d9da190e8fd4cf05
SHA1 3d16712639024b1ed194b3ec957d16f58af2c598
SHA512 d625b7d7fe60445cff8c635509efba54bf7cfbecd93f814d9c5d412b5b1270be77df28824158d8725b0a3f320dcada02dbea287b777c2ba109ea19754d54c984
TLSH
T134A002300AC32CEAC824C86FC34A3730062AF44A03103C20929528E2E80466F8B20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

KVUNY.exe.bat

Path C:\Windows\SysWOW64\KVUNY.exe.bat
Size 74B
SHA256 650c1361604389729e9f8ee56e6ada28ed41173b33b8dc51ba14285c52fbbd5c
MD5 29b85e13a80e5dafd334a7d0408675e6
SHA1 c40498819a91b9b39d21924d253b774659ca50e9
SHA512 7a6d7a93fb48b843ad61eee7580f63f15b9fd0a44d848dc0da5b2bac0180186a717a4ae28eee9ce28c45916c373fd6de5c4f3a070e37ba5bddf40def25e77f35
TLSH
T19FA002B08AC928E2CEA440EDE37A3720043AF4CE031002201A952CC2E08C44B8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LHD.exe.bat

Path C:\Windows\SysWOW64\LHD.exe.bat
Size 70B
SHA256 9a9a0bf3e3d347a67d6495ca330a7ca9f85b62936b2508d55af62f69dd93fc52
MD5 3112ca64773c365f65f32bb9cc0ddc27
SHA1 fdef41b39cff226be94b8cb2cfd413f376207ad0
SHA512 fc796a8c560e42e6b03d7db8b3af67535ad67c55e6a016aaab1546dba6d44c9d883a3ec0d21e75681e1b526d803fa5e58237cd73b7f08abc5833b758e60fd6cb
TLSH
T1E8A002300EC1A0E28824426DC34A3720842AFC4ACB98003012952AEAE00444BCBA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LJDPC.exe.bat

Path C:\Windows\SysWOW64\LJDPC.exe.bat
Size 74B
SHA256 5c8b8b5535ba2cb505c96f363dc8043a95d0172529a3642caf00ae99076b031f
MD5 281177ccba05683e14be31f72cf0dd2b
SHA1 946534aa5abe2d44db5b509d4b293202a0763cf5
SHA512 b2e24d4c8ce11d05ad51b08b5232f108d74516e4235e3c6d4288db47b65e19eb058a9794967b860628d14c84b32d83c368a668ee09488dfc172c6257f99e1830
TLSH
T170A00230AEC120E0A8B4626DCB4A3720042EF46ACB10022312972BEAE00444F8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

LPEDLZ.exe.bat

Path C:\Windows\SysWOW64\LPEDLZ.exe.bat
Size 76B
SHA256 fe8656a2ddf830fe73a1d8375f251917196a8bdaa7b63c7b5329d0e39bf70287
MD5 165dfba9f21e99650dd938ce7ca4c2a6
SHA1 e56e8580becd4015d4d72750359d19b8b6aed4fb
SHA512 cf3fef3077fccf126897a83030ce5f026816fcc769feaa8addf4689521d007ff206e8de543c9c844754a5201343461b4635d8f1161632f9f40a2e522fdd1fae9
TLSH
T12BA0047107C711D04454455DD345771404DDF44507300110315D15DDD5444474510C74
MD5 SHA1 SHA512 TLSH

Submit Download

MDPBXL.exe.bat

Path C:\Windows\SysWOW64\MDPBXL.exe.bat
Size 76B
SHA256 4f091f2cbefd0cc923c4307a64e038c90a5ba6b94767f2456460de045b08ad9a
MD5 1c273bc3605ce7548caed80ddcca481f
SHA1 3283db01595bcb8d282d62059ea2dc7f9dce379c
SHA512 8d22ecde5cb4fb982ef1c0ee6490195ade2cdea845a17ce65aea14111acbfd69b1855d2066e806c39fbd2719766568b873857315d914ab053c36329798a5105b
TLSH
T13FA002300AC120F08C24C86DC34A37B2042BF44A83108820129D20C2EA07C6F8A20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

MMD.exe.bat

Path C:\Windows\SysWOW64\MMD.exe.bat
Size 70B
SHA256 d1fac4788ebb53ba141b818f4dd02cdfcbeba240f3cf294dc3e515ceb7f6ffac
MD5 1d6aedb740f657a09bf4bcea0161b610
SHA1 17ceadfaaa24dd70f6dfc43fcdfb11dc4c630ad5
SHA512 d0991724e9faa3ee93593d3cb07c603aa869629a49739b919ba25d78327ab1a5cb126456ac90a505b64f586bcf32dc00b021e484591d0a51e46ce774c1002560
TLSH
T1A6A002380EC1A0E08A24C06DC34A37202C2AFE4A03188030129520CBE806C4B8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MZQV.exe.bat

Path C:\Windows\SysWOW64\MZQV.exe.bat
Size 72B
SHA256 9b4a2e2b45fa4c9dc3919e7b1d859c9c859c367cb95a90be08324f818ffc5260
MD5 8c7a2f23bec2f8591e0cd7208f4a4791
SHA1 3156741540c047d33664add9b8b46aa3085320ad
SHA512 6b2e8c6df5295b8518e4a8e24022af9a7d74259e6dc6046b8d404e44401b42ac74b6daacafe163d929a80d29b5820a8b6602a92313ad16da03b9905b609ebab3
TLSH
T1ECA002382AC128E08A24407DCBCB3720072AFC4A0310803A139520E2E80644BAA20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

OFWQ.exe.bat

Path C:\Windows\SysWOW64\OFWQ.exe.bat
Size 72B
SHA256 076c2a57a173c12e45d64a1ba1f633f3365d0bc090e886bed2e9a77fa0cf3a86
MD5 fdd4ff6721e0a407ed1848bc9b5220cb
SHA1 af871802e3eaf2a495d725b3ae17636f01acf274
SHA512 a78ee4931a950d7592cda5f2c7a3eb27a40f4c30896e4848b71f65d6fdc801963a8bb5ef4334b0b4e2d98a2c30ffa8a25bf0233882ff7c29ca77691d71a488d5
TLSH
T1A0A002380AE120F0C82EE06DC34A37A8042FF46A031000301AB520CAF00C64F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

OQBWAE.exe.bat

Path C:\Windows\SysWOW64\OQBWAE.exe.bat
Size 76B
SHA256 006128174c09b6e7923bb8897540d5ce94b8e409e747f84e6f0dc69fb0838ba7
MD5 67f5637c1901c988628b588f43e47a67
SHA1 3e4204d7249fa90adc41670199ad2da32a11e12f
SHA512 97b6c4922978232d18796238ca24efbfbe9e8f37a3155a5180fcd236f018c7f1d4ca5ffd1414d386cfc394f859aaa39a773f120105b8a678e09c86a4c29c5a08
TLSH
T176A002300BE3A2E0882440EFC3CA3728043AF44A03138228129530C2F80664F8A2AEBA
MD5 SHA1 SHA512 TLSH

Submit Download

PROX.exe.bat

Path C:\Windows\SysWOW64\PROX.exe.bat
Size 72B
SHA256 f875761d85f9fdc4c0465dc49a8ceee9459baf839dd3aee204470f7f3fa3d2cf
MD5 27bfc9c1c7b2e7e1ee9b86a0f66aa6b1
SHA1 5163908f2bc9ae500450d1c675b87f65696411de
SHA512 c3e432020571f9169eb2bf14d71a91e84c203d22258511a16d53c4c11121d7f06314968aff167f9d0e25ac4dcd68ffa51a6c7331851c453f7883fa6faecd7784
TLSH
T1F5A002320AC120E08C24426DE34A3723842EF4CB0B3000B012D730C3E00444B8EE0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

QGY.exe.bat

Path C:\Windows\SysWOW64\QGY.exe.bat
Size 70B
SHA256 ad196885b62bc753f67a6213ee436ba2bb945c97e2f8fbef41cba8a489c4754f
MD5 8f864aa601af7d0c970163ff1c597513
SHA1 d204f30e78336618eb234c379483d525b20e67b4
SHA512 3d321eb4722967d04172546479f9a281220f2214e19e127430ac606124f059bd3c216d0e8c35bdb151d1b01d77bd10600f5d1ca0c750561dbbebf80eb937e01a
TLSH
T1A5A002300AE1A0E0C824486DC34A372204BAF44A03100028129520C2E20644BCAA0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QHIW.exe.bat

Path C:\Windows\SysWOW64\QHIW.exe.bat
Size 72B
SHA256 da65a7809e7c74ad07bdfe6b52ace040c60c98bdb7414d9c1ca2e12d8b70a3ac
MD5 ac3a9baabb6855417eeeb2d895725d6a
SHA1 5e631ed9bea012c9f258a1502a8c22a69d88c691
SHA512 86f780d11098df9e6b3cc0ff7bfde03b1763583790a4dda9811c203ecebc44ecf74d514181c6bfa1b6b1aa397414ef58af7a518bb2876131282feda08fc28b86
TLSH
T1E0A002300BC120E88824406DCB4A3728842AF67A831880201AD522E3E00C4EB8A30CFE
MD5 SHA1 SHA512 TLSH

Submit Download

QLGGHGM.exe.bat

Path C:\Windows\SysWOW64\QLGGHGM.exe.bat
Size 78B
SHA256 46426a32d45e082b66fed24b4918a92a2471907338db0c4b431a0e3015b3697c
MD5 6dc954d5daa50656c432d5fa95a4ee00
SHA1 9b3fa2c670a512cb98569cdfe355b010cf3a0703
SHA512 908dea2484b75608f3fb2c4ac7fb64936d64d58085d6100e3db8e59ed70466d2154dfe134753adab48b55452ad2ec129e5e5d5d8987ae345c687a940cf913536
TLSH
T1D8A002380ACF20E0B8A4486DC34A373A0CAAF44A23100A20329522C2E0046CF8A38CF8
MD5 SHA1 SHA512 TLSH

Submit Download

QYL.exe.bat

Path C:\Windows\SysWOW64\QYL.exe.bat
Size 70B
SHA256 1cc8ea2e0c7c8ddbc8597e3db5ff3d1d9f311323178a9ec61e6fd312066c8a22
MD5 ef38dd97ff030a792ba756655528c4b3
SHA1 f537854a7e5581412beb837dae6603ff60a4421b
SHA512 892925dad7c246b65b81a897181ed6842193e9d1a04a1308d27dfad78473bf299cadd8bf6c9b54e8ac5ecbe18920226bc4d8605355bb559fc1ec2ca5d118d199
TLSH
T19DA002328AC120E08824C06DC34A3720243AF44A03300030129520C2E02444F8A28EF8
MD5 SHA1 SHA512 TLSH

Submit Download

RIPUYI.exe.bat

Path C:\Windows\SysWOW64\RIPUYI.exe.bat
Size 76B
SHA256 b6dad48888660588a97071779bfcac1e70e4ce0bc062054c663c7256bc4daee3
MD5 de2bb5534e99ff540c70bc2eaa67aa9c
SHA1 292085c804c909597ab116e27f563fcf97a53c11
SHA512 5b766e4f9dcc4d127d54897addb642eef38d11419a138404aa38259c93dc22406e42eae5dca44141c82ccd80398f3a74b678632085561baf4964f26c1ca2dd58
TLSH
T129A002388AC122E08C2C407DCB4A372024AFF44A031202201A95A0C2E00444B8E28EF8
MD5 SHA1 SHA512 TLSH

Submit Download

SABRC.exe.bat

Path C:\Windows\SysWOW64\SABRC.exe.bat
Size 74B
SHA256 9fac387d7c6db9e5979206059bfd9cc12bdbaa9d95261ebb3c7ba35918058f53
MD5 b2b43a9da648122ce0d64c7b420e177d
SHA1 8200bc4d2e18d95413ebb0a6c5b498c1eb071d10
SHA512 b93f3c0346b5e046a2e3a9dfe5830cea15e199e7d86c9a6860f70a6a2a474a3d6e6c4a99d2383f8b44430d76a8ec0d826f5d57a48ca0caf411290add3e10a94f
TLSH
T1DEA002382AC120E08824606DC34EB72024ABF46A03108220339520C2F08444B8A20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

SBNZW.exe.bat

Path C:\Windows\SysWOW64\SBNZW.exe.bat
Size 74B
SHA256 4193ed1e68cfce45d2ade987e1c8aabb2ab53c319ea65e5663fe3c2804a75329
MD5 4451560dace2593e816e553b1c8dddc0
SHA1 b0c648219aac53310abec71e496898bf83a5fe2f
SHA512 93aa90ba7c62ae5ea448299a5ef2bf34c1a6047822dc13ad40155ced8270da5ab2c37242a77dbb4e07d25ed9cdea4926291081d754be99b1ec7d30f3ddc239e7
TLSH
T11BA002303AC920E888A640EDC34E3722062AF44A0310823012D720EAE02446BCE20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

STKMGRJ.exe.bat

Path C:\Windows\SysWOW64\STKMGRJ.exe.bat
Size 78B
SHA256 c9d1824f56d097b507e542b6947bd587723bb1f1a32502f9964c953671afb373
MD5 23caec9d1fb438132a1d600839713bdd
SHA1 afc56ab70010537be56084d4a10fda718a14c314
SHA512 5a8ab5838cc1c7064e37d7ae7c8cc5a15d30efb9b4d2104555cf72f98c8572f4fca5fb9c1c111151f90cdb967f955e016886140f45eee7126e6dde03690eca4f
TLSH
T1A8A002308AC120E28824C0EDE34E3F2804ABF64A03B002301B9728C2E00444BCA28EB8
MD5 SHA1 SHA512 TLSH

