6ede5426eb28ee3c24e041f78ebd3fe563377c0059fd22875fef3c0a3ae14895

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
Size 208KB
Sample261003-t447astzev
SHA256 6ede5426eb28ee3c24e041f78ebd3fe563377c0059fd22875fef3c0a3ae14895
MD5 197a3216cdfbfb84da9fe1e356726d21
SHA1 9b5bb437f15b9e90816a6a9e0fb24e347534fe2f
SHA512 986becd907d69dd1acf6e7ea477635a3ec7ee553ee2ddfc875cb084478bf92a11644e5c474cdd5b643d0cad405ad482ad58ed48e4593e720a885325c03ac73a8
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfv4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO3QEj1
TLSH
T132247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 52 IoCs

pid	Process
3784	HWMK.exe
2960	KMIYL.exe
4320	QHTR.exe
4360	CPAZDMC.exe
1504	VSEVRC.exe
4700	IVMU.exe
5620	CQRDH.exe
1724	DLDH.exe
4432	MTXMY.exe
1944	EUZRCXB.exe
3780	YPDA.exe
4944	CXKIYQ.exe
2424	GNZ.exe
2516	RGUBL.exe
4940	BEHW.exe
4952	HEPJJA.exe
4596	REJ.exe
4108	LROY.exe
2528	GCEWLIL.exe
1056	BPJG.exe
1520	UTN.exe
2588	AOMK.exe
1036	EWTKKL.exe
5340	XOAVBM.exe
3808	XCAKDZQ.exe
2448	SPFT.exe
2912	HKPXYLN.exe
5964	PQPMZYQ.exe
1940	NOAPME.exe
1292	XOCU.exe
2052	IHF.exe
5396	TZAGG.exe
6100	IURKRKX.exe
3224	SCTP.exe
628	HXDBODI.exe
5388	BLI.exe
3004	JYAZAP.exe
1904	VRDSI.exe
5996	KMM.exe
2488	FZRGD.exe
2904	ZNWPNJT.exe
4140	UIBZ.exe
1096	OVGIA.exe
4960	JIKRKJL.exe
5492	ROD.exe
3644	MBHXW.exe
4652	VPSHMSR.exe
2356	RUYE.exe
5704	MHCODC.exe
3296	XAFHD.exe
5476	SNKQNJM.exe
3028	SQOUTZ.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\IHF.exe	XOCU.exe
File created	C:\windows\SysWOW64\VRDSI.exe.bat	JYAZAP.exe
File opened for modification	C:\windows\SysWOW64\KMM.exe	VRDSI.exe
File opened for modification	C:\windows\SysWOW64\VPSHMSR.exe	MBHXW.exe
File created	C:\windows\SysWOW64\RUYE.exe	VPSHMSR.exe
File created	C:\windows\SysWOW64\EWTKKL.exe	AOMK.exe
File created	C:\windows\SysWOW64\EWTKKL.exe.bat	AOMK.exe
File opened for modification	C:\windows\SysWOW64\HKPXYLN.exe	SPFT.exe
File created	C:\windows\SysWOW64\HKPXYLN.exe.bat	SPFT.exe
File created	C:\windows\SysWOW64\VPSHMSR.exe.bat	MBHXW.exe
File created	C:\windows\SysWOW64\RUYE.exe.bat	VPSHMSR.exe
File opened for modification	C:\windows\SysWOW64\XAFHD.exe	MHCODC.exe
File opened for modification	C:\windows\SysWOW64\SQOUTZ.exe	SNKQNJM.exe
File opened for modification	C:\windows\SysWOW64\VSEVRC.exe	CPAZDMC.exe
File created	C:\windows\SysWOW64\FZRGD.exe.bat	KMM.exe
File created	C:\windows\SysWOW64\OVGIA.exe.bat	UIBZ.exe
File created	C:\windows\SysWOW64\XAFHD.exe	MHCODC.exe
File created	C:\windows\SysWOW64\IVMU.exe	VSEVRC.exe
File opened for modification	C:\windows\SysWOW64\EWTKKL.exe	AOMK.exe
File created	C:\windows\SysWOW64\HKPXYLN.exe	SPFT.exe
File created	C:\windows\SysWOW64\NOAPME.exe	PQPMZYQ.exe
File created	C:\windows\SysWOW64\NOAPME.exe.bat	PQPMZYQ.exe
File opened for modification	C:\windows\SysWOW64\IHF.exe	XOCU.exe
File created	C:\windows\SysWOW64\IURKRKX.exe.bat	TZAGG.exe
File created	C:\windows\SysWOW64\KMM.exe	VRDSI.exe
File opened for modification	C:\windows\SysWOW64\IVMU.exe	VSEVRC.exe
File created	C:\windows\SysWOW64\IVMU.exe.bat	VSEVRC.exe
File created	C:\windows\SysWOW64\YPDA.exe	EUZRCXB.exe
File opened for modification	C:\windows\SysWOW64\FZRGD.exe	KMM.exe
File opened for modification	C:\windows\SysWOW64\OVGIA.exe	UIBZ.exe
File created	C:\windows\SysWOW64\VPSHMSR.exe	MBHXW.exe
File created	C:\windows\SysWOW64\XAFHD.exe.bat	MHCODC.exe
File created	C:\windows\SysWOW64\VSEVRC.exe	CPAZDMC.exe
File created	C:\windows\SysWOW64\YPDA.exe.bat	EUZRCXB.exe
File created	C:\windows\SysWOW64\IHF.exe.bat	XOCU.exe
File created	C:\windows\SysWOW64\VRDSI.exe	JYAZAP.exe
File opened for modification	C:\windows\SysWOW64\YPDA.exe	EUZRCXB.exe
File created	C:\windows\SysWOW64\XOAVBM.exe	EWTKKL.exe
File opened for modification	C:\windows\SysWOW64\IURKRKX.exe	TZAGG.exe
File opened for modification	C:\windows\SysWOW64\VRDSI.exe	JYAZAP.exe
File created	C:\windows\SysWOW64\OVGIA.exe	UIBZ.exe
File opened for modification	C:\windows\SysWOW64\RUYE.exe	VPSHMSR.exe
File created	C:\windows\SysWOW64\SQOUTZ.exe	SNKQNJM.exe
File created	C:\windows\SysWOW64\SQOUTZ.exe.bat	SNKQNJM.exe
File opened for modification	C:\windows\SysWOW64\XOAVBM.exe	EWTKKL.exe
File created	C:\windows\SysWOW64\IURKRKX.exe	TZAGG.exe
File created	C:\windows\SysWOW64\KMM.exe.bat	VRDSI.exe
File created	C:\windows\SysWOW64\FZRGD.exe	KMM.exe
File created	C:\windows\SysWOW64\VSEVRC.exe.bat	CPAZDMC.exe
File created	C:\windows\SysWOW64\XOAVBM.exe.bat	EWTKKL.exe
File opened for modification	C:\windows\SysWOW64\NOAPME.exe	PQPMZYQ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\windows\KMIYL.exe	HWMK.exe
File opened for modification	C:\windows\system\CPAZDMC.exe	QHTR.exe
File created	C:\windows\EUZRCXB.exe	MTXMY.exe
File opened for modification	C:\windows\system\RGUBL.exe	GNZ.exe
File created	C:\windows\system\GCEWLIL.exe.bat	LROY.exe
File created	C:\windows\system\ZNWPNJT.exe	FZRGD.exe
File opened for modification	C:\windows\system\MBHXW.exe	ROD.exe
File created	C:\windows\HWMK.exe	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
File opened for modification	C:\windows\system\CXKIYQ.exe	YPDA.exe
File created	C:\windows\system\GNZ.exe.bat	CXKIYQ.exe
File created	C:\windows\system\HEPJJA.exe	BEHW.exe
File created	C:\windows\REJ.exe	HEPJJA.exe
File opened for modification	C:\windows\REJ.exe	HEPJJA.exe
File opened for modification	C:\windows\system\GCEWLIL.exe	LROY.exe
File opened for modification	C:\windows\system\ZNWPNJT.exe	FZRGD.exe
File created	C:\windows\KMIYL.exe.bat	HWMK.exe
File opened for modification	C:\windows\MTXMY.exe	DLDH.exe
File created	C:\windows\system\RGUBL.exe	GNZ.exe
File created	C:\windows\BPJG.exe.bat	GCEWLIL.exe
File created	C:\windows\system\XCAKDZQ.exe.bat	XOAVBM.exe
File created	C:\windows\XOCU.exe.bat	NOAPME.exe
File created	C:\windows\JYAZAP.exe	BLI.exe
File opened for modification	C:\windows\UIBZ.exe	ZNWPNJT.exe
File created	C:\windows\LROY.exe	REJ.exe
File opened for modification	C:\windows\system\UTN.exe	BPJG.exe
File created	C:\windows\system\UTN.exe.bat	BPJG.exe
File created	C:\windows\SCTP.exe.bat	IURKRKX.exe
File opened for modification	C:\windows\JIKRKJL.exe	OVGIA.exe
File created	C:\windows\system\SNKQNJM.exe	XAFHD.exe
File created	C:\windows\system\SNKQNJM.exe.bat	XAFHD.exe
File created	C:\windows\system\QHTR.exe	KMIYL.exe
File opened for modification	C:\windows\EUZRCXB.exe	MTXMY.exe
File created	C:\windows\system\GNZ.exe	CXKIYQ.exe
File created	C:\windows\system\HEPJJA.exe.bat	BEHW.exe
File opened for modification	C:\windows\LROY.exe	REJ.exe
File created	C:\windows\XOCU.exe	NOAPME.exe
File created	C:\windows\HXDBODI.exe.bat	SCTP.exe
File created	C:\windows\UIBZ.exe	ZNWPNJT.exe
File opened for modification	C:\windows\CQRDH.exe	IVMU.exe
File created	C:\windows\system\GCEWLIL.exe	LROY.exe
File created	C:\windows\system\XCAKDZQ.exe	XOAVBM.exe
File created	C:\windows\SPFT.exe	XCAKDZQ.exe
File created	C:\windows\system\TZAGG.exe.bat	IHF.exe
File created	C:\windows\MHCODC.exe	RUYE.exe
File created	C:\windows\HWMK.exe.bat	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
File created	C:\windows\system\CXKIYQ.exe.bat	YPDA.exe
File opened for modification	C:\windows\SCTP.exe	IURKRKX.exe
File created	C:\windows\system\BLI.exe	HXDBODI.exe
File created	C:\windows\JIKRKJL.exe.bat	OVGIA.exe
File created	C:\windows\KMIYL.exe	HWMK.exe
File created	C:\windows\system\QHTR.exe.bat	KMIYL.exe
File created	C:\windows\system\CPAZDMC.exe	QHTR.exe
File created	C:\windows\system\CXKIYQ.exe	YPDA.exe
File created	C:\windows\system\BEHW.exe	RGUBL.exe
File opened for modification	C:\windows\BPJG.exe	GCEWLIL.exe
File opened for modification	C:\windows\system\XCAKDZQ.exe	XOAVBM.exe
File created	C:\windows\system\MBHXW.exe	ROD.exe
File opened for modification	C:\windows\system\HEPJJA.exe	BEHW.exe
File created	C:\windows\REJ.exe.bat	HEPJJA.exe
File created	C:\windows\SPFT.exe.bat	XCAKDZQ.exe
File opened for modification	C:\windows\XOCU.exe	NOAPME.exe
File opened for modification	C:\windows\JYAZAP.exe	BLI.exe
File opened for modification	C:\windows\ROD.exe	JIKRKJL.exe
File created	C:\windows\system\RGUBL.exe.bat	GNZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 52 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5184	cmd.exe
5368	cmd.exe
5532	cmd.exe
1780	cmd.exe
3356	cmd.exe
2652	cmd.exe
2992	cmd.exe
708	cmd.exe
1048	cmd.exe
3212	cmd.exe
2368	cmd.exe
4880	cmd.exe
3844	cmd.exe
4780	cmd.exe
3812	cmd.exe
2524	cmd.exe
1984	cmd.exe
4664	cmd.exe
2724	cmd.exe
2436	cmd.exe
1816	cmd.exe
5432	cmd.exe
5292	cmd.exe
3848	cmd.exe
2924	cmd.exe
3872	cmd.exe
3548	cmd.exe
4480	cmd.exe
4808	cmd.exe
2388	cmd.exe
1148	cmd.exe
4264	cmd.exe
4400	cmd.exe
1336	cmd.exe
4576	cmd.exe
4876	cmd.exe
4436	cmd.exe
1996	cmd.exe
928	cmd.exe
4656	cmd.exe
6028	cmd.exe
3300	cmd.exe
3108	cmd.exe
2880	cmd.exe
792	cmd.exe
776	cmd.exe
4456	cmd.exe
5020	cmd.exe
4844	cmd.exe
5196	cmd.exe
5064	cmd.exe
1328	cmd.exe

