57e20dba5a38a76bb54ad1e94f84556dcff375fb50edcc53181adb9150e10871

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Size 208KB
Sample260728-ah9ecadh92
SHA256 57e20dba5a38a76bb54ad1e94f84556dcff375fb50edcc53181adb9150e10871
MD5 8e64a405f1e34fc26a04a83f17d097e0
SHA1 e0a3dcdf4ba7f6a2dee28a3dafda347782449210
SHA512 a7f17b390f8c253a92815f7ff885ae006f0f66d1a16ee24015a2a6e14ffa50efdfd06b7505d486aeb7c2d58f8091d7440e306d6db8ac112fa171ece8a4ba9ee3
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFdL+LVf84pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlF5+LV0kEj1
TLSH
T107247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 15 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OUYFZT.exe	OUYFZT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RCTTHH.exe	RCTTHH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GPFTM.exe	GPFTM.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCPE.exe	MCPE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XXAK.exe	XXAK.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XQP.exe	XQP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VNLR.exe	VNLR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYP.exe	AYP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZLYKV.exe	ZLYKV.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MQNPZLN.exe	MQNPZLN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYRH.exe	FYRH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FEMOI.exe	FEMOI.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NOI.exe	NOI.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GPL.exe	GPL.exe

Executes dropped EXE 28 IoCs

pid	Process
2200	OUYFZT.exe
1804	ZLYKV.exe
4640	RCTTHH.exe
5100	RCTTHH.exe
4228	ZLYKV.exe
3340	OUYFZT.exe
4732	MQNPZLN.exe
4632	FYRH.exe
1312	FYRH.exe
5872	MQNPZLN.exe
2532	XXAK.exe
4788	FEMOI.exe
1464	FEMOI.exe
4356	XXAK.exe
920	GPL.exe
5896	NOI.exe
3196	XQP.exe
5520	GPFTM.exe
4024	GPL.exe
1716	XQP.exe
3284	NOI.exe
5988	VNLR.exe
4992	MCPE.exe
4296	AYP.exe
6004	AYP.exe
4164	VNLR.exe
484	MCPE.exe
3116	GPFTM.exe