Submit Download

TCCYTAY.exe.bat

Path C:\Windows\SysWOW64\TCCYTAY.exe.bat
Size 78B
SHA256 2837afc28d72475bfc7dbc4e0d5e88d39946421d7ab7a42b87ef15a6e3b078df
MD5 dc6e5a6ba59ce0b321ce330d75b0c149
SHA1 9a7810d8adf71491b4fc881271d7c5b0a1046c25
SHA512 80fcef8e43ab4c4cd01f1366c772f68d72e50d700a1afdf5285e76751b9851b934470e3b0b068c3f4863258aafa10ed77e2e16d1c7ef45a43d1b45007a165f8f
TLSH
T1F6A002300BC92AE08834406DCB4E3728242EF64A23120822329D20C2F00446BAEE8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

TNPMF.exe.bat

Path C:\Windows\SysWOW64\TNPMF.exe.bat
Size 74B
SHA256 18eb26bdcb54232721c25fc18e3d81dc557ac37e6f4a754847ad926f56cc7dfc
MD5 80cdf4bfff60bcfe605fa5d1ba5a7b87
SHA1 6d1086b694c7bc81947525519352824d44bf06ba
SHA512 ebb30785af5404b1939cf236a52687405e153facb732467b2e07f9bea1ce2242f9e5f2340ba1b068e342c55757d12e54dc6d61ac83376bf87878b6027292e8c9
TLSH
T1A4A002300AC938F0AC3C406DC34A3722842AFC4B031C80201A9528C2E08446BCAA0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

TRZTO.exe.bat

Path C:\Windows\SysWOW64\TRZTO.exe.bat
Size 74B
SHA256 a40bbd775b14c0e7661075ee6c625345b518f0155a348f70177c7396c193bca9
MD5 0718e1ab7764c84a48331215748cbe2c
SHA1 a666c7354f057c7e9354f8070931214736962c63
SHA512 3b5c44d3b50f0f7672b4c6b2814736e8ee83f52df3fc1b974be23b6119dec2af0528743c9b4d8e94528b0da06ee6b99ca7b101a0457dccf6e0d085ec36e395da
TLSH
T10FA0023C0BCD23E8E834406DC34AB732042AF44AC390002012B520C2F08446BCA30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

VDTHJ.exe.bat

Path C:\Windows\SysWOW64\VDTHJ.exe.bat
Size 74B
SHA256 4002bce428e1c30cbfa8ac34f69c5c5c17ecbe3e1658bef1b6f597922f6434a9
MD5 061f8c5906901134bf4108b50e3ade39
SHA1 8026b1c7981fb15f5df95d0cf8cc9df3fa3d9f0d
SHA512 913203b5233acd231d1295489612393bb7a8e76f8041bbf9709ff477a015e83541b598aca3d88ec72a67df6af2efa8eda5f1ee4dee59b0f7ac9e687c163a660d
TLSH
T109A0043015C114D0441454DFD34D37504417F4D503500010735D50D5D4454474510D7C
MD5 SHA1 SHA512 TLSH

Submit Download

VUYEEKC.exe.bat

Path C:\Windows\SysWOW64\VUYEEKC.exe.bat
Size 78B
SHA256 631f64f1cd849954bcbd9a6676ab1ed411aeae0752a2642692a8e6f9818bf09d
MD5 35b85281edb4d2db4fb8dd325e24ce70
SHA1 a00fd3fb2e64357eb297e0efbfca37052bdc1442
SHA512 11760d911e51319a40d0fb88c58b4de1e216214e4a8af44585f50a99af7b2cb4bad5aff22b9d2970999af0de8403e9a55d5537ef7dc41b365ee03ead88a95814
TLSH
T1DFA0043057D510F04434F07FC35D371D0415F44513314571135D14C1D0054474510D74
MD5 SHA1 SHA512 TLSH

Submit Download

WDWORV.exe.bat

Path C:\Windows\SysWOW64\WDWORV.exe.bat
Size 76B
SHA256 627f41a78cfeb8c44895f8677a79658794f8a2ff9283966e6a416f7a36b798bd
MD5 fd706e83b78241d2594108242cc051b7
SHA1 4c32ffb8abd0971b86b8e54e89c1e34f6f5b21c4
SHA512 cdd4bba1f2386eb718575c1734ac45a5367188be9d99596e1b0b54cf9864b3a77996d95516b4c11e0a265aaca7a157889339e692a5e3d21c6183d38056d0420c
TLSH
T16DA002320ACB20E2C8AE606DCB4A372C04ABF44A0390022012B5A0C2E004C4B8E30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WHBFIOP.exe.bat

Path C:\Windows\SysWOW64\WHBFIOP.exe.bat
Size 78B
SHA256 1f6014c6672682b552d48aa48f7f36546d70aa43494d3f660c0aa4ffc2ed8a5b
MD5 5ee731714824d8dbb0ed6a3a1113956c
SHA1 732676f79097bf653c751d9a7955e50663c98d7e
SHA512 150971e8f5b88e170a8b01aefab141cf882200137e0ab625a3ee1e0dd6e08fa5866c3fd5a6ad27e322e7c71ae959f0c0cd16c787a80658d7df1f885ca78f980f
TLSH
T14BA001AA2A8128A2CCB4407D82AB2A20882BF44E03200230129620C2F02844BCAB0CBA
MD5 SHA1 SHA512 TLSH

Submit Download

WXK.exe.bat

Path C:\Windows\SysWOW64\WXK.exe.bat
Size 70B
SHA256 f77d932db1afd0ffdbb1d68f76aedb8908b7b06fdd21284051754c1507dbf975
MD5 f7ededb8e8149febde4113642fc6bf6e
SHA1 a46ceb1d85ee95423f5fcbc23e5048552269d7a5
SHA512 aea8171457f43ad194c2584a05b1dcbd756b86fa8018a6e4a2625a13e8acf7941339bed8b82ca8215c55d7de9d94c73821664caebe0ada25d0a519f4259d9516
TLSH
T11EA002320BC130E0C8E6406DC34A37A0042BF44A03980020129720C2EA0444BAA30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

XAD.exe.bat

Path C:\Windows\SysWOW64\XAD.exe.bat
Size 70B
SHA256 43f395f0584cfbc7fec42210d611a693cb9c9efdf47821ae45778d6254e7749e
MD5 fe312f3c24c4edc37c53d6c1eec3e9e8
SHA1 c5de91c01d5133881b0e7b4976ea100ac9e7eefe
SHA512 d405fc0b1075b78c46421a9cf7095b1d188a61c546fc516a16e2f9d33c66d2d3e2a34cbe957a5c1e3c2390660dc4d0c34c7fd8d43c54c7e708848bf298af04fe
TLSH
T15FA002300FC1A2E28824406DCB4E37A0042BFC4A03100230129523C2E00C4CF8B28CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XFCAD.exe.bat

Path C:\Windows\SysWOW64\XFCAD.exe.bat
Size 74B
SHA256 14edeb595d590a22926a7817d96c71dd751197010ed8cd2ed22cf162f09d5996
MD5 7b73cc4269e5cd14d4f31d5661664776
SHA1 3c202358266f7b267c088a4090c5bf8847d9b298
SHA512 52c7245a1f28c7af47f270c1185a637fa7988543709340c1ec95d346be4c8fdc85800b65a35ee3285eaea84fee9451f1f43aaa37931f16f633935759fdec51d0
TLSH
T10EA0023A0BC1AAE08834606DC34F3FA0842AFC4E0310003012B522C2E0044CB8B2CCFC
MD5 SHA1 SHA512 TLSH

Submit Download

XLHXM.exe.bat

Path C:\Windows\SysWOW64\XLHXM.exe.bat
Size 74B
SHA256 17ddd0abba2a2a03756df4f10cfbe0d8eed2be01b3ac9cc5973ad6466341e433
MD5 721d09b5d3d3310b568b1bdd43cfba67
SHA1 791e65a8c99e37b412c86691bec7a92fedb04cbe
SHA512 e546730db3e6d4bc33ee3e0de06a9df1532952344163ca6a9dafe6c32648ee2401640099b7c1ea18e323af97d7f45e7e80734b4c0aeabc934b0c7bdb484266ea
TLSH
T10FA002380AC320E288A4C06DC34E37B0242AF44A23102020129522E2E8046CF8E20CFA
MD5 SHA1 SHA512 TLSH

Submit Download

XQKJDF.exe.bat

Path C:\Windows\SysWOW64\XQKJDF.exe.bat
Size 76B
SHA256 1778b3c2a24626d55ea9b9c4923243d13ed83d95049bdb438738c433d4541b20
MD5 1bac36dd2be00aeb451d482acfeddf3c
SHA1 c564107f98df70820ba3c6a57cba8d723019e3a6
SHA512 6b3ff341b75c84d394726c1f2a4e8cd893f549bb3f4d5e032ad223ea5eec19b3e1b5cfb43877a2db94d8c7af9ad84cfb4554d7bc85d2b81c2bf1bdf29cb66535
TLSH
T1F5A0043015D134F05414507DC3CD3751441DF4451F140050355513C1D0444C74550CF5
MD5 SHA1 SHA512 TLSH

Submit Download

XYA.exe.bat

Path C:\Windows\SysWOW64\XYA.exe.bat
Size 70B
SHA256 fee15dbcf4577ddbb7659651cee60209d298c5fb994a6bc426dd36766a4c31c5
MD5 b5c2eb515819d21bc7728973502cac03
SHA1 9c654df3c152ee5e1c692edcacffcb84fad771d8
SHA512 da682d9093138de2a8f8d20babed327e231c1ceeb500e60c1f6609302880e91d4d067bb788561f6545255b78aa7b23052dec01ecaefda871099e95d571415e70
TLSH
T1FAA002300AC120E08824406FEB4E37A02E3BF44A03100020129D20C2E00C4CF8A28EF8
MD5 SHA1 SHA512 TLSH

Submit Download

YAK.exe.bat

Path C:\Windows\SysWOW64\YAK.exe.bat
Size 70B
SHA256 f39e7074e933c17b5e52d21559833dc421911748b6f23235355198fbc5d6fedb
MD5 10d1e453aef3fc98d3ca6b9923a046f9
SHA1 3823234c4b2e79c0e70acc5a284aa3851c7a951a
SHA512 ddff36c298d043cdcab51657d77b9170dd5b995f9b716fd0f3c23ff3244adaa3a6753baf18def5933faeada75fa40d641b59545e8021033680bb1aaf073e2a78
TLSH
T1D6A002302BC122E0A824406DC34A37A0042BF44A0318002092D52BC2E22C44F8A28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YDTDMK.exe.bat

Path C:\Windows\SysWOW64\YDTDMK.exe.bat
Size 76B
SHA256 829433469e8827f93389417c0d1451984271240fd4f80b19e202bffd68d42e18
MD5 a82fea4058ce0c5f587f6ef4f2547170
SHA1 95ec5233ac842b94d65f92c2875ccc528fd2236b
SHA512 6b266b65abd90e26c2f20aa43b94982b688a1cfa71d19bb92e137c6d0148f60c6b530435b1e6c7409794888f7c9b630debe3644fbcca76fa6fc8f24745d8b9eb
TLSH
T1D3A002302AC122E088A7406DC36F37A0042EF46E033C8020929520EEE00444F8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YMVBHH.exe.bat

Path C:\Windows\SysWOW64\YMVBHH.exe.bat
Size 76B
SHA256 0f118e2cf8254b60a5104bbade738a722195d7733a8622b18895fa7eb0b37370
MD5 a68221048079cc3e454e05add6d93273
SHA1 3cfbf0d269c1740e3049839e56f892b304a21298
SHA512 6177066d67883642bd7c84eb929f1b60a49c8b0f6e20e8b7d9be088ec68e1d4ef392be3d4a1d09ba96d6c0af95fe37152f905a0b826273d91ede5b09938e72ce
TLSH
T195A002308AC128E8882440EDC34AB7B0A42BFC4E23900828139520C2E08666FAE20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YNMJ.exe.bat

Path C:\Windows\SysWOW64\YNMJ.exe.bat
Size 72B
SHA256 7cc38961e2bd32172854c7ab15c30127c07813c91723f487434550953fe6b067
MD5 87a1e9ff521f83a360780218638435ac
SHA1 0c655d86b4aed9f9bbf33c7be03d80206b92ecf1
SHA512 78e642b203a547fcc0b0e6064559ba52e75f6b819473fb8215b85bdaa45d591ed5e5acb891a9214066b0bbf22bae8612909583a36766a810d2a6e280ddef1d6f
TLSH
T147A002300AC130E0882448EDE34A3730842FF44A0318003012B520C2E20444F8AA8CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YRVWP.exe.bat

Path C:\Windows\SysWOW64\YRVWP.exe.bat
Size 74B
SHA256 eaaffe25629a468d20f9d6e742096f61cb791a9c3632d6d55ee2599460a9fb84
MD5 f147dff3ef2c88f1431bb80c098d9bbe
SHA1 6d760c9cbffdab256ea41d668b68538d850d6df1
SHA512 6f331d6630259d5bba546535f9ce8dfe8c35574a1739264919506116e3c3c22339fa3e64171cd6b7f55582594f28be82a5108099f0c3f172c201de0d42075a86
TLSH
T11AA002B80AE120E28824606DC34A3722A42AF46E8330002012F522C2F00464FCE20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

YVLI.exe.bat

Path C:\Windows\SysWOW64\YVLI.exe.bat
Size 72B
SHA256 b2e56e4672ce1ec4eead3666ae2a4a638df0b5912938bcb358614675e9619afb
MD5 c8926d5d9c243b6c43f12e60ff0a34c4
SHA1 727abcaff366de26cac10b924b8a191841a086a6
SHA512 d9e4bb24b8855d9dd52df2a4b0abed3015de054cd6ac419278867d86caf49d2897c5ac44800bf24a389481c2dd6ebc90c15f1ab32cae8ab217f096aef16f862f
TLSH
T155A002302AC130E08824406DEF6A37200CAAF44A0332002012D520C2E0A464F8B30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZWL.exe.bat