Program crash 53 IoCs

pid	pid_target	Process	procid_target
4572	3704	WerFault.exe	88
1780	3784	WerFault.exe	93
2188	2960	WerFault.exe	99
4540	4320	WerFault.exe	104
5872	4360	WerFault.exe	109
5440	1504	WerFault.exe	114
1196	4700	WerFault.exe	119
5888	5620	WerFault.exe	124
4340	1724	WerFault.exe	129
704	4432	WerFault.exe	134
5300	1944	WerFault.exe	139
52	3780	WerFault.exe	144
1780	4944	WerFault.exe	149
3356	2424	WerFault.exe	154
3240	2516	WerFault.exe	159
2780	4940	WerFault.exe	164
5812	4952	WerFault.exe	169
5708	4596	WerFault.exe	174
2488	4108	WerFault.exe	179
5764	2528	WerFault.exe	184
5192	1056	WerFault.exe	189
4088	1520	WerFault.exe	194
5936	2588	WerFault.exe	199
4248	1036	WerFault.exe	204
3164	5340	WerFault.exe	209
1928	3808	WerFault.exe	214
2444	2448	WerFault.exe	219
5856	2912	WerFault.exe	224
3296	5964	WerFault.exe	229
1240	1940	WerFault.exe	234
3184	1292	WerFault.exe	239
3532	2052	WerFault.exe	244
2696	5396	WerFault.exe	249
5104	6100	WerFault.exe	254
2084	3224	WerFault.exe	259
5680	628	WerFault.exe	264
5640	5388	WerFault.exe	269
5500	3004	WerFault.exe	274
3064	1904	WerFault.exe	279
6128	5996	WerFault.exe	285
5540	2488	WerFault.exe	290
5288	2904	WerFault.exe	295
2464	4140	WerFault.exe	300
2100	1096	WerFault.exe	305
5484	4960	WerFault.exe	310
4956	5492	WerFault.exe	315
1188	3644	WerFault.exe	320
5500	4652	WerFault.exe	325
1456	2356	WerFault.exe	330
4232	5704	WerFault.exe	335
5540	3296	WerFault.exe	340
3616	5476	WerFault.exe	345
52	3028	WerFault.exe	350

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CPAZDMC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEPJJA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LROY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IHF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HWMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IURKRKX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JYAZAP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VRDSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMIYL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YPDA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CXKIYQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEHW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EWTKKL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XOAVBM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RGUBL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCEWLIL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TZAGG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCTP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MTXMY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FZRGD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JIKRKJL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBHXW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GNZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HXDBODI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VPSHMSR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUYE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUZRCXB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XCAKDZQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CQRDH.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3704	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
3704	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
3784	HWMK.exe
3784	HWMK.exe
2960	KMIYL.exe
2960	KMIYL.exe
4320	QHTR.exe
4320	QHTR.exe
4360	CPAZDMC.exe
4360	CPAZDMC.exe
1504	VSEVRC.exe
1504	VSEVRC.exe
4700	IVMU.exe
4700	IVMU.exe
5620	CQRDH.exe
5620	CQRDH.exe
1724	DLDH.exe
1724	DLDH.exe
4432	MTXMY.exe
4432	MTXMY.exe
1944	EUZRCXB.exe
1944	EUZRCXB.exe
3780	YPDA.exe
3780	YPDA.exe
4944	CXKIYQ.exe
4944	CXKIYQ.exe
2424	GNZ.exe
2424	GNZ.exe
2516	RGUBL.exe
2516	RGUBL.exe
4940	BEHW.exe
4940	BEHW.exe
4952	HEPJJA.exe
4952	HEPJJA.exe
4596	REJ.exe
4596	REJ.exe
4108	LROY.exe
4108	LROY.exe
2528	GCEWLIL.exe
2528	GCEWLIL.exe
1056	BPJG.exe
1056	BPJG.exe
1520	UTN.exe
1520	UTN.exe
2588	AOMK.exe
2588	AOMK.exe
1036	EWTKKL.exe
1036	EWTKKL.exe
5340	XOAVBM.exe
5340	XOAVBM.exe
3808	XCAKDZQ.exe
3808	XCAKDZQ.exe
2448	SPFT.exe
2448	SPFT.exe
2912	HKPXYLN.exe
2912	HKPXYLN.exe
5964	PQPMZYQ.exe
5964	PQPMZYQ.exe
1940	NOAPME.exe
1940	NOAPME.exe
1292	XOCU.exe
1292	XOCU.exe
2052	IHF.exe
2052	IHF.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3704	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
3704	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
3784	HWMK.exe
3784	HWMK.exe
2960	KMIYL.exe
2960	KMIYL.exe
4320	QHTR.exe
4320	QHTR.exe
4360	CPAZDMC.exe
4360	CPAZDMC.exe
1504	VSEVRC.exe
1504	VSEVRC.exe
4700	IVMU.exe
4700	IVMU.exe
5620	CQRDH.exe
5620	CQRDH.exe
1724	DLDH.exe
1724	DLDH.exe
4432	MTXMY.exe
4432	MTXMY.exe
1944	EUZRCXB.exe
1944	EUZRCXB.exe
3780	YPDA.exe
3780	YPDA.exe
4944	CXKIYQ.exe
4944	CXKIYQ.exe
2424	GNZ.exe
2424	GNZ.exe
2516	RGUBL.exe
2516	RGUBL.exe
4940	BEHW.exe
4940	BEHW.exe
4952	HEPJJA.exe
4952	HEPJJA.exe
4596	REJ.exe
4596	REJ.exe
4108	LROY.exe
4108	LROY.exe
2528	GCEWLIL.exe
2528	GCEWLIL.exe
1056	BPJG.exe
1056	BPJG.exe
1520	UTN.exe
1520	UTN.exe
2588	AOMK.exe
2588	AOMK.exe
1036	EWTKKL.exe
1036	EWTKKL.exe
5340	XOAVBM.exe
5340	XOAVBM.exe
3808	XCAKDZQ.exe
3808	XCAKDZQ.exe
2448	SPFT.exe
2448	SPFT.exe
2912	HKPXYLN.exe
2912	HKPXYLN.exe
5964	PQPMZYQ.exe
5964	PQPMZYQ.exe
1940	NOAPME.exe
1940	NOAPME.exe
1292	XOCU.exe
1292	XOCU.exe
2052	IHF.exe
2052	IHF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2436	3704	2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe	89
PID 2436 wrote to memory of 3784	2436	cmd.exe	93
PID 3784 wrote to memory of 708	3784	HWMK.exe	95
PID 708 wrote to memory of 2960	708	cmd.exe	99
PID 2960 wrote to memory of 3848	2960	KMIYL.exe	100
PID 3848 wrote to memory of 4320	3848	cmd.exe	104
PID 4320 wrote to memory of 4264	4320	QHTR.exe	105
PID 4264 wrote to memory of 4360	4264	cmd.exe	109
PID 4360 wrote to memory of 4400	4360	CPAZDMC.exe	110
PID 4400 wrote to memory of 1504	4400	cmd.exe	114
PID 1504 wrote to memory of 2924	1504	VSEVRC.exe	115
PID 2924 wrote to memory of 4700	2924	cmd.exe	119
PID 4700 wrote to memory of 1048	4700	IVMU.exe	120
PID 1048 wrote to memory of 5620	1048	cmd.exe	124
PID 5620 wrote to memory of 3872	5620	CQRDH.exe	125
PID 3872 wrote to memory of 1724	3872	cmd.exe	129
PID 1724 wrote to memory of 5368	1724	DLDH.exe	130
PID 5368 wrote to memory of 4432	5368	cmd.exe	134
PID 4432 wrote to memory of 3212	4432	MTXMY.exe	135
PID 3212 wrote to memory of 1944	3212	cmd.exe	139
PID 1944 wrote to memory of 1336	1944	EUZRCXB.exe	140
PID 1336 wrote to memory of 3780	1336	cmd.exe	144
PID 3780 wrote to memory of 3548	3780	YPDA.exe	145
PID 3548 wrote to memory of 4944	3548	cmd.exe	149
PID 4944 wrote to memory of 4480	4944	CXKIYQ.exe	150
PID 4480 wrote to memory of 2424	4480	cmd.exe	154
PID 2424 wrote to memory of 4656	2424	GNZ.exe	155
PID 4656 wrote to memory of 2516	4656	cmd.exe	159
PID 2516 wrote to memory of 6028	2516	RGUBL.exe	160
PID 6028 wrote to memory of 4940	6028	cmd.exe	164
PID 4940 wrote to memory of 4576	4940	BEHW.exe	165
PID 4576 wrote to memory of 4952	4576	cmd.exe	169
PID 4952 wrote to memory of 3300	4952	HEPJJA.exe	170
PID 3300 wrote to memory of 4596	3300	cmd.exe	174
PID 4596 wrote to memory of 4876	4596	REJ.exe	175
PID 4876 wrote to memory of 4108	4876	cmd.exe	179
PID 4108 wrote to memory of 5020	4108	LROY.exe	180
PID 5020 wrote to memory of 2528	5020	cmd.exe	184
PID 2528 wrote to memory of 2368	2528	GCEWLIL.exe	185
PID 2368 wrote to memory of 1056	2368	cmd.exe	189
PID 1056 wrote to memory of 4880	1056	BPJG.exe	190
PID 4880 wrote to memory of 1520	4880	cmd.exe	194
PID 1520 wrote to memory of 3108	1520	UTN.exe	195
PID 3108 wrote to memory of 2588	3108	cmd.exe	199
PID 2588 wrote to memory of 1816	2588	AOMK.exe	200
PID 1816 wrote to memory of 1036	1816	cmd.exe	204
PID 1036 wrote to memory of 4844	1036	EWTKKL.exe	205
PID 4844 wrote to memory of 5340	4844	cmd.exe	209
PID 5340 wrote to memory of 4808	5340	XOAVBM.exe	210
PID 4808 wrote to memory of 3808	4808	cmd.exe	214
PID 3808 wrote to memory of 2388	3808	XCAKDZQ.exe	215
PID 2388 wrote to memory of 2448	2388	cmd.exe	219
PID 2448 wrote to memory of 3844	2448	SPFT.exe	220
PID 3844 wrote to memory of 2912	3844	cmd.exe	224
PID 2912 wrote to memory of 5184	2912	HKPXYLN.exe	225
PID 5184 wrote to memory of 5964	5184	cmd.exe	229
PID 5964 wrote to memory of 5196	5964	PQPMZYQ.exe	230
PID 5196 wrote to memory of 1940	5196	cmd.exe	234
PID 1940 wrote to memory of 4780	1940	NOAPME.exe	235
PID 4780 wrote to memory of 1292	4780	cmd.exe	239
PID 1292 wrote to memory of 1148	1292	XOCU.exe	240
PID 1148 wrote to memory of 2052	1148	cmd.exe	244
PID 2052 wrote to memory of 2880	2052	IHF.exe	245
PID 2880 wrote to memory of 5396	2880	cmd.exe	249