Adds Run key to start application 2 TTPs 60 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e312dc3d = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe"	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b4883e3 = "C:\\windows\\system\\ZLYKV.exe"	ZLYKV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7a8c28e0 = "C:\\windows\\SysWOW64\\MQNPZLN.exe"	MQNPZLN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\33d1bf20 = "C:\\windows\\SysWOW64\\NOI.exe"	NOI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ebe4b5b = "C:\\windows\\SysWOW64\\RCTTHH.exe"	RCTTHH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3ebe4b5b = "C:\\windows\\SysWOW64\\RCTTHH.exe"	RCTTHH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3c4257a9 = "C:\\windows\\system\\FEMOI.exe"	FEMOI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\366e6290 = "C:\\windows\\system\\XQP.exe"	XQP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b989e59f = "C:\\windows\\system\\VNLR.exe"	VNLR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b989e59f = "C:\\windows\\system\\VNLR.exe"	VNLR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4f804f61 = "C:\\windows\\SysWOW64\\MCPE.exe"	MCPE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7f28721e = "C:\\windows\\system\\OUYFZT.exe"	OUYFZT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4db03e53 = "C:\\windows\\FYRH.exe"	FYRH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\366e6290 = "C:\\windows\\system\\XQP.exe"	XQP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4db03e53 = "C:\\windows\\FYRH.exe"	FYRH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7f28721e = "C:\\windows\\system\\OUYFZT.exe"	OUYFZT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4db03e53 = "C:\\windows\\FYRH.exe"	FYRH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\3c4257a9 = "C:\\windows\\system\\FEMOI.exe"	FEMOI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b989e59f = "C:\\windows\\system\\VNLR.exe"	VNLR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b4883e3 = "C:\\windows\\system\\ZLYKV.exe"	ZLYKV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d3f15b4 = "C:\\windows\\XXAK.exe"	XXAK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\71464fc = "C:\\windows\\system\\GPL.exe"	GPL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\33d1bf20 = "C:\\windows\\SysWOW64\\NOI.exe"	NOI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\71464fc = "C:\\windows\\system\\GPL.exe"	GPL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\33d1bf20 = "C:\\windows\\SysWOW64\\NOI.exe"	NOI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4f804f61 = "C:\\windows\\SysWOW64\\MCPE.exe"	MCPE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b4883e3 = "C:\\windows\\system\\ZLYKV.exe"	ZLYKV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e312dc3d = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe"	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\7a8c28e0 = "C:\\windows\\SysWOW64\\MQNPZLN.exe"	MQNPZLN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4f804f61 = "C:\\windows\\SysWOW64\\MCPE.exe"	MCPE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\1b88a0ff = "C:\\windows\\system\\GPFTM.exe"	GPFTM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\e312dc3d = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe"	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4db03e53 = "C:\\windows\\FYRH.exe"	FYRH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1b88a0ff = "C:\\windows\\system\\GPFTM.exe"	GPFTM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\366e6290 = "C:\\windows\\system\\XQP.exe"	XQP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\33d1bf20 = "C:\\windows\\SysWOW64\\NOI.exe"	NOI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b0547b77 = "C:\\windows\\system\\AYP.exe"	AYP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ebe4b5b = "C:\\windows\\SysWOW64\\RCTTHH.exe"	RCTTHH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\7f28721e = "C:\\windows\\system\\OUYFZT.exe"	OUYFZT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d3f15b4 = "C:\\windows\\XXAK.exe"	XXAK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3c4257a9 = "C:\\windows\\system\\FEMOI.exe"	FEMOI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\71464fc = "C:\\windows\\system\\GPL.exe"	GPL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\366e6290 = "C:\\windows\\system\\XQP.exe"	XQP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4f804f61 = "C:\\windows\\SysWOW64\\MCPE.exe"	MCPE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b989e59f = "C:\\windows\\system\\VNLR.exe"	VNLR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7a8c28e0 = "C:\\windows\\SysWOW64\\MQNPZLN.exe"	MQNPZLN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\7a8c28e0 = "C:\\windows\\SysWOW64\\MQNPZLN.exe"	MQNPZLN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\3c4257a9 = "C:\\windows\\system\\FEMOI.exe"	FEMOI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9d3f15b4 = "C:\\windows\\XXAK.exe"	XXAK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\1b88a0ff = "C:\\windows\\system\\GPFTM.exe"	GPFTM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\e312dc3d = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe"	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3ebe4b5b = "C:\\windows\\SysWOW64\\RCTTHH.exe"	RCTTHH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\71464fc = "C:\\windows\\system\\GPL.exe"	GPL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b0547b77 = "C:\\windows\\system\\AYP.exe"	AYP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1b88a0ff = "C:\\windows\\system\\GPFTM.exe"	GPFTM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b4883e3 = "C:\\windows\\system\\ZLYKV.exe"	ZLYKV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9d3f15b4 = "C:\\windows\\XXAK.exe"	XXAK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b0547b77 = "C:\\windows\\system\\AYP.exe"	AYP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\7f28721e = "C:\\windows\\system\\OUYFZT.exe"	OUYFZT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\b0547b77 = "C:\\windows\\system\\AYP.exe"	AYP.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\NOI.exe.bat	XXAK.exe
File created	C:\windows\SysWOW64\MCPE.exe	NOI.exe
File created	C:\windows\SysWOW64\RCTTHH.exe	OUYFZT.exe
File opened for modification	C:\windows\SysWOW64\RCTTHH.exe	OUYFZT.exe
File created	C:\windows\SysWOW64\NOI.exe	XXAK.exe
File opened for modification	C:\windows\SysWOW64\MCPE.exe	NOI.exe
File created	C:\windows\SysWOW64\MCPE.exe.bat	NOI.exe
File created	C:\windows\SysWOW64\RCTTHH.exe.bat	OUYFZT.exe
File created	C:\windows\SysWOW64\MQNPZLN.exe	OUYFZT.exe
File opened for modification	C:\windows\SysWOW64\MQNPZLN.exe	OUYFZT.exe
File created	C:\windows\SysWOW64\MQNPZLN.exe.bat	OUYFZT.exe
File opened for modification	C:\windows\SysWOW64\NOI.exe	XXAK.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\windows\XXAK.exe	MQNPZLN.exe
File created	C:\windows\XXAK.exe.bat	MQNPZLN.exe
File created	C:\windows\system\XQP.exe	FEMOI.exe
File created	C:\windows\system\OUYFZT.exe	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File created	C:\windows\system\ZLYKV.exe	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File created	C:\windows\FYRH.exe.bat	RCTTHH.exe
File opened for modification	C:\windows\system\GPL.exe	FEMOI.exe
File created	C:\windows\system\GPL.exe.bat	FEMOI.exe
File opened for modification	C:\windows\system\ZLYKV.exe	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File created	C:\windows\FYRH.exe	RCTTHH.exe
File created	C:\windows\system\XQP.exe.bat	FEMOI.exe
File created	C:\windows\system\VNLR.exe	XQP.exe
File opened for modification	C:\windows\XXAK.exe	MQNPZLN.exe
File opened for modification	C:\windows\system\XQP.exe	FEMOI.exe
File created	C:\windows\system\GPFTM.exe	NOI.exe
File created	C:\windows\system\VNLR.exe.bat	XQP.exe
File created	C:\windows\system\AYP.exe.bat	GPL.exe
File opened for modification	C:\windows\system\GPFTM.exe	NOI.exe
File created	C:\windows\system\GPFTM.exe.bat	NOI.exe
File created	C:\windows\system\ZLYKV.exe.bat	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File opened for modification	C:\windows\FYRH.exe	RCTTHH.exe
File created	C:\windows\system\FEMOI.exe	FYRH.exe
File created	C:\windows\system\FEMOI.exe.bat	FYRH.exe
File created	C:\windows\system\OUYFZT.exe.bat	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
File created	C:\windows\system\AYP.exe	GPL.exe
File opened for modification	C:\windows\system\AYP.exe	GPL.exe
File opened for modification	C:\windows\system\FEMOI.exe	FYRH.exe
File created	C:\windows\system\GPL.exe	FEMOI.exe
File opened for modification	C:\windows\system\VNLR.exe	XQP.exe
File opened for modification	C:\windows\system\OUYFZT.exe	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe
3092	cmd.exe
5176	cmd.exe
6104	cmd.exe
5140	cmd.exe
2268	cmd.exe
5032	cmd.exe
5172	cmd.exe
2964	cmd.exe
1616	cmd.exe
5800	cmd.exe
5932	cmd.exe
2364	cmd.exe
2160	cmd.exe