Path C:\Windows\SysWOW64\ZWL.exe.bat
Size 70B
SHA256 aa5eeb6af612c50412a9071be71d8cd5981e1b250f348e2059a4261ed8f668f8
MD5 6482dd5e3a0a7b27fed233d8a4b0840f
SHA1 19b3ea55b750df22a23616b6c00de9d5e3956ad9
SHA512 1300d5016e57ddf7f186fb8e02884be6880c50d5025790c4e4ec787d06cad4ec1537fa03805dc4087cff7318a0ee4302f1076c4978af2faa05bf8261797e912c
TLSH
T1CCA0023A0AC120F08824C06DC34A3720042AF4CA03300020129528C2F22446B8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

AAPIZMR.exe.bat

Path C:\Windows\System\AAPIZMR.exe.bat
Size 74B
SHA256 0978b14d1ff8e068bc5a60e17ec6774017f259438886fd9d73637c30c712b22d
MD5 72cf8008a6424396b723375bb790b9e9
SHA1 def513df564f3cd0c5079338ea2965c0171f224a
SHA512 73328008ce33e142659f8e5a43f13563f8b1fffb168fbe4bedcfef4d4d79ec4deb05cdd818bc064d96111048b1a0422fb199b3641c8c87df732852b4dfadc3b6
TLSH
T162A0047C0DC310D1441FD05D43553F000415FC410715101C515F1051D1044575733474
MD5 SHA1 SHA512 TLSH

Submit Download

ABUFSHR.exe.bat

Path C:\Windows\System\ABUFSHR.exe.bat
Size 74B
SHA256 8f90ed2c5d49e1be6a8458000fe3aea1839ffa815494df0fa1d327ab783ef586
MD5 1c2fdfffb157d4e7c5461cc0b3bda4c0
SHA1 4869f62bc7948f7a13ad6abe7a831e5c7352a234
SHA512 2e6dd0fd2682aa14a7e1ed0a1dccc9dccac60ec1be6291f13fcb70b67601eba9a5fee6218f22026acffa1cf14d47eb9d9e12b8a90a22f514a6600d897d46db73
TLSH
T141A002B00FC320E28C3440FDC34A37020E2AFCCA0B900A3813D50A82E00447B8BB28F8
MD5 SHA1 SHA512 TLSH

Submit Download

AZGMK.exe.bat

Path C:\Windows\System\AZGMK.exe.bat
Size 70B
SHA256 64c64847dd636058a29b1929e9860592e0575d90bb333bf4675f63c440c3bac0
MD5 9e8da5d839ec60bb7c92ae14237275d0
SHA1 6614c30b795ec63b15874944fefcc8010d84becb
SHA512 bddee469e41ce5952e48c5bdcc9b5ca342905b93600f856d1264314c4a3f31d86fe8e74546c0f1df15d6c20fcd730f54c8e9df812d0c66334aafa4377e330a6c
TLSH
T170A002320EC322F2C834406D434E3780043AFC42031C022C92972082F0044638B2ACB8
MD5 SHA1 SHA512 TLSH

Submit Download

BHV.exe.bat

Path C:\Windows\System\BHV.exe.bat
Size 66B
SHA256 747799d15054ec8e7b5645516daed60b17b9a7f961fcdf42ce6dc7e537c5e1c1
MD5 359a0b605c737f67472d539b3fe24cc9
SHA1 77d9f95cef4d6a1f515270d87a9c92ac186608e3
SHA512 6f565b9ffe6090a922b2cd2e3a8177a4db3e9e984d38d9c2f85206b87ca08d438ef57706e94a4510b6a4dd5a1e33ceb24e088d6d9ced43e88404e96839ae890f
TLSH
T1A4A002308EC320E2882C4C6D4B4A3700042AF4420B90002012950882E0046EB8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BIRMUNN.exe.bat

Path C:\Windows\System\BIRMUNN.exe.bat
Size 74B
SHA256 d15bb8038d3f7dc3ca86806f700bc3abf0aba62618c9e793cb64c9cc1da8eb7f
MD5 c212a03155253fde17cc57ee02403b5d
SHA1 b73894ae4af283573fe3a3a75e9231da5a2bf9a4
SHA512 a8319b0dac8a4c2ffa474dce5a23f2e77691bf3d161164bc016447908e555f84c6eb6765c4641d4165989bd525d03bbe58dca2224256cc667f63753e53ec519b
TLSH
T187A002308ECB20E28824C07D43CA3732062EFC4223F8002292950AC2E0846F38A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CPQ.exe.bat

Path C:\Windows\System\CPQ.exe.bat
Size 66B
SHA256 52fcad4088c9e7582dec80d9fac7ae489d51668b74396fdf4b1e9ef981d76305
MD5 e10af2d3570a0bdae3b7686f3d3e1a85
SHA1 f077cee1a81e809b509d0e34a5c86ebf5e7a5c3c
SHA512 6c434f78f0cddb79106bb1f0a733da5dbf2554304c108b9ad03cea846e16dc62870e6be1969f5455e38285f2e61ec8608676fe03ef47e760e97266178e63bc73
TLSH
T10EA002380EE120E288A4606DC34A3F000C2EF4420330A8201A95808AF004463CA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

DSOEVQ.exe.bat

Path C:\Windows\System\DSOEVQ.exe.bat
Size 72B
SHA256 1cc1a4e81afeca512d5054e727e30753f8ca93e1e7f089c29e1831ec8f349a01
MD5 9b04c0c160c36225c04d58c8a9550455
SHA1 8ba8533bc6e9b5e60574627489cbdcbd3e0090e2
SHA512 f22ad608e61b2b21d58bfe08c5436433daf0e1b0b96d7871ad11db75cd63bbefaf8ae2454dfa3f7fd1c7a1cabcaf314d59a7d755d6af57c238b5fc8c1b4494e5
TLSH
T16BA002300EC320F28824406FCB4A370004AEF44A031080B01E95028AF004C738E2C8B8
MD5 SHA1 SHA512 TLSH

Submit Download

DUS.exe.bat

Path C:\Windows\System\DUS.exe.bat
Size 66B
SHA256 0f560c900732e02ba96839f53b8a93b12425238bef08694e29e17d7596617f68
MD5 a490052dcd622ea78f9959a95bb74e41
SHA1 a2de6e8396923a1fea702736accf209bf46a8b5f
SHA512 3a3c18266ff84c66a49724f1ab3ed4454e9d829a75663d7e742659dd9cfed1105f60df3e69f3e6df29c9964cb29b3daf2dec5204dfba9015bc13e1d06999feb8
TLSH
T1C1A002300EC1A0FAB824406D434E3700242EF442031000209A95C082E00C4738A388F8
MD5 SHA1 SHA512 TLSH

Submit Download

ELALCDW.exe.bat

Path C:\Windows\System\ELALCDW.exe.bat
Size 74B
SHA256 23d0673dd90cdd17820c566b0058d79995ca746643a5476d24ae56d3845934f8
MD5 401be0a1943f2d7bf5ea38c3b89fa8ba
SHA1 07e00bab838d33022b588faa475e59c921382cb6
SHA512 bae071c193ffec1b350e3be676d3dfc53382be7e294458e2b4a19dbd483aee3a762eb5a2b662c45f494533e150da105d79a1352fbea4cdd734154f59279a2a95
TLSH
T123A002300EC128E28C24406D634B3F00042AF663231A8A201ADD08AAE0046738A2AAB8
MD5 SHA1 SHA512 TLSH

Submit Download

EWBK.exe.bat

Path C:\Windows\System\EWBK.exe.bat
Size 68B
SHA256 43201f2c9bb25769ebb3a24ad07776460da7c383d8c19819fd1f63f1b9165715
MD5 9eccd7bb630653a5d68df74386e4b25f
SHA1 c4834079410e213cc25441c6ebb9cc4f336a483d
SHA512 7b772843b4c1a02be4eaec58f6c467c13b919ff7c445e215077f73a57868918093ba580de2521a4ac9e3ca30462023696482a9beebe916cbdff964790aaf0816
TLSH
T11DA002300EC3A0E28824406DC34E3F80042BF4420318002012D5008AE8064738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

FMEN.exe.bat

Path C:\Windows\System\FMEN.exe.bat
Size 68B
SHA256 ad0605c167b9da8348e0046416fdcc5c4f5e951f79ddd6f14ba34d49da586498
MD5 880a0d07a2f99d3ac3232dfb9c3b962b
SHA1 cf850ac01c66d400fbcd6e68da41cba70dcdea7e
SHA512 89cfafd249c73538d3339b885e9ea05d6d123887678a647bb0f06d37c4794dfcb824d032af70500c6e876e35dab37692560a2498ee4638e77c085b161d45013d
TLSH
T18EA002302FC320E28824C86D436A3700042EF44A23900A3092D58A82E08446B8A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

FMEYP.exe.bat

Path C:\Windows\System\FMEYP.exe.bat
Size 70B
SHA256 cda9c8233ad0b2811e1cf77322f95fa5926a54703cda5fabeac0eeed28c3440d
MD5 499fcfbd4afba2ccc3a6d60d41607a66
SHA1 52b0c36bc64062bbc7d248ac4a73908af25559da
SHA512 17f67f40116ec39a789b3cd535b32b935863665c02f58858fb6549fd109599eb6c3a66d1c20cad754ccaf4d4fb4a081d40c4f71e719ceeeac516fb8ba78a0092
TLSH
T118A002380EC130E38834C06F436A3700242AF44E03300830129D0A82E004463CA22EB8
MD5 SHA1 SHA512 TLSH

Submit Download

FPFTPM.exe.bat

Path C:\Windows\System\FPFTPM.exe.bat
Size 72B
SHA256 7a797b972d8106522601885844d8c6231a2c8fd39cf93c97b1f28d702a3b46d1
MD5 60e5bf10bf309e05d1941d04c5aa9d70
SHA1 3370a087ee66c82acf89e8e25de700ce5ad33b33
SHA512 de2557035c70244b7ea28cd8771700ec12f0b42060a53aa64bfd1329c16ee6ce7955a8181c6359ddc51f4f851388eb605e3fb8e57aa049d5922e226180240782
TLSH
T108A002302EC322E38824606D436A37A2263AF44A03308BA8129D0082E02446B8A228BE
MD5 SHA1 SHA512 TLSH

Submit Download

FZURUH.exe.bat

Path C:\Windows\System\FZURUH.exe.bat
Size 72B
SHA256 3651b19994e893bd0d719f6fe092ab0bad292756d5e4ca94bf0437db67ae5871
MD5 6bfeab31e62cd942daad7633ea8ef078
SHA1 e63ef172156496d6355593c846f51ed3420c382f
SHA512 477a05b16189a468f84ed103026689b1559676d0005a45983ea74ee6d67b97fc26b546fe27fed3d5b14706bc578d5ed1bd1ae1ecf03662c5cd18a8139d339125
TLSH
T169A002300FC920EA8C244A7D4B6A3722042EFC4A0B1008209395A082F2847738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

GBFSMYG.exe.bat

Path C:\Windows\System\GBFSMYG.exe.bat
Size 74B
SHA256 2a5f24f6466324c0eadc2005e06cce1930351981c11e8659690ac640fdb9b681
MD5 1a10e99aa12a6c835d9172909bfdd90a
SHA1 5f0fd43d2cb198b44f84cc5739b05ab269b36464
SHA512 e21fdad63ed47cccb57756a0fe334c7ee8b00e6571417d0e688ebc1fc69ab15f222e1f1dcd5f0b7a58c1401ae2b5c6b65e970e1a45fccf41d3cfcc77a8659846
TLSH
T1E8A002300EC920EA8C26C06D6B4A37032E3BF443039800209295008BE20446B8AB8AB8
MD5 SHA1 SHA512 TLSH

Submit Download

HLDGYLG.exe.bat

Path C:\Windows\System\HLDGYLG.exe.bat
Size 74B
SHA256 d52e3eee6aafb66280775c54143b415c635383bf037a735fca8d85118ddab61e
MD5 a90c47053671d688cde7b92f8c855ead
SHA1 933ad3d3f084eb7b25b770833e38a95da3ade890
SHA512 2b601a0be82940927fbdc8c452cc90c8ef5a82b92db03bcffd944147e63eddee851387f878c37767fae1121785aab458a0922edb647a118ea5ea50ab46516069
TLSH
T1FAA002300ECD22E28C3440EFE34E3700042AF44B033008203A9F0283F0044638A288B8
MD5 SHA1 SHA512 TLSH

Submit Download

HQCS.exe.bat

Path C:\Windows\System\HQCS.exe.bat
Size 68B
SHA256 2afc556cd60bb67dfb30ee6c51a6390ab90358a0622c5d761539b14b8c8f2044
MD5 5be08843bc12bebca3432607ee96b46d
SHA1 7e52c89ef8494e6f8db13ad1a39abff18a31eddd
SHA512 56ccbd3d6a3a7cc766c99d1b65928deb82110f4da6d13a0c75d4f100c543d24c08a1fbf139ee5af25160f96745e77527d06d66f5575beffea0c0bceab2e46cba
TLSH
T118A002308EC120E28E24C0EDE34E3700042EF442031828A0129F8082F00E4638B208BA
MD5 SHA1 SHA512 TLSH

Submit Download

HWZR.exe.bat

Path C:\Windows\System\HWZR.exe.bat
Size 68B
SHA256 39959c584bf99d51d7452c6a378b2757c520c73fea2e6018cb76f1510b1580d8
MD5 c2b9dbdcaa6547966d45be03abcf890a
SHA1 969f89a9d5fd3648438d7cd8d164dc09d17198d7
SHA512 42c505841d59536426d5ec0be98fe5b16f2b0ec041fb039a83e12b6c4b653a36aa5357bd86b91653007bfc0d22452bb1ea7306b8067db4b21091ba6b9a7df820
TLSH
T1BBA002382EC1A0EAAC2440ED434E3700042AF4620310082012DF2082E02446B8A30AB8
MD5 SHA1 SHA512 TLSH