C:\Users\Admin\AppData\Local\Temp\2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_197a3216cdfbfb84da9fe1e356726d21_elex_emotet_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\HWMK.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\windows\HWMK.exe
    C:\windows\HWMK.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\windows\KMIYL.exe
        
        C:\windows\KMIYL.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2960
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\windows\system\QHTR.exe
        
        C:\windows\system\QHTR.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CPAZDMC.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\windows\system\CPAZDMC.exe
        
        C:\windows\system\CPAZDMC.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSEVRC.exe.bat" "
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\windows\SysWOW64\VSEVRC.exe
        
        C:\windows\system32\VSEVRC.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\windows\SysWOW64\IVMU.exe
        
        C:\windows\system32\IVMU.exe
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\windows\CQRDH.exe
        
        C:\windows\CQRDH.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\windows\system\DLDH.exe
        
        C:\windows\system\DLDH.exe
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\windows\MTXMY.exe
        
        C:\windows\MTXMY.exe
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "
        20⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\windows\EUZRCXB.exe
        
        C:\windows\EUZRCXB.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "
        22⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\windows\SysWOW64\YPDA.exe
        
        C:\windows\system32\YPDA.exe
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "
        24⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\windows\system\CXKIYQ.exe
        
        C:\windows\system\CXKIYQ.exe
        25⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\windows\system\GNZ.exe
        
        C:\windows\system\GNZ.exe
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RGUBL.exe.bat" "
        28⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\windows\system\RGUBL.exe
        
        C:\windows\system\RGUBL.exe
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "
        30⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6028
        
        C:\windows\system\BEHW.exe
        
        C:\windows\system\BEHW.exe
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\HEPJJA.exe.bat" "
        32⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\windows\system\HEPJJA.exe
        
        C:\windows\system\HEPJJA.exe
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\windows\REJ.exe
        
        C:\windows\REJ.exe
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\windows\LROY.exe
        
        C:\windows\LROY.exe
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "
        38⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\windows\system\GCEWLIL.exe
        
        C:\windows\system\GCEWLIL.exe
        39⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\BPJG.exe.bat" "
        40⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\windows\BPJG.exe
        
        C:\windows\BPJG.exe
        41⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\UTN.exe.bat" "
        42⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\windows\system\UTN.exe
        
        C:\windows\system\UTN.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "
        44⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\windows\system\AOMK.exe
        
        C:\windows\system\AOMK.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "
        46⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\windows\SysWOW64\EWTKKL.exe
        
        C:\windows\system32\EWTKKL.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "
        48⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\windows\SysWOW64\XOAVBM.exe
        
        C:\windows\system32\XOAVBM.exe
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "
        50⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\windows\system\XCAKDZQ.exe
        
        C:\windows\system\XCAKDZQ.exe
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "
        52⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\windows\SPFT.exe
        
        C:\windows\SPFT.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKPXYLN.exe.bat" "
        54⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\windows\SysWOW64\HKPXYLN.exe
        
        C:\windows\system32\HKPXYLN.exe
        55⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\PQPMZYQ.exe.bat" "
        56⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\windows\system\PQPMZYQ.exe
        
        C:\windows\system\PQPMZYQ.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOAPME.exe.bat" "
        58⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\windows\SysWOW64\NOAPME.exe
        
        C:\windows\system32\NOAPME.exe
        59⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "
        60⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\windows\XOCU.exe
        
        C:\windows\XOCU.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "
        62⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\windows\SysWOW64\IHF.exe
        
        C:\windows\system32\IHF.exe
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\TZAGG.exe.bat" "
        64⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\windows\system\TZAGG.exe
        
        C:\windows\system\TZAGG.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IURKRKX.exe.bat" "
        66⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\windows\SysWOW64\IURKRKX.exe
        
        C:\windows\system32\IURKRKX.exe
        67⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\SCTP.exe.bat" "
        68⤵
        Executes a command shell one-liner
        
        PID:2524
        
        C:\windows\SCTP.exe
        
        C:\windows\SCTP.exe
        69⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\HXDBODI.exe.bat" "
        70⤵
        Executes a command shell one-liner
        
        PID:4436
        
        C:\windows\HXDBODI.exe
        
        C:\windows\HXDBODI.exe
        71⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "
        72⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\windows\system\BLI.exe
        
        C:\windows\system\BLI.exe
        73⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JYAZAP.exe.bat" "
        74⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\windows\JYAZAP.exe
        
        C:\windows\JYAZAP.exe
        75⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRDSI.exe.bat" "
        76⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\windows\SysWOW64\VRDSI.exe
        
        C:\windows\system32\VRDSI.exe
        77⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMM.exe.bat" "
        78⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\windows\SysWOW64\KMM.exe
        
        C:\windows\system32\KMM.exe
        79⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZRGD.exe.bat" "
        80⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\windows\SysWOW64\FZRGD.exe
        
        C:\windows\system32\FZRGD.exe
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZNWPNJT.exe.bat" "
        82⤵
        Executes a command shell one-liner
        
        PID:4456
        
        C:\windows\system\ZNWPNJT.exe
        
        C:\windows\system\ZNWPNJT.exe
        83⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\UIBZ.exe.bat" "
        84⤵
        Executes a command shell one-liner
        
        PID:5532
        
        C:\windows\UIBZ.exe
        
        C:\windows\UIBZ.exe
        85⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVGIA.exe.bat" "
        86⤵
        Executes a command shell one-liner
        
        PID:4664
        
        C:\windows\SysWOW64\OVGIA.exe
        
        C:\windows\system32\OVGIA.exe
        87⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\JIKRKJL.exe.bat" "
        88⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\windows\JIKRKJL.exe
        
        C:\windows\JIKRKJL.exe
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\ROD.exe.bat" "
        90⤵
        Executes a command shell one-liner
        
        PID:3356
        
        C:\windows\ROD.exe
        
        C:\windows\ROD.exe
        91⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\MBHXW.exe.bat" "
        92⤵
        Executes a command shell one-liner
        
        PID:2652
        
        C:\windows\system\MBHXW.exe
        
        C:\windows\system\MBHXW.exe
        93⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPSHMSR.exe.bat" "
        94⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\windows\SysWOW64\VPSHMSR.exe
        
        C:\windows\system32\VPSHMSR.exe
        95⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUYE.exe.bat" "
        96⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\windows\SysWOW64\RUYE.exe
        
        C:\windows\system32\RUYE.exe
        97⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\MHCODC.exe.bat" "
        98⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\windows\MHCODC.exe
        
        C:\windows\MHCODC.exe
        99⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAFHD.exe.bat" "
        100⤵
        Executes a command shell one-liner
        
        PID:5064
        
        C:\windows\SysWOW64\XAFHD.exe
        
        C:\windows\system32\XAFHD.exe
        101⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\SNKQNJM.exe.bat" "
        102⤵
        Executes a command shell one-liner
        
        PID:1328
        
        C:\windows\system\SNKQNJM.exe
        
        C:\windows\system\SNKQNJM.exe
        103⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQOUTZ.exe.bat" "
        104⤵
        Executes a command shell one-liner
        
        PID:2724
        
        C:\windows\SysWOW64\SQOUTZ.exe
        
        C:\windows\system32\SQOUTZ.exe
        105⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 848
        106⤵
        Program crash
        
        PID:52
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 1368
        104⤵
        Program crash
        
        PID:3616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 980
        102⤵
        Program crash
        
        PID:5540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 1368
        100⤵
        Program crash
        
        PID:4232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 980
        98⤵
        Program crash
        
        PID:1456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1000
        96⤵
        Program crash
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1368
        94⤵
        Program crash
        
        PID:1188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 980
        92⤵
        Program crash
        
        PID:4956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1000
        90⤵
        Program crash
        
        PID:5484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1016
        88⤵
        Program crash
        
        PID:2100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 980
        86⤵
        Program crash
        
        PID:2464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 1020
        84⤵
        Program crash
        
        PID:5288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 980
        82⤵
        Program crash
        
        PID:5540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 1016
        80⤵
        Program crash
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 1336
        78⤵
        Program crash
        
        PID:3064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1328
        76⤵
        Program crash
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1324
        74⤵
        Program crash
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 980
        72⤵
        Program crash
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1364
        70⤵
        Program crash
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 1012
        68⤵
        Program crash
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 1012
        66⤵
        Program crash
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1000
        64⤵
        Program crash
        
        PID:3532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 1012
        62⤵
        Program crash
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1016
        60⤵
        Program crash
        
        PID:1240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1020
        58⤵
        Program crash
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1016
        56⤵
        Program crash
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1368
        54⤵
        Program crash
        
        PID:2444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1324
        52⤵
        Program crash
        
        PID:1928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 996
        50⤵
        Program crash
        
        PID:3164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 1368
        48⤵
        Program crash
        
        PID:4248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1020
        46⤵
        Program crash
        
        PID:5936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1016
        44⤵
        Program crash
        
        PID:4088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 980
        42⤵
        Program crash
        
        PID:5192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 980
        40⤵
        Program crash
        
        PID:5764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 1016
        38⤵
        Program crash
        
        PID:2488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 1028
        36⤵
        Program crash
        
        PID:5708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1364
        34⤵
        Program crash
        
        PID:5812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1336
        32⤵
        Program crash
        
        PID:2780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 980
        30⤵
        Program crash
        