Submit Download

JKIFWSC.exe.bat

Path C:\Windows\System\JKIFWSC.exe.bat
Size 74B
SHA256 4fdb89a01a820851467aee7a0230de713f10643ca7deb7666e30eaae0776f2c8
MD5 bfb4fa7065e2828c3a4aecd8bc8e08aa
SHA1 938104443e4aadd320f79362fba86992059ca64d
SHA512 eea76f25817fe27f2ccf3ca9f5f2081677e9eb643547846a1dcd87dcd86e0552d9f1bb41e6d93f874b9d5a724e75bd4cf6d14622665f8fa6ee68ee794569718b
TLSH
T17DA002302EC120EA8C34606D6F4E3708043FF4CA033300A012B50282E2066638A2AEF8
MD5 SHA1 SHA512 TLSH

Submit Download

JSORES.exe.bat

Path C:\Windows\System\JSORES.exe.bat
Size 72B
SHA256 08b115073899d61f305e772536102fa8677e8ce54f70d4ad284fe455ef9dad34
MD5 d5563802a59b10ebaad136e640a75ef7
SHA1 a0a37c05800157eae3fa31040a52da16d92444a1
SHA512 da8e84902f8f4a7d470537123d63eae40e4c72b7e1946b065ef08a2622ca3eb42626a4fc8d54c9187cdd664f6cbbd4d06f6f08567495e2aa489d3c6fb51ad69c
TLSH
T166A002300EC120E28C3C406F4B4A370824AEF64A8338022012B5C2C2E00C4E38E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

KCMAPK.exe.bat

Path C:\Windows\System\KCMAPK.exe.bat
Size 72B
SHA256 c9b61ce13c2ef695dc156b472230bae5748fa2f1a6396fd612f0213f9af7d92f
MD5 a1e054587ac8b7ac143e1eeeab62b1d5
SHA1 c29f9c235a2cc8d6d22b6247b56baeb8e7d0df5c
SHA512 0cc429ad9050f58d8168fb7c6511e01ead447fe095643fad591d1840d8d07482dd4078ceecd8145c890dbe0f504e5a5016c0a78487a68f2664ae1f9fe372e372
TLSH
T126A002300EC122E28824406D63EBB780842AF4620318803092958082F0044738A32CB8
MD5 SHA1 SHA512 TLSH

Submit Download

KDABQKY.exe.bat

Path C:\Windows\System\KDABQKY.exe.bat
Size 74B
SHA256 7e6e96ff9ea51977fcfe9c67d9fa0b277f83d2e703c48f49ef7abc03de91c9c2
MD5 14ab81c19fbbd07570483b6fa9a6cf45
SHA1 e062bdb0b7f800d0409ba44683e49146b020933c
SHA512 4ab860a5fb1f81fc9c136577c579619789ffa18a71720519ef503eae5dc3af325fe69a88d4f307f807930214effab5c4d9314d2ceb8852946737419a856e9417
TLSH
T19DA002302EC12AE2CC24437DC34A37880C2AFC620330C82012978282E007CE3CBB08BC
MD5 SHA1 SHA512 TLSH

Submit Download

KFEG.exe.bat

Path C:\Windows\System\KFEG.exe.bat
Size 68B
SHA256 3da75dbf562625de2d246ca0cf4869935c25a18a9869d6af03ddad989c09b263
MD5 ad95b477daa7a172519da20962778cdc
SHA1 34639c2b49447a4d180cb6b17bffdfb8eb3c2fcd
SHA512 3607e4d31b976a7e735134518def35bdf93db52614b3668127a49a369a02744a1532f284afdc57a870e6679e0ec167a35e149f3554b37d0dc3feab0c593a8fd5
TLSH
T10CA002B20EC922E28C24606D43CA3700042AF4E20390802012B5828BE0044E3CA28ABA
MD5 SHA1 SHA512 TLSH

Submit Download

KLBNIA.exe.bat

Path C:\Windows\System\KLBNIA.exe.bat
Size 72B
SHA256 d1d0db2000566726c48a6804308252ea48ae09d2aa980810aaa48d4fdcec67e8
MD5 314c62393861a30933a4d489bb75bd02
SHA1 ad78178bdb84dcf96a7711f9d2472d88032f389a
SHA512 45aaae4ee4b8f0261b67f31c8f5cb33d5fcf96f3ba3e4cc7e983432624b48ce9ac56532105f1a196dd3fc955276ebb4449cda46373b8aaeea26904e8bf777819
TLSH
T1C9A002382EC122E2C8A4406F636A37000C2AF473831000309ABDA0A3E004E63EA308B8
MD5 SHA1 SHA512 TLSH

Submit Download

LCFBUET.exe.bat

Path C:\Windows\System\LCFBUET.exe.bat
Size 74B
SHA256 736676ca7479516bd3527adb69b4ff58ed5d7b2b41acbb22f1ae08d0a2fd4571
MD5 6ea37580d8df9f4aaaa4b30fcf748682
SHA1 2dd4436bd7a85c0b49fd945cc0e151594cc34935
SHA512 557b5ebb0a07ca600cd2cb4bbfb92382cd5ec819086403b2ea1af7ed31653a869d1f374fe1d8404883e86f9cb505055b6a1a7f5936fd2c360e573f387bbb20d2
TLSH
T1EBA004304DC150D14D3440DF43553F401415F54513D4511053570441D0354534510C75
MD5 SHA1 SHA512 TLSH

Submit Download

LEPNVRQ.exe.bat

Path C:\Windows\System\LEPNVRQ.exe.bat
Size 74B
SHA256 056feab5f2f833d1d66eb3a66cbfc6ab9878abd60300bf4483769e45effe1fc2
MD5 ab2b33a4299d162a004147f0a339e643
SHA1 dbf5eb1d1a4a70759f9546f1671b967b9312a9d6
SHA512 373194b34ce6496791e2660dff915ae864c363ccee63b3b088b3a30c4886a4ae667e97379c94a9d3d66d5357b0a5c7a31180ca4ac48789865a6df79977731223
TLSH
T1C5A002300EE132E2AC2440EDC3CA378024BFF44A03D002201A95008AF006C638AA2CBC
MD5 SHA1 SHA512 TLSH

Submit Download

LFB.exe.bat

Path C:\Windows\System\LFB.exe.bat
Size 66B
SHA256 a0c5db1aa1c96a73130139b680953fbbc4ef591d382b3651654b6ea61ca9b49c
MD5 4a9aac80622f9b3ecf6bf05e7a858bea
SHA1 bdaf0cd1ab4c7e3a4bd98d979dc51b3b72a0a280
SHA512 7521e9519b41876cf5fd60844a786d88e454f62b7ea7910ce9e051322de22d005a61b4c288ff8fe11fd8ee785db39c72e1fc4e2ded57a54cc1b1571b0ac0196f
TLSH
T13DA002380EC120EAA82440EF434A3700042AF44A03D0022012952082E804663CEA08FA
MD5 SHA1 SHA512 TLSH

Submit Download

LFCJL.exe.bat

Path C:\Windows\System\LFCJL.exe.bat
Size 70B
SHA256 688479879d52b13e8f26d58dd6629c5157bf743af68913435d906595b358e435
MD5 9234f437c3d45845a3714ccb7e113dcb
SHA1 e45fc11408eefc66d4b65723dd26e6256583069c
SHA512 b87a423a5ddf18de7b02a1b9dcf007a75c86d4f31c26523ac647a5f5855f9dff9af088ffb162180a0a7eea61331828e512b0652f92987825866a384c9bb284a4
TLSH
T14EA002B00EC1A0E2C824C0ED434B3700242AFC6A03D002201AD500C3E0046E3CA208BA
MD5 SHA1 SHA512 TLSH

Submit Download

LIW.exe.bat

Path C:\Windows\System\LIW.exe.bat
Size 66B
SHA256 53deeeb324c936374edb76aeb6f6798bd8f6944850b83ae98ee54be7156e2304
MD5 fdcd5dbc92dbe1756d40498c359949d8
SHA1 2edb432198c5c6dd3574acfdae5ee45f25f8d1b2
SHA512 ac1ae386f519c02187c602cf4ac84c46b8954cd6d1b36615b32897c0f680cb1f29bf40af36f684ad5a891df2ea0f3484976d23ee73795a447b459d3383a726e7
TLSH
T1AEA002300EC120E2882448FD434A3708062AF44A83D0002212D500A3E00C4738AB08BE
MD5 SHA1 SHA512 TLSH

Submit Download

LXPXLM.exe

Path C:\Windows\System\LXPXLM.exe
Size 208KB
SHA256 a947fc6f9fb45799e4c3ea2e38846db6cea35befa4ffa12cd9bce1b02cacbda7
MD5 cc1c5c15030d87b9233abba688206355
SHA1 7d051866f6e1bd780cf87ecdb28c3d05b6fcaf9b
SHA512 df8301bdb0bf50f83744c8c733a9b3f72a897b656c89d7a28577c2ccd570e152f35acbb47c192a36b1cdeb24afefe247105cc12fd46cb29bf184cfed5b2ba9e1
SSDEEP 3072:52+UgWQBfx/N1OvhTapy/m67Lvzo/m4QF4pLthEjQT6j:A+U/0/N2a+zo/m4QFkEj1
TLSH
T1DF249D01F5498922D3A71A380DF3DDA49E7BFD065FA2D25B78403B9E5E322B059F2784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LXPXLM.exe.bat

Path C:\Windows\System\LXPXLM.exe.bat
Size 72B
SHA256 a39c89922d7bf863cf14ae574220534f5228c6c0cbeba84de5947769c8f27fd0
MD5 964465ffbba7b7f7c9d189a29861f7e9
SHA1 bc32ce6b3d533d7bc7f2aa8b57f8ef1dc31d41b3
SHA512 276e3b6f6eba48eda3f4794ce535b2f3e4c26de826ed7554059578accc00338797d1514e6e1a6b0cb175b2fa157df6de812705449580d62e259b75a11b664a1a
TLSH
T1C9A002300EC120EA8C2C40ED63CA3728043AF44A83D88A2812D700CAE20446F8AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

MEWIKJ.exe.bat

Path C:\Windows\System\MEWIKJ.exe.bat
Size 72B
SHA256 dabdebcdb32a150d6325b2295803df96c53640bb819e3f8f613f4f155ca5645c
MD5 8027fe85b5e53cb77556c63cb9afbb88
SHA1 adc454d07d42c3d12aafa2c08de67ba927fcaac3
SHA512 6eeed41e98445c0850c828dc806034e5b26a24e6c91e76933bfcc4c27ccbcb1258ab413e706fb1ecff703414124f114e76064281e33e34e26145b450d7738cfa
TLSH
T15AA002308EC128EAA82460EF634E3700062BF443233088A21A9523A2E0044638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MJRHD.exe.bat

Path C:\Windows\System\MJRHD.exe.bat
Size 70B
SHA256 bbf322cd768e5d4ab65a29679b52951b216ad3f7bafef2b5f19bb323dd780324
MD5 c9e075af334e9c364cf42b992e936d13
SHA1 944aabffa98ff77447d62e00012b87a76ceccad5
SHA512 4b4f20c9fcfa586d936d3cffa33b243223c6a0183015303ae65b11a7f1e4de0ed891614558f10ec1d9ceb97dde636a197a72349f3616b72a01364823f74558a4
TLSH
T182A002308EC9B0EB8CA448EF434A37000C2AFC420390803012970082F3044638B22AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MMA.exe.bat

Path C:\Windows\System\MMA.exe.bat
Size 66B
SHA256 4f0000fb9f88c5f5a60e623cf767bd2045ae285d71967aa8d140715b03635079
MD5 fd7978f813956b44f13192f60c28336a
SHA1 89c43dd63dd8846c657fb276cee47795640f8fc0
SHA512 56dac6e93f5fb07b5349752a7309bb1b5d2ec017e7fabb451eda52dda42d2f7b8f947374b00351aeea1cd2921f3e6e8e2f824a6bc7eb8f8efe219cec7bbdcd92
TLSH
T157A002388EC130EB8824426FC34A37080C2AF44203182820129D0083E0044638A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MUEUL.exe.bat

Path C:\Windows\System\MUEUL.exe.bat
Size 70B
SHA256 ba8f485777dc38df140764a63d819055f5308cceb1f32dc74020cad132f5b3d4
MD5 8ee89bbbe5cdca21185dcdccf3f6ad66
SHA1 2e4a56d254e70f700ba6c5b69d908fd9cf1a5e9e
SHA512 421cf8255c1a31a30562906aca17268b9d4b4092bff4a4e420545c1573de1042e173dff400f18f0526bb0ed3666c2d5dc83a3d8270d3ac5bdcd7397a950b3a08
TLSH
T1B7A0023C8EC330EBA824C06D434A3702A62AF642031000209295A08BE004663AA28EB8
MD5 SHA1 SHA512 TLSH

Submit Download

NCCS.exe.bat

Path C:\Windows\System\NCCS.exe.bat
Size 68B
SHA256 eb029631eef8b6fafe780d22251be421749888806a8c2bd4bf31b68ba7deee5b
MD5 bf5ffc634181dd89a49889495e9a9b16
SHA1 54855ac9bb7f784326e2ec2961033d56b0cb4d43
SHA512 aa22cd6ebff9073fa22b88f449862a2b8200f87953b354f0f41b46ba27e6a3172927c160ae54e39d8593482a77334fb94738fef733d934f448ba5c94eb4dbcf0
TLSH
T104A002300EC120E28824406DE36A3F00062AF442031800E012958082E02C4638B208B8
MD5 SHA1 SHA512 TLSH

Submit Download

NHQGWV.exe.bat

Path C:\Windows\System\NHQGWV.exe.bat
Size 72B
SHA256 08ac1c0be4db28afb412cce2d4491a44deb1c13ef5bf867f2711a310e17b6dec
MD5 5322dc3f413098823beb77507603d563
SHA1 3a90ff1a882ac894296e9cd0ca677784a05ffb32
SHA512 be1bd9b7b6c0cafe21ad34ae33d844d5c4e0993ed7d4af29a57b3f62fec3b759f6adb8b76f16e4695321f628f3201d3b89727490916311690240b80a6144535f
TLSH
T10CA002380EC320EA8824CC6FCFFA3700342AF4E20B10802812950082F004463AB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