        PID:3240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1020
        28⤵
        Program crash
        
        PID:3356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 980
        26⤵
        Program crash
        
        PID:1780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1020
        24⤵
        Program crash
        
        PID:52
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1016
        22⤵
        Program crash
        
        PID:5300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1020
        20⤵
        Program crash
        
        PID:704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1008
        18⤵
        Program crash
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 1020
        16⤵
        Program crash
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1012
        14⤵
        Program crash
        
        PID:1196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 980
        12⤵
        Program crash
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1000
        10⤵
        Program crash
        
        PID:5872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1016
        8⤵
        Program crash
        
        PID:4540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 980
        6⤵
        Program crash
        
        PID:2188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1020
      4⤵
      Program crash
      PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 1328
  2⤵
  - Program crash
  PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3704 -ip 3704
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3784 -ip 3784
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2960 -ip 2960
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4320 -ip 4320
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4360 -ip 4360
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1504 -ip 1504
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4700 -ip 4700
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5620 -ip 5620
1⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 1724 -ip 1724
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4432 -ip 4432
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 1944 -ip 1944
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3780 -ip 3780
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4944 -ip 4944
1⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2424 -ip 2424
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 2516 -ip 2516
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4940 -ip 4940
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4952 -ip 4952
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4596 -ip 4596
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4108 -ip 4108
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2528 -ip 2528
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1056 -ip 1056
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1520 -ip 1520
1⤵
PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 2588 -ip 2588
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1036 -ip 1036
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5340 -ip 5340
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3808 -ip 3808
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2448 -ip 2448
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2912 -ip 2912
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5964 -ip 5964
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1940 -ip 1940
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1292 -ip 1292
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2052 -ip 2052
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 5396 -ip 5396
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6100 -ip 6100
1⤵
PID:360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 3224 -ip 3224
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 628 -ip 628
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5388 -ip 5388
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3004 -ip 3004
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1904 -ip 1904
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5996 -ip 5996
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2488 -ip 2488
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2904 -ip 2904
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4140 -ip 4140
1⤵
PID:52

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1096 -ip 1096
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 4960 -ip 4960
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 5492 -ip 5492
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3644 -ip 3644
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4652 -ip 4652
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2356 -ip 2356
1⤵
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5704 -ip 5704
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3296 -ip 3296
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5476 -ip 5476
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3028 -ip 3028
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BPJG.exe.bat

Path C:\Windows\BPJG.exe.bat
Size 54B
SHA256 9bf9375a50e88c92bdd7e38fc533a6ce8c78ba2410c995beebc416e46c7b9e8d
MD5 6745f49caf5d99f86712dfd15f8f520c
SHA1 75fa56f26dcdd6a8f2e5cf556570270cfae25a22
SHA512 8adb755db585cbe23cb1ffd9f792e860d247d2b5e6b9d021deb04b6d9707835539bf04fbee30fc6bb153006003dda99d55a3f3f1bbb369f1c549f4e74d212351
MD5 SHA1 SHA512

Submit Download

CQRDH.exe.bat

Path C:\Windows\CQRDH.exe.bat
Size 56B
SHA256 0460a6d728ecb51a8a317f2cc3ecc0927760cb0b95105abbc539a6b594ccd9a5
MD5 e7e2fb1bd4008f3ba265c36ee00fbd7f
SHA1 696ec68d78555b6107e632b6eac9632767951709
SHA512 e65f9ab0ead675df6f54a0bff2215a95cbea8df16656c0c0c009330d71982c2c02bd8e1e97a73727f67ed87d612f8e82e63cda4d1eb4ec6c46b71fcb2423e75a
MD5 SHA1 SHA512

Submit Download

EUZRCXB.exe.bat

Path C:\Windows\EUZRCXB.exe.bat
Size 60B
SHA256 81cc06af06f98a6a61460f893d086e5e71f544ceb79225029b1e3cd485c69c60
MD5 73c338226c156214f566da564439dea8
SHA1 2cd022ba4fbe60247fe76b1eeb536bcdb12f96ff
SHA512 0f55e7af4abcbda648982259404dc81e57b78c97dc81df77f7131aed50927cc79852f57f392ad2e2c2c5f7c2cd2c25f445a9d3f114fdc96042e4eaa42f385ef1
MD5 SHA1 SHA512

Submit Download

HWMK.exe.bat

Path C:\Windows\HWMK.exe.bat
Size 54B
SHA256 5a13ed179ea5777f5019eed9f6506744f08a5e0fb1eecf491d6baeedd98630e6
MD5 5bb01de0ca930b253bf997a9827310bf
SHA1 e18fe7be72416026fc922b516fcaba2f176d165b
SHA512 2c9cea50f2a7fc31ea86c32dd175aff0e6930ef0b382242f288bcb70c71b6b9ce61c3479c011b3bc25bea946d3844139cdc25997f89ad964d0cd88c46ad5c672
TLSH
T10190023008E1A2C08826406D434B3788840AF640023C208092152282680444382002B0
MD5 SHA1 SHA512 TLSH

Submit Download

HXDBODI.exe.bat

Path C:\Windows\HXDBODI.exe.bat
Size 60B
SHA256 a15404ad2b0f3abe2f87bdd6a4fc4ecb785aee94f429ad4887d8ab4d6a1f1c7c
MD5 944be6cf65b37f7f650e8d1d02e8941a
SHA1 b8612c1ff257c7485313b4745d16eb6bfd89c922
SHA512 4486c896acec96d33828bbb4b26e62a59139ddd2be33b368f2b5ad30f970656319d28e6469c52ad5234e231e45513c991f2a34f449a0a9545f40bb68669f3d2b
TLSH
T14FA0023008E32AC0882460494B6A3702048AF642021000003A15028272044CB808CEB3
MD5 SHA1 SHA512 TLSH

Submit Download

JIKRKJL.exe.bat

Path C:\Windows\JIKRKJL.exe.bat
Size 60B
SHA256 f39fafe28fff37165d390ef6aaae51a308a6ad7f56fd4c5e19cc0a7037b52ef6
MD5 e961330f66c279b4b11b8399516199d9
SHA1 60e66fe161fca34051fd6ee67d0ef410da875200
SHA512 3181cdeabfd614d47604afbc88349ec303b39a953bbb6a69ace97a2d366ed359640d68b17c811644308a7f8e04252e43666aa3ea2474f56d563413e05a834901
TLSH
T144A002B208C122C08826C84D436A37820E2AFC6002100002BA1F0080608E44BA0800B0
MD5 SHA1 SHA512 TLSH

Submit Download

JYAZAP.exe.bat

Path C:\Windows\JYAZAP.exe.bat
Size 58B
SHA256 6c5622bda0b931202b8ae111313f9a842dc4e49d8db21d5ecb5fb0f1df2a8119
MD5 5d6f56d219bff44e8ae4ce4f28b7e3b4
SHA1 e1268fbb536895a44aa80e8d0c2a04003f7bced1
SHA512 ceb40762a71c893b79c54178fe63834f55f5ffd979ab13eb9274892c32bbf14ec4d9931e04f68977fb2b818c6b684b2390b7ed10b40145dfcbf5fea54714ad95
MD5 SHA1 SHA512

Submit Download

KMIYL.exe

Path C:\Windows\KMIYL.exe
Size 208KB
SHA256 af3de082a5bc87b774467936387638897a6319ca6a94a2b0b5ec80f8d908af8c
MD5 1d9fa259424156720d5ba15607b90def
SHA1 84f01ab487fdeaa0e20162daaed00bf2c848e949
SHA512 c333b0cc164769c588e7c57cbefed4c717469e55da7a3c9e6dad79a11b500bc270f63a10b3111a5b63001388dc546ee398f71f93d5beb54c3e164c3b16fd2b7d
SSDEEP 3072:t6lrAMi+Rk9RyrRawIz8CjD2D0zOksHW2Hv4NLthEjQT6j:glipErRawZOsJQEj1
TLSH
T168249085F9C5C062D267D73849F3A7E809767C22EFED138F32417B2E66B628005A1797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMIYL.exe.bat

Path C:\Windows\KMIYL.exe.bat
Size 56B
SHA256 ddaf66a3c1aec8eea652f6b42241a9a64e84bf83c40f7d94db627735c8ac2f0d
MD5 34761825194d81c86031435b80ddf312
SHA1 06d24d1b229e61c0aaa21489d6fd19afc1b3fbf1
SHA512 87d935bf876b0d4c331c0e40256c4dcb52b4bde0374510d53a511115d9648dc3c4afa9e5e980aaae53175909deac11d58cb00edf0f398ef36fb339f8b927b421
MD5 SHA1 SHA512

Submit Download

LROY.exe.bat

Path C:\Windows\LROY.exe.bat
Size 54B
SHA256 eec80323c1e40cfc09cac30d8d1b4520b5e1b0bae6446efb4e79228e4a61eec5
MD5 3d75a63c3250d263b1c9c88fe673ddb9
SHA1 a249b3db5483bba02f5c81099fa6429bb6e4bad8
SHA512 ef2582483f3a9dd985c2dea3228f298dca6a3d09f8fc5d8a2fdb81ef3f7077762da98c6054104d607f1c99bfc10306c1442ecc7eece1a70916a18988da5ad5c0
MD5 SHA1 SHA512

Submit Download

MHCODC.exe.bat

Path C:\Windows\MHCODC.exe.bat
Size 58B
SHA256 187139d9ba99e270c3da0cbb4a6ccec1877989b7d3911beb7da1b71a6bc781f8
MD5 5dcd6b9dfb7b16398a786261e49e500f
SHA1 39e9a8f208193c95c4e3f8d53fff8e06e7995b6b
SHA512 c35ffad43a91d5a622b74318bb8581dfc1eb2b92d3a8ebc4048d6cf95ddc3a5e5c0e253eb16140419c5041eeb749ef53506d4b84580fcf4a5206f43033e844ca
TLSH
T19CA002B038E328C0883470ED434A3FC2242AFC402212002212152882622466382000B2
MD5 SHA1 SHA512 TLSH

Submit Download

MTXMY.exe.bat

Path C:\Windows\MTXMY.exe.bat
Size 56B
SHA256 898968b2c6200063309eb774e1d5078e50b8c671d86ea1c0bb5a08f2b684a0c3
MD5 d277e857b56e094bd688b92a14fa1fc0
SHA1 f258d861dbf825886f75ff1c407c4c96d7556fc7
SHA512 90fd8de2ab99b4fdbceca8afd40e1bed208a8d6c5788c1b1c026af94f556a098e21cd5d964210aa140eef05bbcdc9b7a9eb58cae33aa16fc20b9910358832f3d
MD5 SHA1 SHA512

Submit Download

REJ.exe.bat

Path C:\Windows\REJ.exe.bat
Size 52B
SHA256 d06352cdb350ef0a4db68c0781c8dfd69c13c77389cb40c6c00002c4b819c1ce
MD5 0f7eab5264ad5ce555092ccf189e172f
SHA1 597cc72823e590199151fdceca4b5e8d51568fe4
SHA512 c932021e34e0a51f617d0a4383a8bab63a7b64b1a781d34cbcef6f8f6c80488dc02e9f6f65acc786b51856c4a2efe3b3dffc05d46fdef4d0caa6d2d177d16d2c
MD5 SHA1 SHA512