NUV.exe.bat

Path C:\Windows\System\NUV.exe.bat
Size 66B
SHA256 5fd1300c2b328cac921a407c2be39c10206c7bd554fc745a687ea7d479ac7c10
MD5 703bbf88bb127f1f64e65215f17eefda
SHA1 9d25027386308634e90db34ea6f0b506a7adfa6f
SHA512 7469060e8f3d508cfa90bf7368f30319707d6fb3949864ccd2f76e33442ca5e8c047fda8ca6d44a1a76dc8c2a40ad3da7f5a5087e33a7402ebc3e9edb9dc7239
TLSH
T13EA002300EC120E2A824406D6B6A3700062AF4420B1000F092958282E0044E38A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

OJPOR.exe.bat

Path C:\Windows\System\OJPOR.exe.bat
Size 70B
SHA256 54914b6188304e53689714057548517bee46506c91809350cff70ada884415f3
MD5 4407e3c8da090c1c919a4b85053510d3
SHA1 07e4d8e24add5b316ca397a5b1c24d9cd7299a67
SHA512 f9b9b674dbb079fd0b9f4c48d5e71060f710063c662cc8e106f9059d69bdf0ac998213998d669ac5ba17062c8d0fe04c209fe0cb6242951a50640718ce25b9c2
TLSH
T134A002300FC3B0E2C824406FC3CABF000C2AF4432310002012970082F20C46B8A308BA
MD5 SHA1 SHA512 TLSH

Submit Download

OOBXA.exe.bat

Path C:\Windows\System\OOBXA.exe.bat
Size 70B
SHA256 61608d01ea0ab73ef242bc7b7c87515992007f010e8b4df213ae7cc055761d22
MD5 7e034c9c3dade217d5b5f0af36dbadb8
SHA1 d76386bc71a26d8250242524c7c87d3b2097ddb4
SHA512 0ac354cbc091cb249c20cb5060d455598d6e48b7196d47df0068bdb90d2afb3456765cfd1242370453827446717487d4195cb8e21b5f89e5b4bc580798bc0d15
TLSH
T100A002300FC120E2C834606F634A37200C2AF64203102020339F0082EA064E38A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

OPEFDW.exe.bat

Path C:\Windows\System\OPEFDW.exe.bat
Size 72B
SHA256 fc1601e2c9ac396fe2c87cf41a9249a8f4b5c563ac8f7be9615584aa39239d29
MD5 04113fa63cf7a615278b02c31b5607b0
SHA1 9d27f733ed4ef9f419702e02d4bbcac7003378a6
SHA512 17e959c670e1e3b3cff8375a737745e9639ca171de2c00363ae2090d9f6564378d6364af8f034e88e1eddd65469858f51b3dd638b6d24846abe121bf27e922f8
TLSH
T130A002308FC128E2C824486DC34A3700842AF4422330003032D500A2E2244738A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

OYVMJ.exe.bat

Path C:\Windows\System\OYVMJ.exe.bat
Size 70B
SHA256 26ab1759ec756dee6ae4cfa090299c1faa66252563a7c260d8ee11fd8c5679c8
MD5 08fdba7ecf8cbf40cb7c8d890a6ba124
SHA1 c5f361a3c11756f29a533b5028df1ba3ee447c45
SHA512 b37eaecc475567509f8588473bf3b5e06cc07f1cb366953f4fdcae83d7a37db46bc2cbb4e7d1d093e8501d22728e0d9b72dc5d145b854ecf97ce903723c41cee
TLSH
T1A1A002380FC138E2CC3448ED6B4A3700042BF4420B38202812958082E3844E38A2CAB8
MD5 SHA1 SHA512 TLSH

Submit Download

PGNCBG.exe.bat

Path C:\Windows\System\PGNCBG.exe.bat
Size 72B
SHA256 0883b93787e03c85029a0f64688e8c32e74bb649f0330317b1d23701c6c53da1
MD5 2f88f83b12bfdb74645ba9f6ed9bcf17
SHA1 3dbcbe35da765db4195b2746f866669f84bb101d
SHA512 28508f5da54b7d5d517dc27f3e46708e90f22fa4f81b88600f3e2825c9f36bb41282a167cb8f2600f6d0f11ba37e6846ba0ea5a43b6a1fcec0ffe1dc3a387e05
TLSH
T1CAA002300FC9A2E28CAE686F436A3720042AF642231A00E092958083E0C4463EA288B8
MD5 SHA1 SHA512 TLSH

Submit Download

PTFS.exe.bat

Path C:\Windows\System\PTFS.exe.bat
Size 68B
SHA256 6ec643bcf97839b5ebff37611a8606b7b8af5d17b8197dec371c209152f35b70
MD5 562e042a1366641438a40a5edd4f06e9
SHA1 2d2c84c3ff391f2cbb750cbf4ad12ca7246efc57
SHA512 947c3d46ba2507f2480b3b04b1d949ef480f3b88853e8250cf11f2383bbde7482b5df56dca90e67d20cc9d028251e54fa4346abdca88adc5be46bb2e8ef8ae69
TLSH
T1F9A002300EC120EA8824406F634E3720042EF442831022E0139D808AE00CC638E208F8
MD5 SHA1 SHA512 TLSH

Submit Download

QBKJ.exe.bat

Path C:\Windows\System\QBKJ.exe.bat
Size 68B
SHA256 0dd078c9c9b7d8ad88d72e9c3f558b99d05c450240e7c45da21e4da317e2ab89
MD5 3432953453513f231d9396401aae399e
SHA1 10862535b9058a0cbe20b6ca4f150b3985d45f68
SHA512 089396a5b5ff85bd71b53917de83bab9ff16b56b30f5a4f42087cb2cb344a5e665d3a41e033d6f64612633f2c41b3360b5e1d091acfa8480ccaac8eb2cf5974b
TLSH
T1D9A002300EC120E38824C0FD634A3F20042FF4420338802012950282F00446BAAA08F8
MD5 SHA1 SHA512 TLSH

Submit Download

QPASK.exe.bat

Path C:\Windows\System\QPASK.exe.bat
Size 70B
SHA256 cd95e3304d5c674440d89bd885a9be8596a1c14f16f0932bb9e7ca6b0159b166
MD5 92a31ca4e9afc49c940ffcc57f6158c9
SHA1 a3d2904428ceb169e0fa3f373a485fdc17651835
SHA512 cb83ba61be0adc2735afb561c369a243a1d1542ecda565105475b615c3fbaa0df4ec927ada697e1e5b283d2a76581bbd59d68ad5d8a58cbea5efbcb0ae864d83
TLSH
T11BA002300EC120EB8A24406D434A3782E42AF442233C0C203A950082E0044638A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

QRO.exe.bat

Path C:\Windows\System\QRO.exe.bat
Size 66B
SHA256 21c903a658fd9ee1533c9059b56783f8088aaae75568b7db38e1b13b2cd842eb
MD5 c3a2b26b337fee41e89ca1fe29d7deb1
SHA1 5ad9462f605886bc80f349f53a80e5844e9e9947
SHA512 7f9f896ae487722227d8150e9e5ad2f4be0ea80749e8236ef7fc14d9baef763c0c3eef4d3ebf2c2f99a2cc35eb5c1c5c6d442fb3c4ec75f1cc44ecce26914fc5
TLSH
T162A002380EC122E38C26406DC34AB728A4BAF4438318022012950082E0044738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

RDOFHDA.exe.bat

Path C:\Windows\System\RDOFHDA.exe.bat
Size 74B
SHA256 c9914eff4eeeaab9299c2b18f7e48cf74904d607a9be0f4d3143084be718a1f0
MD5 6986baf8db11307637bf9b5a3f4a5b37
SHA1 8ca2a66fcbf0c4640ed5242d0bc2d833e5f5ed95
SHA512 54312395c39a39bab982922e5749b1e34dbad82b9e0260c91a043d9b205fd049dd957cc5afa704313300b805c31db5696fbde45ed097d23db65a9fd300274d63
TLSH
T1A3A00230AEC328E28824426FC36A37000C2BFE4203180223129D00CAE2064EB8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

RQIU.exe.bat

Path C:\Windows\System\RQIU.exe.bat
Size 68B
SHA256 c0b71c023ae5f7bb0c669b0c3eb0872352cd90478c84a1dc8ff5bd3f04a31207
MD5 18a01964ec021ef815955b9c23a15eb7
SHA1 699f04b4c2282ae6a0221952111d68393fa9f9fe
SHA512 fbab98bb283d2d49f9256e1c6e4dcb7f19003c1e470e85865bceb676e9a6de9327f9482a1677e7b2abee3a122bf25379e37c38a102f7d00975c3e98ee12cd61b
TLSH
T140A002302EC120E28A2448EF436A3700042AF442831000201A950083E204C638A30EBA
MD5 SHA1 SHA512 TLSH

Submit Download

SCHHWK.exe.bat

Path C:\Windows\System\SCHHWK.exe.bat
Size 72B
SHA256 df38986267da382fd86c28e30e1c372ce5ab49000d59fa650e58ced7dd400d83
MD5 befd8f6bd322cf25a37f89c093a7caca
SHA1 a3ab17d235cfd01822216dc3d7648b3a5d6c9f44
SHA512 c50214ca577dcbbae314a0c2128dd234a7380a38a699f95ab3f52a56a94738fce92ca01e642b7cf6f4c356c4e4368359c89a5cefd46b72b51703704f0449b691
TLSH
T1F6A002300EC1A2E2A824C06DC36EB7800C2AF6420318282013BF0082F0044638A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

SIVZTT.exe.bat

Path C:\Windows\System\SIVZTT.exe.bat
Size 72B
SHA256 c752759f07e645eca3b341208852c8077459cc146997fa42fddcdf48e4eb78a9
MD5 786613ce997a1b4c0a43a48f5564f9c4
SHA1 9fcb7d7a1dedc873730a2deabfee643b916c6a8f
SHA512 ae71ef3bea1d88dda28563e2989b58730227b140497e3cfe1f7e9b42077a14b2890bd80824a82a758af0f9b662b8f3620ccaeb4b836597cb03bc4dd465df9e34
TLSH
T174A002380FC122E28826406D434B37800C3AF4420B100A2B9BBF0083E2044738A208BC
MD5 SHA1 SHA512 TLSH

Submit Download

TCJG.exe.bat

Path C:\Windows\System\TCJG.exe.bat
Size 68B
SHA256 8977e907a9b3ed5f50964c774435fec5521c9a3dcda01b388feb1621f41f57b2
MD5 7b7e2c840fb7fdc9595e7f01f459b6e4
SHA1 26d84997caa7c87119eb29eed4239a35cbf6f5c9
SHA512 1621b31e8a43f61c5fe35993435f5c72514078fbcfb85e6cb8fa0f2dd027cf2086c03ddba3380ba3681a600b7dcbcc29d377a2938640ddb03728b9c84aa08aee
TLSH
T144A002300EC920E28C24406D434A3700062AFC62831888301E9508C3E8244638EA8AB8
MD5 SHA1 SHA512 TLSH

Submit Download

TYARQ.exe.bat

Path C:\Windows\System\TYARQ.exe.bat
Size 70B
SHA256 5f1ccfe03f875e92884692b345e5caf476eb461d908069850f339713b103c4f9
MD5 5937dc0fd203f0f4e7e42290c142b380
SHA1 c2ab3fa2eb0e85c5c23384e54bd630116c74625b
SHA512 46c240b033633119d27698090954728c9478ed8abcb81525e8d38ec3d09893ab31d34765efeee9739ec7014617cc30e0c533a1c07a21dc1c6f71edf128ec3e04
TLSH
T1DAA002B00FC138E28826E06DC34A370007AEF44203100AA01A95008AF8044E38E20FBC
MD5 SHA1 SHA512 TLSH

Submit Download

UTN.exe.bat

Path C:\Windows\System\UTN.exe.bat
Size 66B
SHA256 4d0fc12ac9c0f74ce17df5c0bb81efe6924631e1f0ee96961455e9a980e481e0
MD5 364fe0aee49aa7c498dff261517d4698
SHA1 b509d89d0ea43495c52b849aa05d798dc860d6c2
SHA512 b1c165ce15988b92dcb2030966d0c8f05005034d0aa8e51b5d01c7fbd41a2e7be903c27fa9c78989d3042ea6f444a95ade800682d5268187c0fe08e06c44d8fc
TLSH
T14DA002308FC322F28824406D434A3700342EF442039028209295088AE0044638EA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

VNLTAQ.exe.bat

Path C:\Windows\System\VNLTAQ.exe.bat
Size 72B
SHA256 e4a65ac4e31061992b1a3b316243d5a001495a346ee57a5e7665e71ec55e7a2d
MD5 3fb50edef51ebec3cdb21aede0f7eaba
SHA1 edb57ee4010fb18fc28c3217bfffec2f08b61541
SHA512 a210695d877f00926e5944af6c62708980ff866d262568e1ab9406c0eabe645e85cac929e1ce1aa0bd0f1e6ed3555d96751671f611fee26259dfa7c4fc78f3dd
TLSH
T1C7A004300FC517D15D14405FCFDD7700041DF4C11311031015FD0045F004557C5D4C74
MD5 SHA1 SHA512 TLSH

Submit Download

VNNVFKQ.exe.bat

Path C:\Windows\System\VNNVFKQ.exe.bat
Size 74B
SHA256 df55d797d4b2d545086c372fc8634ef8176e2f13d66b4447232855fbc4584b68
MD5 2ef3a0757c942b6325570781f8d77ff3
SHA1 1c29b5dcae7364ee61b141e9fb05cad790369ae5
SHA512 72f1ae53a39823d54dec6c3078179886c0e20c1695828804424784892e18818c35d80bca7061114be9cca3178af15d4b10d392a8d51076dd22af8d4e9ac636b3
TLSH
T112A004700DD115D1541440DDC7CD7700051FF44153305170155700C5F0045534550474
MD5 SHA1 SHA512 TLSH