Submit Download

ROD.exe.bat

Path C:\Windows\ROD.exe.bat
Size 52B
SHA256 99137d5ef945f0f6a1828ff17b44bcedc1dedc83b87469f2c838f012275451c3
MD5 dd2160d112e497593f1093a0abab4323
SHA1 f035e3fc879de63ada6b38f42e7b8760d8168f0a
SHA512 e96a457a532465911373d9143506aa8d1489a9e644d32080a90bca1e4af832166915bfcae61b296242d614b432eaca64fea3dbc2d202414387b2e3b965ebee86
MD5 SHA1 SHA512

Submit Download

SCTP.exe.bat

Path C:\Windows\SCTP.exe.bat
Size 54B
SHA256 cc038c0532cf5f10bb093e0284c0692603a833497aa549c19f976c6dc271b651
MD5 286358a6b9aa08c8da85a2d6e7c13f8f
SHA1 3c245a9a9088568b53e713a510f4cafac5cd54f9
SHA512 ca9cf5032ecc04b290cb5a34e8483bfe95562f68b9f1afd6b667393a518e4a78f9dd329aea997ff5cf6ea1113fd4aaca252a34e8a4737266982e49ddf58e853a
TLSH
T1B19002F80BC122CA8824606B434B3720C40AF46822300028921502A060044C3C8000B0
MD5 SHA1 SHA512 TLSH

Submit Download

SPFT.exe.bat

Path C:\Windows\SPFT.exe.bat
Size 54B
SHA256 d379a3c40192850b9d9a14aff2f6d958899907856015301826d7e2ff82e603aa
MD5 ad1fba979955ec5e184857a6e1b9d63a
SHA1 eb8f0c7e1eb087ca104fd167e446e92fcdaa6fad
SHA512 41fa86dd9937f07ac5a7c20094c7fd8600620682f5e21611c0e1652893b67d5303b796d48a9059916feef96d614f8c6369ea4d7f5bf265d6b06934434535abd1
MD5 SHA1 SHA512

Submit Download

EWTKKL.exe.bat

Path C:\Windows\SysWOW64\EWTKKL.exe.bat
Size 76B
SHA256 5725d9b78f9356a6dfe65c85a3e7883a5e950ab103c3b662a6a6a967cae68c7f
MD5 354ca8ae7d81d00b5dcdae6b49f1929f
SHA1 cee6b25e9c9b90b70b272c58e9a2eb766c620200
SHA512 6702f28c137e596a98f924d47bd438745bfe5b408301e073ddb2e1f2e499a0d132a2a4679f80f2d87f3d8d0da5f9b2f357678ccc668f131669c1c6b2a954ec9e
TLSH
T110A002300AC120E0A8B4C06FC34A37200CAAF4CAA3B2C020329528C3E0244CBAA28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FZRGD.exe.bat

Path C:\Windows\SysWOW64\FZRGD.exe.bat
Size 74B
SHA256 9425f7b0f611f5abc09a7f33b57f8d2cae180affe3c2e1eda18f4648d87d7ba6
MD5 47f583fbdee008e63416516a6007085e
SHA1 4373be611c25a88edea9153067ff7fb813f7fd9c
SHA512 75907368905b07a882d20446e62909b2ab3743b1215d4f36c645f8edcedd3e3ff60ca549296d6d8c7cd0b6dc7b74b384f7f4323f6b17bc4273442823fe6b99fa
TLSH
T1DCA002300AC1B8F08C24406DC34A372804AAFC6E039020B0339520C2E324C4F8B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

HKPXYLN.exe.bat

Path C:\Windows\SysWOW64\HKPXYLN.exe.bat
Size 78B
SHA256 b5ec8af80d6451f88a3b127d8aae0226bff55c56cf8157eded0982c029410690
MD5 8fb88e5c2e10b48e6f8b7c78402d67d3
SHA1 158635afe6e6328b0ba8fd24def5891e3eaa9999
SHA512 b5317e84cf0c0ca41408272885d587f94814395c33c16327c4b346a87432904118d33ac14c840f9a2a5f16170c1ffb13e15e7970d888b003bb9e475cc84e9eaf
TLSH
T18EA002B00EC130E8EC36486DEB4B37A0042FFE4A039A0820929528C2E006C4B8A32CBC
MD5 SHA1 SHA512 TLSH

Submit Download

IHF.exe.bat

Path C:\Windows\SysWOW64\IHF.exe.bat
Size 70B
SHA256 5ca1086bf5248cb158a96b6ce8f583b059202c8abda1aadb4fe5230e70b61f8d
MD5 97c465252284552f71d9169c61ebc205
SHA1 0fa5b7b6c6f9ea874aaacc079bbbd3fecdf3d20d
SHA512 eec53d1a322583c44bb35bf994ca54e7e6daa155dd0f3540ecd4a0ae32946c7dce69860c358d96e8e6c9afd9b7671961935ae4062dd9e7a5ec6320a53fde0c3e
TLSH
T134A002300AC130E0A824C06DE34A3722842AF44B03D2002812F728C2E00444B8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IURKRKX.exe.bat

Path C:\Windows\SysWOW64\IURKRKX.exe.bat
Size 78B
SHA256 7700ebfb8c1b83e219fef3f7dd6a640d876785b091ef373caad7111d83670bc2
MD5 c610fa827097f006907c54db755054fb
SHA1 3b340d97508c531872de7e08c2756aed161495ec
SHA512 6bcb1821929ae14fd940d70e918e9b122f2a562a9107a92daa1fb6e5953ac431772abadf98b10f4af83d9e15f5c154a91148bc9ce6539c9f2405a8638f1bbe0a
TLSH
T1C1A0043405C150F04C5D445DC34D77114415F4C5133140F4715714C1D4044474D10C7C
MD5 SHA1 SHA512 TLSH

Submit Download

IVMU.exe.bat

Path C:\Windows\SysWOW64\IVMU.exe.bat
Size 72B
SHA256 763e1591bfbfb967225d95f180b0063465e677ef7a050be378e6789c4cb656d5
MD5 8a78eeaf39950d64eac6ca506688e8bc
SHA1 8343f00c1fe5d7d2dda49fc580bfae23da70957b
SHA512 524692fe1eb9b9bb4caa77b396b36ea5b1adf28b06dbe23e75cd632002c6e96f6fc84e1900e0f4f5f438bfab0717753e0f74c76104ac704ed112ee0aee2de536
TLSH
T103A002302AC320E0883440EDC34AB720043AF4CB0318002012B528C2E004C4BCA22EF8
MD5 SHA1 SHA512 TLSH

Submit Download

KMM.exe.bat

Path C:\Windows\SysWOW64\KMM.exe.bat
Size 70B
SHA256 319bda331031bc57f49dc6abfc592f56dc65ea8b41373af7271334294ab7d468
MD5 12c1db4103544ab04db638bfba274857
SHA1 1018ca1d3f3e83444edabbb499e9ebfb3a061aa8
SHA512 87af314c8f29cf6916bbae1f7d3210f8beb86c9754fc9fd49a3e7d8d5353cbfff5fa05fef199d20eb82a781f152b2bb3f8852b3791475f12dadbbf8bd87f0d2c
TLSH
T1F9A002300AC120F08824406DE34A37202C3AF44A83180020129528C2E00C44F8AA0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

NOAPME.exe.bat

Path C:\Windows\SysWOW64\NOAPME.exe.bat
Size 76B
SHA256 b07cc394984120367ccc0071125604b9e5974f480d28d1f059a22362532489d4
MD5 2c61e96f56c9acff901632c8ea3ebc77
SHA1 d15bd96917bb5f8855a6a777a16051110bf6ff48
SHA512 b777676bc1325e1940a188024afc6777589ef9da6cb488464a7c1020cbf9aed526899f6fc0fe56b429a4a00bc581b5a4ef51c4173135fa1c5e1a225fd47b95af
TLSH
T188A002300FC328F0883C406DC36A3F20243AF64B033A8820129D22C2E88444FCBB8EBC
MD5 SHA1 SHA512 TLSH

Submit Download

OVGIA.exe.bat

Path C:\Windows\SysWOW64\OVGIA.exe.bat
Size 74B
SHA256 4516029ce1112b5bd5249939722614b3282a31ea833957d1d9ff4e9c87b61d98
MD5 13953bfbef243d8acec80d9830aafb13
SHA1 24e24b8cc0b0ab4bb9ac99df7f7b1fc955fa6950
SHA512 e4684579802cfd26c335435fd84f3ae28f023c69936f30ab9215c7949f1dfca7e995f1243d2a5c3f8117dd6c038c22ea042e46322845641f164a85b6253e3fc0
TLSH
T131A002300AE320E08AA4C06FC34A37B80C2AF44A83900020129D20C3E8A4C4FAA32CB8
MD5 SHA1 SHA512 TLSH

Submit Download

RUYE.exe.bat

Path C:\Windows\SysWOW64\RUYE.exe.bat
Size 72B
SHA256 240bd82c78e01ae8af40047e15df91493425bc0b97a1a6881a14f2a5b1adcfc0
MD5 8af35831a038ba03eb14a9de1cbf325f
SHA1 e2663c930b7717f5c5171f9d3e8cdf086b193c6c
SHA512 f8d3f1e46933eff922ca5358b77b460baf3faa5f4452bae4acda0806107db1e4ba69d0574d70764c485e7de9d39d328b7cab3aff27d126dd7483cf11fc1d26de
TLSH
T17BA00230CAC320F28834406DC34A3730242AF44A231382209A95E8E2E00446B8E20EF8
MD5 SHA1 SHA512 TLSH

Submit Download

SQOUTZ.exe.bat

Path C:\Windows\SysWOW64\SQOUTZ.exe.bat
Size 76B
SHA256 ec91c988ac178ef1f63b4a03d478d3eb04b74dc7d7c715befaa3261702a84090
MD5 424c3f3693389769e036e3ee99113ea2
SHA1 b1bc81ab1ecb446d2b3e8cba25be7d47e9e9d502
SHA512 21bb941b4ea751c8ce60c166497db4d90300401eb04b194cc4eac863ff97e509d0bbd516004084fc2b414a4774df57a9339d32f3173fdf433abbd10c1181732a
TLSH
T134A00232CBC332E28C2C606FCBCEB720042EF44A03102028129522C3E00464B8E20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

VPSHMSR.exe.bat

Path C:\Windows\SysWOW64\VPSHMSR.exe.bat
Size 78B
SHA256 2fd6c7fe75b84e3ffe8b0d30e2ab9f73b1854151ed5693e5d907e597c9356864
MD5 c0db65be3439156ae034ddfed2c09f8a
SHA1 c814c2a4e9e94a932c40d26fe93610a8d3096b84
SHA512 50334a90b44e4b335555e8342c8a030fbba31333252355d43849927dc371370a4fba81bddfcce76d60e7564842ecd533c1727cf4ed5233309d6577307ceaff29
TLSH
T1C1A002300AC120F8882440EFC34A3720062EF44A033000A013D520C2E08E44F8B30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