Submit Download

WSQRIF.exe.bat

Path C:\Windows\System\WSQRIF.exe.bat
Size 72B
SHA256 8e31842ccd74d9fc3dd14767b828a7e693758119585e6f88a5e772812dc6005e
MD5 a48b35cf300d6f8a935374f6a5475ec5
SHA1 5cc4c585395f46eb35b019197f23ae2092fdcfd8
SHA512 e81b3ce3560e20d98117e43cb0ad4f2b94fedf8135ee8b074e143f700c1689d7a1e2fbfb63c2d7c92085b57075b208971aa5d3978f5780db4bd2b80f39c2fe58
TLSH
T195A002380EC938F28E24E26D434A370204AAF46283130020129503C3E206463AAB0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

WYZZD.exe.bat

Path C:\Windows\System\WYZZD.exe.bat
Size 70B
SHA256 b34b1e37546ae301f84d0c5c10ab66ae9049354f1e48f7d2b04ed67a8929a8ec
MD5 68363d5cf611a1b967d6883ca01aa45e
SHA1 002ccf2264c89d7a3adbe624a2a3a70635c5ac01
SHA512 3b9c9720fbf2444cb47a4eb69580499faa05bb4adb4a5248095254af8368c20ad00f0f2ef95b9dbc9e69fe977b5cc58936236dda2503c877af9dfe970d31dab5
TLSH
T18FA0023C0EC9A8E28824E06F634E3702842AFC428310003812D700C2E2044EBCB20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

WZGC.exe.bat

Path C:\Windows\System\WZGC.exe.bat
Size 68B
SHA256 58d79e85eb091044e225cd6172bf35f97ec7641c027cca6a832a526025f6c584
MD5 7064368eb801d465245bc76bac4a6df1
SHA1 9b2fc7bd4bcc64188de69c81a4ecf5eb102ef55f
SHA512 54cd14867f693482fff1bafc09c336654f87beb9a27b3b9eca8caf491d5d250a87bff86d5333c81b73f654aa243b03e24ba38cfbd0c560f96310af8476a88dbc
TLSH
T188A002B82ECB20E288A4706D434E37000CAAF4E203108028129500C2F0044738A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

XCA.exe.bat

Path C:\Windows\System\XCA.exe.bat
Size 66B
SHA256 ee4f5b43323d07980add40bd32b66fd84576468ec3fb81758af512a00d317d1d
MD5 6d218dda13e9f60f25be4dbfb6650a4b
SHA1 0467b1d065e5a35b0afdc26c7d758fb06537394c
SHA512 286580f61dc8a41044b5495a0bd6dc3bc641f8b735def7b983001b8c765d4287d105e558f63a08ee7423332c17a2af5262918e46440a1d151bcd812319bfa261
TLSH
T136A002320EC120E2882C406F4F4A37002C2AF442031008B2129D00C2E22466B8A20AB8
MD5 SHA1 SHA512 TLSH

Submit Download

XJGHVVH.exe.bat

Path C:\Windows\System\XJGHVVH.exe.bat
Size 74B
SHA256 5387f817f584987884355bb6cb72c0493de6a7e072a387478ea70893aacc3c1a
MD5 a84a7f55cb1a1eb185e155a71eb1729b
SHA1 a81367c75fde371f5e9399a0167c81b7923f9dd1
SHA512 54298e52386c49675b9e2ae4e0befa39b5c48e92899331e2568a971a354b44966f43eb4690ccc7ca4b9487761d563ac9ad5c1d8d7622e9852364dab41d19b0ce
TLSH
T1E9A00230AFC1A0EA882440EFC34B37282E2AF44A233000B8139700C2E2A4673CB208BC
MD5 SHA1 SHA512 TLSH

Submit Download

XKZGCHK.exe.bat

Path C:\Windows\System\XKZGCHK.exe.bat
Size 74B
SHA256 4bc9409665145b05c9d3a23ef3742e3472418b722f97c73d814a38d2043aed72
MD5 ed433a963c5f2adafed8d1ab81a6775a
SHA1 4ee1ad3097811b6e14ddf56ec06221666fbaea7b
SHA512 09154a5ee7bdc71f348890607da676d96e13546a3524fc9ac79c6e3c85c3ffeeda555af3f5a2b978a460748fb7bea13f86d435c5b7af102c3f53e2296eef66f4
TLSH
T17EA002323EC1A0E28C2440FD434A3780242AF442039800B0129D00A2FA347E38A228F8
MD5 SHA1 SHA512 TLSH

Submit Download

XRMU.exe.bat

Path C:\Windows\System\XRMU.exe.bat
Size 68B
SHA256 231b574d594ff4a7293d3bfac3a57687c73f18ee144dfa177547ee728d0bf6e9
MD5 73b50b07640a3ddbb8c33b11de37e18f
SHA1 81f7acae518732f3012850c08b274aa899b27cd9
SHA512 4c5bed35777bead92efb6919189aa9f69b14c0f111ae924af424f85b1aba7fe4698fe9091ad650f1874f77e02c20fbe775fe03089ddd2de625d534a48c6785df
TLSH
T161A0043C1DC110D14D1450DDC34577101C15F4434354443011753041D115D734510D74
MD5 SHA1 SHA512 TLSH

Submit Download

XSNXQX.exe.bat

Path C:\Windows\System\XSNXQX.exe.bat
Size 72B
SHA256 fedd1afc033f36e0d0483044393738544aef9a7d44ba229052a080f595c14702
MD5 47f4d535a6a87e2cebe0c5784de253cb
SHA1 3d4bc43af8a85748e1f8be97a703ff9ff9bc2877
SHA512 e6bedd9784ba590deb160a83d1c3934c129a2ff30ff5b12ddef748234a3457a59cf2dc53bffeb75a5c72aec7f8ddbd025eeaee4e224ec6f4ff2ce387e2707068
TLSH
T1F4A002B00EC128E28C2C406D434A3702A42AF4CA039000B0D29502BAEA267EB8A20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

XWWBMQW.exe.bat

Path C:\Windows\System\XWWBMQW.exe.bat
Size 74B
SHA256 754dceb0ecd00c1832ede50c78c4d13a2148a347e635782430293a41b2af37ba
MD5 8a6340f92d1abd8d11be93610050e886
SHA1 49a1ed413bd4e4d47df65173ad0e67a545f357ac
SHA512 5b779561af93f9a095764eb397b36ecff3a994110e9e2a7788395bd379d4480d7f0f060252bbfb7e238215870b0d656de867995071b583435ce1479c15ace46e
TLSH
T130A002300FC138E38824406DCB6A37002E3AF44E0B9022301ADD20F2EA24673AA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

YAXXMP.exe.bat

Path C:\Windows\System\YAXXMP.exe.bat
Size 72B
SHA256 a3163c882d16dcdac4fded196a8c55eaf7d26ceb8723fc262343dd35f459b0b3
MD5 3e197a1ecfb3238ae1017f6027d43bed
SHA1 edda78129c59901fac43f77a8f965dae7233e2ef
SHA512 78c2a4b47c9b9c4228f08cdfb4dd62e224911b988bbae7848592d4c213b82653b7cbd621d35f8d8552e52bc28c1d4ca5055329baddf8b07e16ae63cc4736725d
TLSH
T1B2A002380EE120E38824486F634B37280C2EFE4A033A22281295088AE03446FEA20CBC
MD5 SHA1 SHA512 TLSH

Submit Download

YJEQ.exe.bat

Path C:\Windows\System\YJEQ.exe.bat
Size 68B
SHA256 f96c8c7a25430a8940d0873c0b13ea2df049df2c4e455b10b081aa520978b8c4
MD5 ef1ccdd8dd7e71527a97914338b6f5fc
SHA1 90ff3d2d0f4b1e554f9bf3e9d795cbbb4e0c06f2
SHA512 cc3f654544d31a55ce95d59faf16c8facc488a3ed39c5293d7a040e7ba0d0327b8ea139d2a86d9b2fdff5f032e77153861824f503a2baad0ae8657d800146777
TLSH
T1CFA002300EF120E2A824406FC34A3F800C2EF642031202203A97008AF0044638AA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

YKSJYG.exe.bat

Path C:\Windows\System\YKSJYG.exe.bat
Size 72B
SHA256 dbee497cb71e5df5433b3a91e27def7abf649fcb9e91e912734049b1663e36fc
MD5 9645aa01bd3e9de297072d5a9194c570
SHA1 8291ba5cece264c5fab26295f320164ebb4b6de2
SHA512 363d2bc39cc0d3f9901d62864512f9b3b101460a345401e0eceec3d0a4dbb244687dbb380cdd464543e0c39abae26fd52f2728da147f6e8177d4172a618593dc
TLSH
T125A002300EE920F28C24606D634E37002C2EFE430B100022129580CBE80466B8A28AB8
MD5 SHA1 SHA512 TLSH

Submit Download

YLYJLXT.exe.bat

Path C:\Windows\System\YLYJLXT.exe.bat
Size 74B
SHA256 6ea3e85b01f05bde0becfb7ad5e9e7a6a2287bb0ff927850994ae236b9076922
MD5 8e1e2100cd1deb22bae72b492060a641
SHA1 4fd21cfb42e796ff882a77af7b7b8c3dbdfe8721
SHA512 4bbd7ccba0b3d5b2b0487dfd253f5a961af8a0229e2a4501cfe121c679f71f6389357daa3ac263294e9b45a1e05d3629cc96d7048a9c83cb295facfa3cea27eb
TLSH
T1D2A002380EC138E2A824406D43EA3780363EF64303120A201A970083E004463CAA0ABE
MD5 SHA1 SHA512 TLSH

Submit Download

YXHEL.exe.bat

Path C:\Windows\System\YXHEL.exe.bat
Size 70B
SHA256 cd6ef37e5b89282b198548034bc2aacecf1a415e3861aee4da213bdae2653963
MD5 655d7753d1e3464867e419af3d6812c1
SHA1 8d88194e082c6b5975184051f0626605658b4846
SHA512 b35434e90efbbc4e367c2712203d18403a5f0cbc752215883a85d7046052e58eef4f1f874f314edcfc141734c836ad44d70b310ee5c286bc835367b885ef47ea
TLSH
T168A002300EC120E2A826C06DC34A3708842EF7620310002012950082E02446BCA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

ZPSPPBA.exe.bat

Path C:\Windows\System\ZPSPPBA.exe.bat
Size 74B
SHA256 c6a86a65d49928528e0df76911d353f913856ffc9b115121d837a4c098e69a19
MD5 9dbb3d4671287963912b7c3f32b496dd
SHA1 58d0c9677b6eedec89834a4c8c4e030d8718e949
SHA512 2ae775e951d3866b649547275214bc65e5f572c0257090f850a5e7a2ca9d57fe6960b9f7a813ca473a7602e8f87fb3847e6eb707496203c26d36c586491f2613
TLSH
T189A002300EC9A0F28824C06FCB4A37080C2AFE4203388020339D008BE804463BA208B8
MD5 SHA1 SHA512 TLSH

Submit Download

ZPYAS.exe.bat

Path C:\Windows\System\ZPYAS.exe.bat
Size 70B
SHA256 adaf463e346a1c2f6060687190d5ea8209705bf6f910ec653fd00d5cb8907aa6
MD5 492c3e2b3a616315d42783e376df0df4
SHA1 95623b3d8cc2aa1d06abb4c2bacafe3818982c69
SHA512 b1c6e4786020e6cd1b44c6aa3ed06abac9e4ea978b377e9508bde1484a49f93f5c47729b1ca4b3a2c2bbccbb7543482abbb2902c5e99721b0bb2183651e92f28
TLSH
T108A002300FC132E28AA4C0ED434A3700243AF442833800203295888AF08C463AA28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZRTM.exe.bat

Path C:\Windows\System\ZRTM.exe.bat
Size 68B
SHA256 7d70c49ce2062e9f7958be0e123616b648248718e6517a7dcd2346a2e60f160f
MD5 65c55aa7bfd35da90a32f63ad72187ea
SHA1 4495a34cd473a031669389a5c71403f00789511c
SHA512 f0cd0614d195404975ccfd94fae8883b75c2a451aaea3595a9a75e59c98601ba462a831feca11ea3f763580ea48049c879bcdd1e5bb2a0badcbffa37d7debc4e
TLSH
T165A002388FC122E28C24C06DC34A3720042AF442831200A012950282E00446FAA288F8
MD5 SHA1 SHA512 TLSH

Submit Download

ZRUI.exe.bat

Path C:\Windows\System\ZRUI.exe.bat
Size 68B
SHA256 47a5c952fc921f963d48be5184e08c80a8fee62784ef045308fab2afb39d4ce5
MD5 2afad66c459ba7b5ce58f7d31aa7f44d
SHA1 988510912323c4f0cc1ca384fc3dbadc86b5dbaa
SHA512 363273465dcb09bea122778fecf050702c7b86eda025f717de6355b0c9d58ba8e36cd00950483a0886fdd247d69a83d92ec3ee377780bb2056118b1c8b8c1d3f
TLSH
T16CA002302EC120E28C24406DCB4A372206AAFC42831000A093958C82E00446BAA288B8
MD5 SHA1 SHA512 TLSH

Submit Download

ZVVVJL.exe.bat

Path C:\Windows\System\ZVVVJL.exe.bat
Size 72B
SHA256 923a001cbd8d2f2d008404916c5d29c7e0cde2825e64d919e481d2c268bc0c33
MD5 f9495576c701e6adb0f1d3a405d3070c
SHA1 2b2b5ec3960673ce105b712d6de2d01aff55493a
SHA512 48bc8b9736b72d3afc6a19d777edb219b83f89ab178ae46e18b1513b1e44318324723976765a0ff31f773a398b21ef60840c80df182e076feaaa3801f07b4d0d
TLSH
T1A6A002300EC120E38824C26D434A3700062FFC43031000201EB50082F004473AA28AB8
MD5 SHA1 SHA512 TLSH