VRDSI.exe.bat

Path C:\Windows\SysWOW64\VRDSI.exe.bat
Size 74B
SHA256 70fd591653f4dd438d1bfa81bc301e678cd989b32a154169b3530fdb40cc256f
MD5 bbc0d8a22fdc8aab1bb7e786fdb97e9c
SHA1 870b8626951cf219353884ac02a441b0975adaed
SHA512 1329ad677acbd91a5ae250715f513b04a51dd1fe11d74dd2c3985c3413df3f9a26d43b038262f9a119b4743b1eb6ef4cb52b4cee09a47fc1db15c6901f7b0374
TLSH
T116A002300EC120E88824406FCB6A3F2224BEF4EA23100020139DA0C2E00644F8A20EB8
MD5 SHA1 SHA512 TLSH

Submit Download

VSEVRC.exe.bat

Path C:\Windows\SysWOW64\VSEVRC.exe.bat
Size 76B
SHA256 b9c0174a19ca33c5c82b1f6b85899279e42816821ec157abfb7c6c8a6963c1c0
MD5 2ac97434a820c18fb19d7752da6f5ad8
SHA1 81da943d04d214b34a1d2d8a6fd8ba43774ec434
SHA512 9928543b270abca81cbf627717421d8ba138101c2e6ae931928a1ea6f57fa1ffd224f1e4919dfc52c029127abd6529d1cb01df753c46a43fd353c746619e5b73
TLSH
T114A002302AC120E0C824626FC34E37A004AAFC4B0B900320339528C2E80644B8A22CBC
MD5 SHA1 SHA512 TLSH

Submit Download

XAFHD.exe.bat

Path C:\Windows\SysWOW64\XAFHD.exe.bat
Size 74B
SHA256 19fa1119e5138c7c3b1d67da7afd2c5a6a083765f5de411188c9f51c75c53d93
MD5 57f21332c63e6d401af35d8702528ab5
SHA1 47fa22e19299fa69a218127932b9eb0643cb7bf5
SHA512 f505490eed06d7e5028d8ada08f992254f930c5c8f8ae0f593fcfecdcd7061ed5b942b10530264c3ee30ee90cc31e918506058972aec6cdda4ed8e3d76e664a3
TLSH
T129A002320AC1A2E38824406DC3CE37A2043BFC4A03900232129520C2E8044CBCB22CF8
MD5 SHA1 SHA512 TLSH

Submit Download

XOAVBM.exe.bat

Path C:\Windows\SysWOW64\XOAVBM.exe.bat
Size 76B
SHA256 76b28c47ce6288efe29861eb41800aa9101a2915323834e96f27f24ad3b60cd4
MD5 57f5d0f25b98fd3808d05124c5d7a891
SHA1 42ba7d344956b74102eed91592ce8716368fcf39
SHA512 400aca8b2043c1289795128f55245a40f03099ced101ce77efc8d6fec1769a8aad48123013c5b45feb0f7ed4a271ea0f26a954d28b439ee961f261951fe00c11
TLSH
T1A5A002300BC3A0E08826607DE3CE3FA804AAF64E23100020329520C2E0346CF8A30CF8
MD5 SHA1 SHA512 TLSH

Submit Download

YPDA.exe.bat

Path C:\Windows\SysWOW64\YPDA.exe.bat
Size 72B
SHA256 da0ba9ab846dbe027e5439e1f18cf0b07025cdb211d2648b20611f0242a4a40b
MD5 e1480bbd490547fc4302951d4d3a7b85
SHA1 a13d82829ddaff0f10eaed599738b78c80c46d0c
SHA512 bb132560dcbc25c0aa04fd94ab95b05a4501f86562814cc8a90acc8025ff1a6e4736719d15b2f0b6b0363582409b57424916cdaa21468e0bf3a13b8516cc9f85
TLSH
T1F9A002B00EC128F08826406FC34A37200C2AF44A8B300022129D28C2E00444F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

AOMK.exe.bat

Path C:\Windows\System\AOMK.exe.bat
Size 68B
SHA256 afd5d0add27bf7604acac11ce58a003e6e5b03881abba358929b7f47448b367c
MD5 6710faa2d7ebf9c6ecef94f8f8c71d42
SHA1 1984ff1f4c4684bd071d78e1f80bd188673b00c4
SHA512 165bc6997ca033991439853e29280deafb67f8c09ff6b7ea8c76045533364c1595954065f7d26fcb1e03b85b1fd578c8bafcff5b9c0732527155329861342b83
TLSH
T1EEA002302EC3A2E28834407D434A3788042AFC42031C0828929D0082E004473AB208B8
MD5 SHA1 SHA512 TLSH

Submit Download

BEHW.exe.bat

Path C:\Windows\System\BEHW.exe.bat
Size 68B
SHA256 2161efd904c6dfc29ca5b8d30dfb63336740f4a16c96e51d14e130ab9f1bc600
MD5 f22c7afc3b067ea23e40a1884a4f403c
SHA1 3d32028d8a1775adc3b3b3b59f5b876c7c50a4cc
SHA512 c539a8d9279c830a6f8b5dce2cc4f229f62df2681a1114501a9ebb4fc180e36829da45de094c7b4894efa5e26b18102c5e8b8af1939cd699e72a5d75dd4c3d89
TLSH
T182A002300EC920E2A82C406D434A3700042AF442839000201ADD00B2E0044738B20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

BLI.exe.bat

Path C:\Windows\System\BLI.exe.bat
Size 66B
SHA256 dbe1823f099b4fedc9c66b34e9928a37e88e121044614b54c5b115ab470c159c
MD5 78dc62fff53d185545b5e05a9485c5b2
SHA1 ed4bcb1e54253d6c0e2fee83b5eba8f72d4c53ab
SHA512 fa5b1dce4c7989405d72a4acc514c0fac3786d978c88cf4d6f4aa97a16b8a7d14b76ea98cdc59ac141a02f20b8d7db2f0cb6c5367ead14f5ab9bbd9071d9f5fe
TLSH
T140A00230CEC120F28A24406D6B4A370004AAF443039000201AD500C2E0044638E22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CPAZDMC.exe.bat

Path C:\Windows\System\CPAZDMC.exe.bat
Size 74B
SHA256 65c19383b8c795ace1c462d08a81ef8e44819c148e7ce52e0979b9dbd1e7ef36
MD5 81280523c9781df850b6efb58df086f7
SHA1 5b8928e3c86821419bee1202553a94d99201b12f
SHA512 a8f7c07a083c2472ee6407e509ac3cb38cdd2585d88cfba1e0fd863ab1a0d1017fab77f29b19cf24a8d1eb6e56559be41332e6fac94e4808220b52a73ae989e8
TLSH
T1F2A00230AEF1A0EAA824706D43EA3F02042FFC42033808201A9520C2E0844638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CXKIYQ.exe.bat

Path C:\Windows\System\CXKIYQ.exe.bat
Size 72B
SHA256 55b3a5aab48c547cd9df63cc2cbbbfd2857ee279d67dcd26400a3736ccaab0fd
MD5 78bf151c63ab3bca53a11f11e866039a
SHA1 2927023d45bb097d962c599bc8555d8ccd9174f1
SHA512 0a1aa328df76f9d6ef2a1d833af630802ac406b2a2c73b4339f62d6e63c55d193c477699a890e731c98cbb7122f7cc66633649f6a42fbeccaebb827895d55137
TLSH
T199A002380EC130EA882C606DEB4B3F08263EF442031000201A9700CAF0074638A22AB8
MD5 SHA1 SHA512 TLSH

Submit Download

DLDH.exe.bat

Path C:\Windows\System\DLDH.exe.bat
Size 68B
SHA256 5680e162a7d84e8445ac1ce861f12f50766a7cd30a0fc522c427a7ae3b371564
MD5 8067d5d08eb98008a521acb004d8e2db
SHA1 2c9c568fbe977634fccc0dcc172df632da054f7c
SHA512 3cdc48ddb1e15a7afec41568fa9d7e0a06fd365a21886442630231fda748423f225f4b30359d60723c6d6f7e665fd819911af0956b574610a171b699c67be7a7
TLSH
T121A002300EE128EA8A3C406DC34A3720042AF443033000B01FD50082E2864738AA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

GCEWLIL.exe.bat

Path C:\Windows\System\GCEWLIL.exe.bat
Size 74B
SHA256 f5f0a5da7f7478f89a0a7e2abe21b086c7cc6b6c9948399341471e53b318fe90
MD5 516e78234c6b9a89b84d1a98c4663bbf
SHA1 2e38f67dda2e448dcb91a3c21158c6a988831718
SHA512 49b57e9b861c32e220dfd5c24787253d58656572b3de9f3170e4a9ad8125df6bdcb766560d1e7b0fbd840a3e9f36a2d413cec9dffa495189165818b0f6abb92b
TLSH
T1A4A002300EC130E28824C06D6B4A3700042BF4428318002A129500C3E204473CAB0CBC
MD5 SHA1 SHA512 TLSH

Submit Download

GNZ.exe.bat

Path C:\Windows\System\GNZ.exe.bat
Size 66B
SHA256 95680dfddcb33752fe9f736ed5796fa0f2ae79d60c93f515b61370dd8757d128
MD5 c3c4ba8b743a16570707ba6d66222986
SHA1 ec414de5ce9a3219d7e7eace305935cd3976f01f
SHA512 24794817876ec4d0ecad03c32224224f7ec896e6975c388a5642ded0e3687fcd758de842f0aa7145ff1055c3c0f10206fdcba197cf36845e22e42429e8705c1d
TLSH
T1E9A002320FC320E28824406D634A3700042BF462231000201B950082E086C638A208F8
MD5 SHA1 SHA512 TLSH

Submit Download

HEPJJA.exe.bat

Path C:\Windows\System\HEPJJA.exe.bat
Size 72B
SHA256 fae3120a74b7a018d5c98d2ac41a77f5210caeac45dffcf1449e116c6600e807
MD5 22fd31c6c188b336c381fe41b75115b3
SHA1 6712ce321d1f7694c4c92d837b01046b8695e453
SHA512 eea7f3c0f258dd8bb166f9f669de30c8f42c012858e23c73e1171864af5f64d12a53d6575d736983aa0a5e26dcb50cbd669d6e192f79891c50c80ed0b2cc4a1c
TLSH
T166A001200EB920B2A82440AE424F26000A2EF843331028201BDE0082A006863AE20EBC
MD5 SHA1 SHA512 TLSH

Submit Download

MBHXW.exe.bat

Path C:\Windows\System\MBHXW.exe.bat
Size 70B
SHA256 c2190a6dd4523f3ed41a0d7e34917f72df404ae2a8e8dd50ab81243281c71cad
MD5 358dd38f4e06527eb0eb454cd44bbba2
SHA1 03cd2d3d07a1fde4421bd4aa04cb58def684390e
SHA512 22f7ff22fd051f605cebeb31f52cb7f18b074bac40ce015a1b8dfe4af7d5b8d71cf82dc6c3e82e8c1e03934d553947c9995c63adcb5b0387ebe79dc5ab87b80b
TLSH
T1D9A00230AEC120EA8824406D434F3700842AF4420310002812D500A2E8044F38EA88B8
MD5 SHA1 SHA512 TLSH

Submit Download

PQPMZYQ.exe.bat

Path C:\Windows\System\PQPMZYQ.exe.bat
Size 74B
SHA256 a7d3170dd69f770ab5f9feb1e3ccb1d20d64add8a0f84638541106b81bef63ec
MD5 1f6e27ce1115588613360305604d9ca9
SHA1 3ebfdc44febf10305e42d0a5f82c5d0450a34007
SHA512 8fbb4b48f25dd71b323fe5fdefd9c6a33ca0c94321f74dfaa0ddc07d1d6c6a55845452ebbfd1402115addade669d6f8a27c9756723a1e9d6e860cd8230872fb5
TLSH
T128A002380EC1A0E2EE24607DC34B3F00A42EF442031000E01A9500CEF2064638A20CBE
MD5 SHA1 SHA512 TLSH

Submit Download

QHTR.exe.bat

Path C:\Windows\System\QHTR.exe.bat
Size 68B
SHA256 fbed17ee38ba95b6356be1e342d847aa8f1c60cc649384b421eeb93601abae2f
MD5 18d1561b1608d251be71913c17d468b4
SHA1 c23ea7178dbbf2fd209f543db21c48279fd7c469
SHA512 0c0215f90cdca94e05085c7a918ff6d567eff9bd68677cafc38e0916e433e6bca1547c14d7fcb5160b709dc753a0e86ae31db05c1d02efc80d67737a03727bfb
TLSH
T15AA002320FC332E3A824487D634A3700042AF4622B1C00201A9D0282E20446B8A308B8
MD5 SHA1 SHA512 TLSH

Submit Download

RGUBL.exe.bat

Path C:\Windows\System\RGUBL.exe.bat
Size 70B
SHA256 43021e5e27fb15d195c0bfb5791f20ad269350ffd91b3b9af307129d38db1348
MD5 55d734239f9dbec2fee37dff10663083
SHA1 4d4308ea43877bc75a2c59165f10c49c872ba6ab
SHA512 7bdc0d97bc69e53851e7df793be1a69a2cce0e957c5b262622a5734e0277fc803960fae5ac73d766070b21bdd91ecb097e01fd275937ed5a1f3627f26ab97ff3
TLSH
T1C5A002308EC9A0F2A824C0ED43CF3722C42AF46203120030139500C2E0044638A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

SNKQNJM.exe.bat

Path C:\Windows\System\SNKQNJM.exe.bat
Size 74B
SHA256 dde088f94b6cb9778c1c29d81d56ac52cbeee09a02160fed621eec4b75e3d321
MD5 7d15404ad5392d96a7190e9108bb666b
SHA1 e73cfea5d4d1a512d51fc03289aef35480799b24
SHA512 7be8ff1ebef5fea857b846dbe6d049d90340bf34f30a49a5c8232824d88ac50cf4f94d670bcd43058addeae341efc24d8a0e87b0b9d53089f76f876b3172b7ec
TLSH
T12DA004301DD110D15454445D43453F001C15FC4513304C3415754451D004C7FC514474
MD5 SHA1 SHA512 TLSH

Submit Download

TZAGG.exe.bat

Path C:\Windows\System\TZAGG.exe.bat
Size 70B
SHA256 770b26a4c6120370ccb066d886b0fee0aa38303a995bc67939dc56418284e3f5
MD5 8147768055472de27cc4e4689c4a8712
SHA1 7e471478bdf0400cd2823521e36960643df08eb6
SHA512 835177d3099dd47e4f46f87854f22177a97de1534265daed270098de99624966266cce224be46630e36cdcf14380be3549958ccfb8bb9e7b5612ec776a86906c
TLSH
T1E0A002300EC920E28C24406D436A370204AAF4420312082013D50883F80446B8E28ABC
MD5 SHA1 SHA512 TLSH

Submit Download

UTN.exe.bat

Path C:\Windows\System\UTN.exe.bat
Size 66B
SHA256 4d0fc12ac9c0f74ce17df5c0bb81efe6924631e1f0ee96961455e9a980e481e0
MD5 364fe0aee49aa7c498dff261517d4698
SHA1 b509d89d0ea43495c52b849aa05d798dc860d6c2
SHA512 b1c165ce15988b92dcb2030966d0c8f05005034d0aa8e51b5d01c7fbd41a2e7be903c27fa9c78989d3042ea6f444a95ade800682d5268187c0fe08e06c44d8fc
TLSH
T14DA002308FC322F28824406D434A3700342EF442039028209295088AE0044638EA08B8
MD5 SHA1 SHA512 TLSH

Submit Download

XCAKDZQ.exe.bat

Path C:\Windows\System\XCAKDZQ.exe.bat
Size 74B
SHA256 657c423f1fb804fdf5b8d0948e35ccfa2605fa1be46f376eede6d9327967f359
MD5 51f283d351c9bfa7f18697f3b7dfb022
SHA1 2cc441303bbe4357ea13acc83ad0d32c5a0fbebf
SHA512 47ccc584bc506a836df4ca28c9afaad26c8ff61c2ba56ddde56541ba4474f7ebf7de9abd4af14915a2f706c9bff7c41f39aa494adad9e19cb318c1ebc6f0615c
TLSH
T1EDA002328EC120E2C8A4427DC34A3700242EF442031008321A9720CBF2AC66BCAA08BA
MD5 SHA1 SHA512 TLSH

Submit Download

ZNWPNJT.exe.bat

Path C:\Windows\System\ZNWPNJT.exe.bat
Size 74B
SHA256 acd9df54c9999981dc976fd4c946dd1dae18fbb40fc117a7ecc3fac8766ac62a
MD5 9b6432482fb7b0b5d72503eb015b8911
SHA1 69fa791b8f6be782703ef1ff5e253e675888c15e
SHA512 044e3d83222f4b237a542d140ed984cb99677b234a992a3326f8d876266c890ed0953595fabb6597ed45cc967229a7e354216e87ca964e11844294503c8a1652
TLSH
T1E8A002302EC320E288AC4C6DC34A3782062BFC42231202301A9780ABE804C63BA208BC
MD5 SHA1 SHA512 TLSH

Submit Download

UIBZ.exe.bat

Path C:\Windows\UIBZ.exe.bat
Size 54B
SHA256 c50c586bc916a323988a962cda6ffea74c6244d5694391e08e53ceab68bad09a
MD5 d073095f6b53ef118acd738b085b03d4
SHA1 1d2e5d91f4ccf429040395fd9468670c0c0a8e5c
SHA512 ece1cc4f93de0e4632ce6ec586b0d7f6a678dc5df7a6386fd1717deb4090fbba472a29f238a44b5c79c4c2264b434b2d455c54ae4d5c79ddb8ef4d36254095ec
MD5 SHA1 SHA512

Submit Download

XOCU.exe.bat

Path C:\Windows\XOCU.exe.bat
Size 54B
SHA256 caaee3635d2864fc838783d823361046db28b5db95cc4f3ed349d756536e9986
MD5 dd42b7237cc36a8e39ab4140040f6ae7
SHA1 ca483f5ee08b046e6a170eaea33b5165a5baad79
SHA512 27a4bdaa0334ef9cebf20e887d8bf1ce1a6e0880bc673f63a8abd30ec7abcce65bea33407019d092c2860ccbfd1a019029ed6b0b444676490ac3f4194564a9c2
MD5 SHA1 SHA512

Submit Download

BPJG.exe

Path C:\windows\BPJG.exe
Size 208KB
SHA256 f7b60cc814e1694fdca28be772d8dcd1713d70031f6d1b6efb686c8a6654c6b9
MD5 cc9ade6138ae148ee54cc8af7af64650
SHA1 9e202305c58e1bbffda073bedab2d6341504554a
SHA512 a6040f2e11894c6d8131c3647e8e54006a506907b751dc8b7354e541f0595abbdc30364ddb86360f1d15bec2b6eed7c17ea5c44e9f730c982d951a7b5a801ddf
SSDEEP 3072:H2sCFaPnTi2CsT5ob6iQ7wM69PajOYQ4NLthEjQT6j:WunTi2Csob6imU9QEj1
TLSH
T19E247D4177C88352D27F49704CE695B829B9BC46DFA3C63BA900331E9CF651C4BA77A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CQRDH.exe

Path C:\windows\CQRDH.exe
Size 208KB
SHA256 9a15b6540953012754768f4ed554e5fe9e8a66f6a847f9f27102613432d3ada5
MD5 d8dac8a8c8958c00898b036c4c8de24b
SHA1 8a50051165c0bd22c70faec1c945af408bb6fb28
SHA512 e4f3934086d864d600ab288ce726dbfcb3bb6f82aef70d07673433d235faf68df164011c209dddadc730bba1d6262aa8642aca7a82d1de5a933c1b60be99897e
SSDEEP 3072:pgbWa2z6qZn052zblF3EFNQHEp488egz5iO9K4NLthEjQT6j:pgbWXns2zbrU0w4t5NKQEj1
TLSH
T14B248C05B9A9D943E3AA473DC8D866591B90FE219F63C27BB8C67F0F8C71B004950B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EUZRCXB.exe

Path C:\windows\EUZRCXB.exe
Size 208KB
SHA256 1038b26c92b37a62c1befd9b7c0642ad7c1c65655ad24bb2b660ff1dc5631b36
MD5 7dfd1d7e637766d22211a6afb2917414
SHA1 76c3c4152e7f20ae5cbdfbaca755c81caec88d27
SHA512 9148d752f2f83b74d307fa5c16f8c5473837b79bd2771028bba8c5a36e0741cdfd167a82ca3616d63cab91cc8ceb971c208aa74078fcebdf4418056b3db7562a
SSDEEP 3072:0rQpTsf7MyIYyRFiAo9ls8n2wHrT1vDz8MKOh1bm4NLthEjQT6j:0rcsf7MyIYyLiAo9FLpHKOhJmQEj1
TLSH
T1CC24AE03798DD916F59727749CE34BA0ADBEFC02AFF1822F294C735E9CB62464851B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HWMK.exe

Path C:\windows\HWMK.exe
Size 208KB
SHA256 06ab255ae8a1b5bad2a6d20234069872956ddba619297de8c36b802fe6084c8b
MD5 1e9ab6d37afdb285629ed4d739e85c0c
SHA1 a292551e2f7257cb1abcc0011c2415c2d06d9239
SHA512 c6aad429b9684a36cd75b4f44ebc100b4d3c172aa5e9c103604c95d63e3b10ff32a59fe8436110245fafa0fff33723a084a324be5b9cf229d163d8186b548787
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfj4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LObQEj1
TLSH
T1A7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LROY.exe