Submit Download

ZZFU.exe.bat

Path C:\Windows\System\ZZFU.exe.bat
Size 68B
SHA256 4b65bd6afe0c40a210cba19f890150cf68b818442010d65c13d33493185f379c
MD5 674293cb2ec7ac9ecc3e492920fd83c9
SHA1 702e57a0fa2c8894cd1e762b8f3b2dfa5171bef9
SHA512 47305143366c1953e3361ecd4deb5a54243677ae1067e1b324298bab130100b2871183c62887ade25b58adb702e2d4233ef282075213329b5bf112e2747037ab
TLSH
T1F9A002380EC120EA8C2440ED434EB720242AF4428310002012950082F004C63ABA0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

TEEUL.exe.bat

Path C:\Windows\TEEUL.exe.bat
Size 56B
SHA256 14f6da1b866352084e8f40b12e6f10410f22b693338be22e19dbc7161921ee6b
MD5 31f18b12f4638511edbeaf9400554e17
SHA1 8eaf8b1915cdf1feb6a0e4f4254e245b2ef4c5a7
SHA512 c54594bf705528c6e294fe07d4c8fcb20b9727510c9837f94ebb2a8dd81e2aacc41d4705393c304eeb0170340f3254a2158f09f640764e71182eda6ae2715bdd
MD5 SHA1 SHA512

Submit Download

TNZ.exe.bat

Path C:\Windows\TNZ.exe.bat
Size 52B
SHA256 72534a906ecfbe61c6b814b856dfba59b94486c4e6bfff492cfc45510542504a
MD5 382111d7d17fa9dec3adccb9db333c67
SHA1 1b3ed724eb6a605cbca6d4ee505a97ad7b60c103
SHA512 1b99d63c2b8376e8724d0acdc9cf9d4ddab709061da5aa603bedab5ac145c08b74625b30b0eb640d7d5475fb4e905d775eddda8f016b8df6301b5ae20fe7bd55
MD5 SHA1 SHA512

Submit Download

UBSMBS.exe.bat

Path C:\Windows\UBSMBS.exe.bat
Size 58B
SHA256 17c8a4f9776da2680277c1b7b965ad11f15c7928c65dff56538168e3f89ea030
MD5 e9abeda603f12248e70c90fc8f9ea772
SHA1 27e6d3c7daacfacb9852cda074bc49cd0133dbc7
SHA512 6a463fb1d7e9d91875b937720149515668bb99fdb01fdf2607e82cf3f38a234f4e2aee6a11d0ef1c79a04bfc13d676cf5e82513c614850fa168a0c00536e4b26
MD5 SHA1 SHA512

Submit Download

UZFVGU.exe.bat

Path C:\Windows\UZFVGU.exe.bat
Size 58B
SHA256 fcca2e16354cb40c97b0339ac89d6f1b6e61ae057b40b7dce4df5f971927bf8d
MD5 c8f0960435a3f84b59c0db2cc42927f1
SHA1 9c57c9218dfae6e1acda23504faa0fad8c454534
SHA512 3b908212ac93d034e86ce67368de0085ece6d1e8bcb10909eca5cd6f5f22cdfacd91a7fb50de89ded98131654e5e731bdf81966cfb729398515a9bd88e78acd1
MD5 SHA1 SHA512

Submit Download

VDFBS.exe.bat

Path C:\Windows\VDFBS.exe.bat
Size 56B
SHA256 a8203cf41056c4a8f0d9a328aeaa45fbbf28329e75fe66f699c96ef34981a344
MD5 405f0a922eaf860f47bd8d0ab293dacd
SHA1 e449570251ffd423b91532b98c8dc3778d8ac188
SHA512 052c70a5adfe34f8a2df47abdc2363674e8b8688ea7a8bcf5908d667284c48b35b3aba7ccd86e78062bf762cd4a88995baac06d388882b7cae6c69b214d50d68
MD5 SHA1 SHA512

Submit Download

VREG.exe.bat

Path C:\Windows\VREG.exe.bat
Size 54B
SHA256 7e9953cda970b3e91939fc974fc5c4d327df2fd19c3c1d3e5204e6b09f3108f4
MD5 17040290c7c151444c56592a662b6da2
SHA1 14331a1c8d446cf3aa4df04cd1f81c390f470a80
SHA512 483f6439cf1f38c52334d37add2325f58f43b1bbb6f8369510a8367af6d57b94ab43159049867dda7cd649fe464925f22cdacd395d6e5e4614055fb4b252e163
MD5 SHA1 SHA512

Submit Download

WLKZMC.exe.bat

Path C:\Windows\WLKZMC.exe.bat
Size 58B
SHA256 767e6f3ed51660e4d9b1c52a8273a25afd53c2df226be3551aeda0781c02a663
MD5 ed9d69b5f2842ca075f602ed2d145d59
SHA1 cb220e302724b325e0a37fa6667f842fcf71597c
SHA512 5591f7af04e769f70c5a03e20eb51d6ad09d53f3f2a24bde5ad1bd75c366d4ecc3be99f5ad359cd7aebad2f631ad767e743252afdaa6aea43ca35cf7b1292b78
MD5 SHA1 SHA512

Submit Download

WMNJSFU.exe.bat

Path C:\Windows\WMNJSFU.exe.bat
Size 60B
SHA256 54b01a4324ee0e47d03a2cab7a2ebc9f6f9ba08a96c6096326c93a67e5656096
MD5 d31b2ae251161c578373ca3ac2d0b4d6
SHA1 7edd7033c357e3e28fd5dc7ede532f4929dba7f6
SHA512 b67040e2a2ae3263396c570416738d5b6dcd6b9149f9de4331d761c40b75af5929f963db3e90c799811f8c7e94e849baee89ffa5a850191ed2fe8ff1a7308c72
MD5 SHA1 SHA512

Submit Download

WOUKRZF.exe.bat

Path C:\Windows\WOUKRZF.exe.bat
Size 60B
SHA256 3b97227a932703e5234badf8c2164cc7dc5c8019d0ae56e804c52207777e07e9
MD5 2f6e6ff120d14f49c120c8ed317b99cb
SHA1 d36dc0b3bb0f1fb14fa874a496254be443603418
SHA512 6261d5729d4ec5c5cb2b8878a3e8ce923acfff440976ed633bfed0ba2f013eefa8b884ca68be1c7577b93f28d8b1d2ed186d1a2e8e228149fb92c3483fe2053d
TLSH
T106A0023888C1B2E08C24C0E9634A3702042AF6E0B210A000131722806804C43A2C08B0
MD5 SHA1 SHA512 TLSH

Submit Download

XBUZDV.exe.bat

Path C:\Windows\XBUZDV.exe.bat
Size 58B
SHA256 0a6b7e8e685ed0f4c796a03880cfb1378fb894df026538cd90635124f28ae4ac
MD5 b3ab3b9a99587b5454f4dac4c5ca5e2b
SHA1 2bf0c575f687a4d1d738392c6b1cec64010cffdd
SHA512 13f0ec2bc050373d4b66f937a6fa0a7724a6ddcdeecf14953f68487f7528fb14149788606f5e80e87c32fde405a3eea00bcea773509e12dfb64e08b3c1c762e5
MD5 SHA1 SHA512

Submit Download

XCF.exe.bat

Path C:\Windows\XCF.exe.bat
Size 52B
SHA256 6a50871e0bc47a9f08d6356b866861e17f285a54ac40fdd103160a94d814f147
MD5 9b3521be33c7398b777e7f1ed552e790
SHA1 66b02f1a5dfd26127e9684301efceaaf1f3e2641
SHA512 0802c46050e1fd346f365f56f3f40599eca47d8e9971202dfc4e250ede06b1879d57b9d5f59807bb31e4248a8ad93a78779338d40e16ca4e0f0d1fac39b11c97
MD5 SHA1 SHA512

Submit Download

XKMN.exe.bat

Path C:\Windows\XKMN.exe.bat
Size 54B
SHA256 a36469273c6ef005af124e4bd4d87c6d9e951642cbb392b9e253f53176ffb1be
MD5 804c098902ca39a1989ba91f34d0bad2
SHA1 3580bb403edd2c19e4239da95ee4b02bb009c8b0
SHA512 337f3aee90e00ab63e79c1c77b9d809dd4ee1612f5c3aba4fc92a74ae6c6e753ed45e9a98971c58637d2e652ac4d3fb1d671d34f3fc23894b5496eca3c4867bd
MD5 SHA1 SHA512

Submit Download

XOQ.exe.bat

Path C:\Windows\XOQ.exe.bat
Size 52B
SHA256 1cb9ebd6d81eb217a556acb1fe9c1b9f46fe4037d5300d6eb9f354dff54e8904
MD5 4709d297a7b08f4fd8de5036f770d833
SHA1 8cdd8e20abb02850149f89fd6a99300e4d1589de
SHA512 615d46b9de6cb807e7e254848d41d3f39d926300cbcceb5fef6daaa43364201c22cc58577727297fcd9ab9a70ece5222637360ff03b387cbcff6478ff86b901c
MD5 SHA1 SHA512

Submit Download

XVSTFSB.exe.bat

Path C:\Windows\XVSTFSB.exe.bat
Size 60B
SHA256 8c35e716a0d5966641daac519f609ddc7502d910fdf93e24c3a3707e82048a89
MD5 a2eb652d88d860862e403b1f2366b01d
SHA1 d1522f7a5539d1473c39e38ab046a952d1079eab
SHA512 c73053053dead93ef7532ad648583020ebb69b24f34aa618747b77e8b296b73c85ea7e07373cdaba55e4d674e2cd20348001fba02b97ff16d2b01fa4ad581549
TLSH
T1F7A002B00AC1A0CA8CA4684D43EA37000C0BFE6202902000131500887804643A8000B0
MD5 SHA1 SHA512 TLSH

Submit Download

ZCLZYNV.exe.bat

Path C:\Windows\ZCLZYNV.exe.bat
Size 60B
SHA256 3ed47b0e5f7551e5eddf74f97b2912bbe51160c589ff433d2cb23709f31af3d4
MD5 13c7f88aebfbb7d834db90d6cba86125
SHA1 51726c4a5b038b1ab1c20902a5f1f125bf98385b
SHA512 4c566208941678302deaa6f88a96e177f8a77ed1be32127bc997837b623f586884adeac6e0d707b80daec6cec4779f77a8edeaac21441408f88edbeaed944e6a
MD5 SHA1 SHA512

Submit Download

ZPLLWA.exe.bat

Path C:\Windows\ZPLLWA.exe.bat
Size 58B
SHA256 69aee80549e9fdcbdf907fe98e8b05eec2c4543f639b58d4d8d43003dc5e4fff
MD5 e60f3dd246a519e9cbe19dda0eee36e8
SHA1 ce10bc4fe10b5b84e7855f9dfde7b78dc6d74d49
SHA512 2ff1fdcadba56c5d748ec824583ffc3ad010be350946717a102b74c75ee3b52831d49aa1f6d729ca07bab2e9e4060895f04a00fa2e0743bb5fcc9645a5a217cb
MD5 SHA1 SHA512

Submit Download

ZPTKLH.exe.bat

Path C:\Windows\ZPTKLH.exe.bat
Size 58B
SHA256 9f93e987b1d746be3d0152aa6da71663b8c2ed7dc8e1cd6b99b16d7bf0034243
MD5 14b5e6a85a0a7d3e18b622865a236c93
SHA1 33914cade31d3dcee689e5c02a73eb31eeaff61f
SHA512 62907c047486f225e2ba471c00cb0efe89c5af10b1f63c8d66794419c01572143eff5cf2f109ff4ba29ed5721e189b7411c6866794098144f267144f416a5c70
TLSH
T12EA002380AC120E8A8BC72496BCA37380C0BF6400210020A3B1500887084673A0080F0
MD5 SHA1 SHA512 TLSH

Submit Download

BOV.exe

Path C:\windows\BOV.exe
Size 208KB
SHA256 29d9b6971c444897761137224246d94a5b3b56424ca5e79df3eeefbb534fd033
MD5 051c557ecc3a04dc0715a1225b1cb7dc
SHA1 203b39576e1ba57dcb871ff4e5b018d815f2e934
SHA512 7355efa3d207dea91753abcb6e43b17ff4b56ef3f35c22c2fcd6ace50319014e1e16d397336610c970656d1adda79b21232a8e2e3ab4c33c8e94ee3a74f2156f
SSDEEP 3072:lW9CO41zW5pZJ5p50uvq2WKk9FYx+znSaGdjrozMYeCoZ398m4pLthEjQT6j:liyz+vqfjY8OaAHoQYepZ3SmkEj1
TLSH
T136249E197569C416E0A742744CCACB3C2D79BCA17791CB6F3E48B38D28B1398CAB6753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DPNO.exe

Path C:\windows\DPNO.exe
Size 208KB
SHA256 52631bc3948fd95a37a813dfdb2d78026a9803e770f58b88ed9e081614fb9c4d
MD5 2b275e3a56c8f167526a3b6bee8674ca
SHA1 469dcd11c01fe9b5e39be083dc56f199c072662d
SHA512 c835ec3210a82809c4f0e8dd2b11e9a8fa324d206b54210b18d500946577ded39bb413aeecb3bd8a94c2f46cffa5480e02af91ead0d6ca8f1c52fde69b4b7a13
SSDEEP 6144:clh3p9l6PUo6jibUMSsgFdKOjs8eTw53XkEj1:cJ9rdYg6vT8XkC
TLSH
T13C247C7937E2D106E27F00F6E4E1C3A45EA5BE259BF2910B6F493B9F0AB02511C32B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FDWXESB.exe

Path C:\windows\FDWXESB.exe
Size 208KB
SHA256 da3a3c2de9a874e5b67163fabe36c381175ae5e540dd8789ad20863ad25bd002
MD5 3ce418b75b1f6834c7d82b11ea7dfa0d
SHA1 dc272b8e5b2ec76ee73f70327d587d04836fa8e8
SHA512 27f24bcdc1db53b21e2042000877fd4a10739435fb6219dea382666ff40e45c26a7566ffa93957d51e6f964f82ac3d3dd58ac8ce1310c0f0257d314afdd3dca2
SSDEEP 3072:ZaJUoAbFDs6HbqpQF8u5DcYuHwhs9CLkeaqM7OBvG4pLthEjQT6j:MajFI8qpg8uCYhs9skLqMSBvGkEj1
TLSH
T1CF245B027AA5D053E0B35B3118E2D7D93F27BD728BB8820B7658334DAE735C65D91BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYMOGKT.exe