Path C:\windows\LROY.exe
Size 208KB
SHA256 a00cc5aa0a04d17fd2e6521fe53135991ca4a0387b124d8ac32751668b5d96a7
MD5 1066fe76c44882dc0f7dc7a396e5b67a
SHA1 59c2fb10ff3b093e1f6635a82bf66aeb77a0e3ec
SHA512 d8bc65a923a31b61708661b73f32d8a784a7145d4d27c5449a7994d703355048a501db40984beb1f973b31828cd9009eaf81f59a71b6cfe0c3fa9770abfcdb66
SSDEEP 3072:k7g2Smcgd9biSia1F1k4QIk9Vq7jqt2XWdJVAA7u9A4NLthEjQT6j:NPmTvbxF1k4QIkb3deuQEj1
TLSH
T1A2248E107A758597E26303F10AEF6AE8295EBC1EAF26133B7264733F58313A58C54B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTXMY.exe

Path C:\windows\MTXMY.exe
Size 208KB
SHA256 ba7e71e8d5673cf95f97c1b850a13da5954fe4fcdc46bb30f86f23a3f74afd90
MD5 e3a17983fd0b6a96397a91b989971b30
SHA1 443fc29d2b3f2b49de9e608a74710a0154f768ec
SHA512 9d754011b4d5fccce47f4c9fcf34286ec3b3dd72abf440ae6ff1f2424099a4f27405b5d7063c14fbd8aee3b6d96dfc09a233d6df9652a658851117bab2304983
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfm4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO+QEj1
TLSH
T1F8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IVMU.exe

Path C:\windows\SysWOW64\IVMU.exe
Size 208KB
SHA256 217c965e450ba7d14af6c763252f0dd008d63bc4bd2b7545ca0d315415e5d492
MD5 799476a2b253ca82ec706b70ca8195d1
SHA1 1e9912e4a063122aeb8e8c2b39c40f868a173b29
SHA512 c90a5c89e5bd9876db43a2d3469b946c23a36d765af2f535d8ecde4c2a1d006d383ae5661db1664644d0ada3cc12fba1e40d9da7a1bf87c818ff57b71f823d70
SSDEEP 6144:/jZ6tXJdIZMI6OmbFfZJMw3cKBHWKIMnswHQEj1:7Z6tsZMI6Om5rMw3coHWOnswHQC
TLSH
T12C247D07BFA6C911C6D72B3942F39A945E62FD629BE3C53B3440335E28326408F57766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSEVRC.exe

Path C:\windows\SysWOW64\VSEVRC.exe
Size 208KB
SHA256 e3464438cfeb7b19c554c7086a9cb0240a5b747eda0def396e7878f07e8c5059
MD5 d94a6daa71ff434595cfa28ff41020e0
SHA1 633cc5d90b1966bcfc413567cbe4a4c70a5b3ea7
SHA512 2348cd586460c59583263ba64f27469f1b99009e535ab506d7b02a2f52fd8314f2fb72e2f92fdc4e59e094800a5b60eb452a38ef4b262f3eb91d81dcb16ca57e
SSDEEP 6144:D+fzykuwl09LpsT1xOkoKrr1lE3pE4QEj1:D+fzFy1psBxOkoE0rQC
TLSH
T1C424AF0E322DCB4BD0A71B3455C5BBBE5BAABD109F71532B79063BAE1C7216C9C90361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YPDA.exe

Path C:\windows\SysWOW64\YPDA.exe
Size 208KB
SHA256 9ce0bffb6aeb18b1abe16f034f0308199412012509f4ae364cac8218a5335b16
MD5 f22f5bbd15ebf36cd0c04a30305b2a4b
SHA1 934d835ec2bf0043c69a49a029cf41bf06083b6f
SHA512 2288a11471baed6626839bdc896781f02e9014b373073b26a73c665fe4cb25c2defe875bb1a3fefe2ccafbdac34835ce239a78f2029eb5b294e27ccf75acbb27
SSDEEP 3072:ME4ttjrOU5TmPhqNqQMa0EQDnBTp/EHCXdR8OtE3Pd4NLthEjQT6j:Mlh9mPsNlMRDnBTiHCjTOdQEj1
TLSH
T122247D4175A5866AE46B8F38D4EA87FC1F673D32AFB5460F72C8330D6EB25900921B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BEHW.exe

Path C:\windows\system\BEHW.exe
Size 208KB
SHA256 a1039712bf6b106814f7718bd1ada34211a710d864eaec73e252c9cfb7a6e3bf
MD5 20d60430401e01966acbc02e2f8ab742
SHA1 fc4177c05d54c231942f7202cf8467bb6c24e579
SHA512 e41e1abe5e22cc0feea6ff53b0c6546e24e8f206bd571186671790f27901cbc1cd6a79077c4ac8f3a07c958ef29273dd67091e9e0998034a718089d7367f1505
SSDEEP 3072:5IR2Plomfr01R2AiWWsZhP9nC3XB39INjkuGny5Nn4NLthEjQT6j:s2PbfgjWsZfnCh9IKnKnQEj1
TLSH
T13F24AF05B251EC06D6370A304CD1FAE029367DF5AF9259477F897B8E5BF2A942C326A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CXKIYQ.exe

Path C:\windows\system\CXKIYQ.exe
Size 208KB
SHA256 1d3d55e8d48be2b6feb07c612c614a5a35fa1a83e446fc6717efe2a691ff909a
MD5 37df6f66bd27042dbfbc7e5294563f66
SHA1 9e948503135b424cfab6cc99ebd79da40eaa0827
SHA512 b52b289c5d352116c4d445ffcac268af582dc9561dee5f345723d6c1caeae3f056f3979f377344924e4753cf1de380a838c3338aa30d9e4f4c38c4a0899a90d1
SSDEEP 3072:CdKzXNpoR1JBY9QEyNRNd/8s2MvXLia65UDBk0yKI4NLthEjQT6j:CdKbW1nEaRrUPybiabON3QEj1
TLSH
T10E249D007B8AF642E2B72AB14DD9BB793B2A3D23BFD5CD1B3541B34DA975344A400A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GCEWLIL.exe

Path C:\windows\system\GCEWLIL.exe
Size 208KB
SHA256 44c3cdf493d5b5c2b6fdad1f7165de478293bbbd479eb3ac0efae50a6c2508a6
MD5 714cd6346f1565a6647f45e73064bc50
SHA1 f0f61f763e44392dc4741e72e4f144727c3663ef
SHA512 910e4959767a01e818e4b693b6033b694504990f63c1344883465a3b2ab28984eea6fbadf9958264cf0fc2607a461c987903ff3f923b934a409352d4c148e46f
SSDEEP 3072:y5BjrbV16mrKZN7HO5wWL7Ap6KlurSNCkhmUiazca54NLthEjQT6j:IBjrbVQmWZZ+wK7Ap1OOBiQcyQEj1
TLSH
T167248C11B261CD42F6BF17B43BD2C6E45BBBBC1A9BD6212F2684331E45B32448C94EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HEPJJA.exe

Path C:\windows\system\HEPJJA.exe
Size 208KB
SHA256 e0b9340fa714d0c054dff6e83ad325154f8a6bfba2a77d28060bede62b82ef49
MD5 3371a6e3108c5d72ed886f1402f03052
SHA1 87ef99401d854dff677855349910c11a2627c29a
SHA512 6f6cf388a7d9d83c0c78913a0b405adcbd4282daea36beb20f4c63ded9b798f110cbc5beffe2c1e1d47e0c8162708457485b2c141fdbb89000a599514e2cdf3d
SSDEEP 3072:o1WQAWaU+9BwQt0KkIsJdpMfbfJgLFCGXyj5AW4w0NtCkpKfXQmsF9mSMC4NLthC:oQLP616s2f7OLEvAImtCxfXCF1MCQEj1
TLSH
T1FF24904071568B62D1971A7099E2CAD0992F7C219FE6435BBE40337E7EF12402FB6B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QHTR.exe

Path C:\windows\system\QHTR.exe
Size 208KB
SHA256 03ae0878428c2c266a5f8afe5280151e346bf2ed82168c89b724489ba8f3180f
MD5 895b90f5453491b982661e68582170d9
SHA1 bf16dbb655d6858a9d4eef65a15e3226a7a09407
SHA512 f5e66308b3ccbbfa61e800ebf37c1bf1ecce8d1a8833ae4aead1e98067643b9a9dbdd46fe08770b123023a82d2c98ee9e241d4e6c6e639809e99046442c7b6ae
SSDEEP 6144:NXvFd/dWMTa5+sTf9/hoL/No8d4yST40HLGQEj1:9dpMMTa5jjXUoOtZ0H6QC
TLSH
T1EC24AF12B699E5E3F4AF623448E6CFB856B2FCB0EFAF421731CA771D19316180419762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGUBL.exe

Path C:\windows\system\RGUBL.exe
Size 208KB
SHA256 e2e7258d78c9af61d8a8123f9d3a427ad85bec4b1c48c82b935ab48dda7b88e9
MD5 a9fff1b97662ec6ee723646b7a6a8e7f
SHA1 579aad9a071091b032ff7093bfd51cc675ac0e23
SHA512 09d7d30872bef4acb29ba95f4d2b209b65737fe0bdee81f60169c739256b51b76c6015a6e4bc10f9b8dd2584583e4c76260a5a43da9148a2f90023ed378e33a2
SSDEEP 3072:+r0p15QpTexsujFIHBcPZjCas992jDDNQHRMPD2urtpg6rVsjoBpkt4NLthEjQT2:1hFaBCjCasaOHR0rp7rVq4pktQEj1
TLSH
T1F5247D1176D3C402E5674632C9F786640EBDBC10EFB6824B3D98B35F09732925AA6BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-482-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/628-495-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1036-352-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1036-339-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1056-299-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1056-315-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1096-577-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1096-590-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1292-436-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1292-423-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1504-90-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1504-74-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1520-328-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1520-314-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1724-135-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1724-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1904-531-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1904-518-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1940-424-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1940-411-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1944-165-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1944-149-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2052-448-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2052-435-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2356-637-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2424-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2424-210-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2448-375-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2448-388-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2488-542-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2488-555-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2516-225-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2516-209-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2528-300-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2528-284-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2588-340-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2588-327-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2904-554-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2904-566-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2912-387-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2912-400-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2960-45-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2960-29-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3004-506-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3004-519-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3224-483-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3644-626-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3644-613-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3704-19-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3704-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3780-164-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3780-180-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3784-30-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3784-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3808-376-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3808-363-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4108-285-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4108-269-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4140-578-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4320-44-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4320-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4360-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4360-75-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4432-150-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4432-134-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4596-270-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4596-254-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4652-625-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4652-638-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4700-105-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4700-89-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4940-240-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4940-224-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4944-195-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4944-179-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4952-255-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4952-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4960-589-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4960-602-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5340-364-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5340-351-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5388-507-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5388-494-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5396-447-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5396-460-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5492-614-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5492-601-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5620-120-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5620-104-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5704-649-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5964-399-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5964-412-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5996-530-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5996-543-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6100-459-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6100-471-0x0000000000400000-0x0000000000438000-memory.dmp

Download