Path C:\windows\HYMOGKT.exe
Size 208KB
SHA256 2151e1a8739d85cb6257827b22e29bc52354c67f6126d39d4163508f1feb497f
MD5 edf10e60067f94d8526489c6be3e7a4e
SHA1 685d288b32591da9982266e06496630b5a159fa5
SHA512 8df660bbcc5255cd4a6baf75c7bfb96e7c9ffa2d61fd394885fd72571a76838581cef8280dde3cea096b028e0f54e77f5927a45dbb4a9ddbbf9db20c75af56be
SSDEEP 6144:URoDl3t85theVGO0ofkOUFE+fg2+0U7kEj1:URo7GOpfkxFEz0U7kC
TLSH
T166249E03B692C406E0E32A796CD3EC975939FCA66FD5436BB144778EBD302E4C941B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IXRAP.exe

Path C:\windows\IXRAP.exe
Size 208KB
SHA256 d4e96fcfc7dfe1410fe169a69326d4e649d1dcff6e6252cb5b4272c4968c5704
MD5 7018a5aa2d20f723c6e8b16c8fdf95ae
SHA1 989aba1256cfe076d32fd27a7be0ecc32d119c05
SHA512 bd724c9d3efb9720d25097bdc10b0812744fa85ffda46a772b63441410910728159c34048832cb7f553b62916ca39ac848d5a3e657ae1011bc0ac3f696e0b7f4
SSDEEP 3072:58quWX+Ar9S3hMQV5vLVVWzYvp3BkzMzMq0h4pLthEjQT6j:6qTXr5Q3L+zNEM3hkEj1
TLSH
T131246B41379AD5A3D8BB4E3404D385E15A3A7DB22E6F923F7F90334F2D75A405A207A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MVYNF.exe

Path C:\windows\MVYNF.exe
Size 208KB
SHA256 2d1327d2cd6cd09ee46069fc4fe54c97292bd0ae2139d0392366be6676b3e7a7
MD5 2191832a527bf75acfe0ef9a86337628
SHA1 69d526289602757536858a83ca682a5ee48e8f76
SHA512 4aab8afe21d6b88c911316ebee180fe427271cdf0daedeb1ee17128783bd49a6d797664e99d87e2a8d24127d3827604f55153cb8c418a26a249eed38d5707432
SSDEEP 3072:81IT6hTDgsquRueu2o1iXgytyvv/kAL8jVMBRfJOREf5Mte3EwqA4pLthEjQT6j:EG2bquR222iHtEv/k7jeTPqAkEj1
TLSH
T15F248D0235D9CE13D493333844E2A2A55F77BCF96BB2D71BF9A0B39E2470A885E24751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NBAE.exe

Path C:\windows\NBAE.exe
Size 208KB
SHA256 3b19bed254874e137bdd12b4746e44be976a8d78213ae16f69a21d73ef5c5ba7
MD5 eeb4637750ca8d0a907bd4db0f25c157
SHA1 00178efb0068625d24a186365d9a520ad2dc8e30
SHA512 cdb672ed6296492f61df188089a85a3b1b95caa09ec63803db0b9559bb914b7ecd1883f5cc331015468f46a581bc39664921162b313bbb752c6a722c38484d16
SSDEEP 3072:lW9CO41zW5pZJ5p50uvq2WKk9FYx+znSaGdjrozMYeCoZ398d4pLthEjQT6j:liyz+vqfjY8OaAHoQYepZ3SdkEj1
TLSH
T1B2248E197569C416E0A742744CCACB3C2D79BCA17791CB6F3E48B38D28B1398CAB6753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OMXSYL.exe

Path C:\windows\OMXSYL.exe
Size 208KB
SHA256 bd0b4309cae2e9015a99d9145962133dd5e8f3160e723dc9a476be40812bc851
MD5 105abf6b8016ee3eb3174f2e7dcae087
SHA1 5a939357fa2049317c08bbf1c3ed858f8c924a7f
SHA512 9e26cceb36b433af2f86019fa1bf2055f9c402e1fca7c69c78af732a1ebb768396e9636b0935daa99b99a14bc012ae3e3081117486df21dd89d02eb1c3aa3c02
SSDEEP 3072:WUoeIahN0pVmF7Yup8qFTRuLOKUMmXeOjQsUyF4pLthEjQT6j:/oiapwpp8qtKbMLRkEj1
TLSH
T15D246B0279C68563E2D72B3C5CE793F8096EFC109F6C91FBB5C0736E4A7A2614855BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIZHAQ.exe

Path C:\windows\SIZHAQ.exe
Size 208KB
SHA256 ad2fd427c2ef33248dd0d4b4c1148b5e4d3df410707c400038c681d75fa0a925
MD5 019362d6a10e2e33762133144860b32b
SHA1 180880d557321b38951a9606f3e7cda7a2ea97a6
SHA512 41df0491e2a10b71eec5f049dd43ef81fa5253215620189e8e059cb12ae4f99a927ad373afe05dee425d796c6e210a40397b00da39aa33cd16a2e0dbbcae98d7
SSDEEP 3072:wCNM9XisUC4ytBIWEYsl3qdl8PmrDwGFT4pLthEjQT6j:BM9y5WEYjimwOkEj1
TLSH
T199248D00F4C3CE1BE567423249EDDB943D327C92AE71962B7601BB5E6A327908C877B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARUZXDJ.exe

Path C:\windows\SysWOW64\ARUZXDJ.exe
Size 208KB
SHA256 5959db6f31de17d8a56435f252ccb3b4570ac54acc6d78905fe9da35c38722d0
MD5 31553ae2bbc554209cf1903368dd2ba3
SHA1 66b6a5aaf1eeea86e650d86083a3328a8e43f875
SHA512 0280ddc649585dc6e44c36d04ef49fd79a7263dd790b2d815d70f7616946eb1cb9eef4594a41072c9f9c3872c1c2b24f15713d3050bf2bd4c7d20ffd380e80be
SSDEEP 3072:EVB0c6393M65HMmi+Vd1FNE+WTbkDYJBLNzISAZQ4kbp04pLthEjQT6j:w0cg3MIp67TbDLNzIvZQ4kbukEj1
TLSH
T1CF249D13B6209583F03BD235FACBEB701829BC506FE54317A980376F89F1A6A4D1B765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDSI.exe

Path C:\windows\SysWOW64\CDSI.exe
Size 208KB
SHA256 bdc1bab909c9bd0e028145062f5d1462834d143d8fd002bb937aa2f8be7fe7b0
MD5 c5cf3fb0590e2df242b29caa1d5dec5e
SHA1 51a63c7024a18d0a236185f8d1fa0a05499b16fd
SHA512 34c14c32259132fd67499f46527d13634cf784125b0cac293f2f865e89ff705813042fdf049ca01732d8f05ebc34588f69c3b1984d0f6794a6a18d44613d83e6
SSDEEP 3072:ABvI/QdAEJxuYIUf99Pcufaz3SLFm2NPClvshpRN4pLthEjQT6j:ABEREf1x9EzG5fS0hpRNkEj1
TLSH
T1C024AEEB75958027F46346308DE1EA7F3479BC25DF66831B36893B6EBC712849C88B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MMD.exe

Path C:\windows\SysWOW64\MMD.exe
Size 208KB
SHA256 9722d5fbbf7bc449ff8c207178c3f1a3db54fb9380e3239241a599ee1d858719
MD5 979a5fcc1f319676d4252d78d6ad5b85
SHA1 62363bf43153db27f276a92c5c381ed1e6497dd1
SHA512 089f087008f0545aa79c00c0e012ff9fbbdcc24c192b778d84780f57cbeaf0d512e451ccacc2f18d33507f6cb5cf7f78ec4c4982ce7da345cbacd750225c590d
SSDEEP 3072:tgwBM2hUfBSHG/YDK+LEeFRx/68tz7lziZ74V7d1oUksH8v4pLthEjQT6j:tgw6YgBSHJH4eB/R7lzS74EsHCkEj1
TLSH
T15E248E113BF1D04BD023CB3A6ADB4AB46927BD91DFB7525B76043BBE5C3128409683AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TRZTO.exe

Path C:\windows\SysWOW64\TRZTO.exe
Size 208KB
SHA256 50fa1be4b3e5de51a97c63588db80870f1bd0f71b622ff3796990172d8550a42
MD5 f725c7ef70ecae999ac341a8d091f470
SHA1 749a72db6971055a7362c89e68281a45d1afd308
SHA512 13e74910ef774287b94f14f14b4a405a00d5c0d1f9ed801c474b8836c2fed9da5b9e71dff4b3cd6af216a0c41ae5c4f3ee0cfdefbdbf51d28c0ce1c22e848829
SSDEEP 3072:QhljlTgB+OetLREBEkFdSKkqQFi94kYJLDDNpLH4pLthEjQT6j:QhZOB+Ftt+FkEALnrkEj1
TLSH
T15B247D0772C9A462E0E726F54FE187D42A35BC756FF2412F7594732DAB31A018EA37A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VDTHJ.exe

Path C:\windows\SysWOW64\VDTHJ.exe
Size 208KB
SHA256 699f1827a96e0f616a1304be0d5f655c15f12017e5bcc7b276f14050e206b273
MD5 18d6d6d8b0c9553c7b8be55c4e2e460a
SHA1 945b42542e0bd99d0428a960222e9d78f50bafad
SHA512 79ee83d0d89af79fcb13c2be222714424057ccdcddaded927824017b38b4be04b0d5cfaf84355413b3f82c0a5c5da903913a4b47abcdfbd06751d9e2e6487edb
SSDEEP 3072:9PjuODwwB7MXtpx1soBNzKkuZM951yK68pvncRDWh4pLthEjQT6j:0ODsXx1nB0kP51znukkEj1
TLSH
T1C3247D2762508CA1E2A71A70A8E5A5E02577BC15DBF7932B7F80F33F3AF6640A545313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XQKJDF.exe

Path C:\windows\SysWOW64\XQKJDF.exe
Size 208KB
SHA256 1c311976aec7711235481f6c31259967515eb7224c7ca8a94a3aaa50e2e1fa10
MD5 92ce9eba853268b45fb7c7c382aced47
SHA1 7e1e221fa1b0a76c3034f6809a30f1317a74cc8f
SHA512 172512d67334bb8a056a23ce2c45d3d864956795a7052597788932516d0fc52b311f5b9162a44b7bb869b18e7a929bbd5333f909cb55f14c2a6af76530fd5bc5
SSDEEP 3072:jm1uvF/S0NErNOftTtctU4L3uPi7h5KpN4pLthEjQT6j:jRvFnErU5qtjiPit58kEj1
TLSH
T120248E03B9C7C183C9E74B3848EBD17815B6BD43AF71410B398537AEBD718960D25BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LFB.exe

Path C:\windows\system\LFB.exe
Size 208KB
SHA256 768157bd8d0a78e27cbc870805ced09717a49c6987afce89d35d712a5fe15eb3
MD5 a5b8d4f9335abfda6deb03637063278f
SHA1 8bb941b6c67abd2d08fe9b01d7d451c2c64e5526
SHA512 1adf26a838085c3dfa3774dca58de6c73da696cb7a6eaa82727e18e8b52f78db8df077ce600f4cc3fff2402894d4dd3558d84255734d7d1175a3e6979284b8ec
SSDEEP 3072:v34JO5itrjRXPyHGiWTXgWquBJtmaT6v0eRih0TonToXLWy6F4pLthEjQT6j:v32OijRkW7hqqtb3eREaqFkEj1
TLSH
T168247D4233559413E097563D9CE6C6B58B2EFC723FB6B2077D00738E18725626A2AB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OJPOR.exe

Path C:\windows\system\OJPOR.exe
Size 208KB
SHA256 fbaa479a22602e9d4027353ea27c63a267a56a2bbdb7343686e694a4f5eb5023
MD5 3fc8907fac331cdad7437e0aa8f3f770
SHA1 2667e8388d5ee69e4dc4f734bbaea9d599251a80
SHA512 72f85f27d0f99fcd7875cbfee6fed130eef9e4735696e431e7a9cbbd8d76ee11136987ad3677d811068e352b72443ce7a280f7d9f01c2a9e4b48d3ce59e5bb32
SSDEEP 3072:C6f9zNBBa/yOJ+hk8OVlx7Osg8NWayxfjHPEC14pLthEjQT6j:x6yLn0x7OsgnP1kEj1
TLSH
T156247D423664CD83F12B193094E28D721BA7BC665FF6532BB8C43B9FAD726A80514F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-337-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/608-325-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/984-408-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/984-395-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1228-656-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1228-669-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1384-372-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1384-384-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1424-89-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1436-348-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1436-361-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1608-466-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1608-479-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1728-253-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1776-455-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1776-442-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1796-514-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1796-501-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2088-45-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2088-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2316-268-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2316-252-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2320-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2320-44-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2388-74-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2388-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2520-104-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2520-88-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2528-633-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2568-179-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2568-163-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2628-632-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2628-645-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2636-209-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2636-193-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2684-467-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2684-454-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2708-490-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2708-478-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2868-420-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2868-407-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2880-208-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2880-224-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3068-574-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3068-561-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3096-598-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3096-585-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3420-396-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3492-542-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3492-525-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3520-349-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3924-149-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3924-133-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4148-443-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4164-326-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4164-312-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4240-668-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4244-431-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4244-419-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-573-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4280-586-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4336-373-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4336-360-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4352-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4352-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4428-530-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4428-513-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4500-178-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4500-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4588-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4588-29-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4744-118-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4744-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4848-223-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4848-238-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5088-621-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5088-609-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5100-566-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5100-549-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5348-558-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5348-537-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5436-502-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5616-148-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5616-164-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5764-282-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5764-298-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-283-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-267-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5816-297-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5816-313-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5920-610-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5920-597-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5964-644-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5964-657-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6112-103-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6112-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download