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2364	2108	WerFault.exe	87
3460	2200	WerFault.exe	91
2488	1804	WerFault.exe	94
4832	4484	WerFault.exe	96
708	4640	WerFault.exe	99
5388	3340	WerFault.exe	105
1380	5100	WerFault.exe	103
3508	4228	WerFault.exe	104
4364	4732	WerFault.exe	121
124	4632	WerFault.exe	122
1752	1312	WerFault.exe	131
5908	5872	WerFault.exe	136
4672	2532	WerFault.exe	137
4088	4788	WerFault.exe	138
2308	1464	WerFault.exe	141
1984	4356	WerFault.exe	142
2332	920	WerFault.exe	157
3952	5896	WerFault.exe	162
4088	3196	WerFault.exe	163
5728	4024	WerFault.exe	180
4580	5520	WerFault.exe	179
2956	3284	WerFault.exe	181
2452	1716	WerFault.exe	182
1980	4992	WerFault.exe	184
2280	4296	WerFault.exe	185
3936	6004	WerFault.exe	190
5160	4164	WerFault.exe	191
5704	484	WerFault.exe	192
4152	3116	WerFault.exe	193

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FYRH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FEMOI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RCTTHH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCPE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZLYKV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XQP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUYFZT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XXAK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AYP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQNPZLN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AYP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZLYKV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XQP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FYRH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FEMOI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XXAK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPFTM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUYFZT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQNPZLN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCPE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPFTM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RCTTHH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
2200	OUYFZT.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
4640	RCTTHH.exe
4640	RCTTHH.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
4640	RCTTHH.exe
4640	RCTTHH.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
5100	RCTTHH.exe
5100	RCTTHH.exe
3340	OUYFZT.exe
3340	OUYFZT.exe
4640	RCTTHH.exe
4640	RCTTHH.exe
4228	ZLYKV.exe
4228	ZLYKV.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
5100	RCTTHH.exe
5100	RCTTHH.exe
3340	OUYFZT.exe
3340	OUYFZT.exe
4640	RCTTHH.exe
4640	RCTTHH.exe
4228	ZLYKV.exe
4228	ZLYKV.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe

Suspicious use of SetWindowsHookEx 60 IoCs

pid	Process
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
2200	OUYFZT.exe
2200	OUYFZT.exe
1804	ZLYKV.exe
1804	ZLYKV.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4484	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
4640	RCTTHH.exe
4640	RCTTHH.exe
4228	ZLYKV.exe
5100	RCTTHH.exe
5100	RCTTHH.exe
4228	ZLYKV.exe
3340	OUYFZT.exe
3340	OUYFZT.exe
4732	MQNPZLN.exe
4732	MQNPZLN.exe
4632	FYRH.exe
4632	FYRH.exe
1312	FYRH.exe
1312	FYRH.exe
5872	MQNPZLN.exe
5872	MQNPZLN.exe
2532	XXAK.exe
2532	XXAK.exe
4788	FEMOI.exe
4788	FEMOI.exe
1464	FEMOI.exe
1464	FEMOI.exe
4356	XXAK.exe
4356	XXAK.exe
920	GPL.exe
920	GPL.exe
5896	NOI.exe
5896	NOI.exe
3196	XQP.exe
3196	XQP.exe
5520	GPFTM.exe
5520	GPFTM.exe
4024	GPL.exe
4024	GPL.exe
1716	XQP.exe
1716	XQP.exe
3284	NOI.exe
3284	NOI.exe
5988	VNLR.exe
5988	VNLR.exe
4992	MCPE.exe
4992	MCPE.exe
4296	AYP.exe
4296	AYP.exe
6004	AYP.exe
6004	AYP.exe
4164	VNLR.exe
4164	VNLR.exe
484	MCPE.exe
484	MCPE.exe
3116	GPFTM.exe
3116	GPFTM.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2964	2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe	89
PID 2964 wrote to memory of 2200	2964	cmd.exe	91
PID 2108 wrote to memory of 3092	2108	2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe	92
PID 3092 wrote to memory of 1804	3092	cmd.exe	94
PID 2200 wrote to memory of 5176	2200	OUYFZT.exe	97
PID 5176 wrote to memory of 4640	5176	cmd.exe	99
PID 5100 wrote to memory of 1616	5100	RCTTHH.exe	117
PID 3340 wrote to memory of 6104	3340	OUYFZT.exe	118
PID 6104 wrote to memory of 4732	6104	cmd.exe	121
PID 1616 wrote to memory of 4632	1616	cmd.exe	122
PID 4732 wrote to memory of 5800	4732	MQNPZLN.exe	132
PID 4632 wrote to memory of 5932	4632	FYRH.exe	134
PID 5800 wrote to memory of 2532	5800	cmd.exe	137
PID 5932 wrote to memory of 4788	5932	cmd.exe	138
PID 1464 wrote to memory of 2364	1464	FEMOI.exe	155
PID 2364 wrote to memory of 920	2364	cmd.exe	157
PID 4356 wrote to memory of 5140	4356	XXAK.exe	158
PID 1464 wrote to memory of 2268	1464	FEMOI.exe	160
PID 5140 wrote to memory of 5896	5140	cmd.exe	162
PID 2268 wrote to memory of 3196	2268	cmd.exe	163
PID 5896 wrote to memory of 2160	5896	NOI.exe	168
PID 3196 wrote to memory of 5032	3196	XQP.exe	171
PID 5896 wrote to memory of 5048	5896	NOI.exe	175
PID 920 wrote to memory of 5172	920	GPL.exe	177
PID 2160 wrote to memory of 5520	2160	cmd.exe	179
PID 5032 wrote to memory of 5988	5032	cmd.exe	183
PID 5048 wrote to memory of 4992	5048	cmd.exe	184
PID 5172 wrote to memory of 4296	5172	cmd.exe	185

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\OUYFZT.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\windows\system\OUYFZT.exe
    C:\windows\system\OUYFZT.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\windows\SysWOW64\RCTTHH.exe
        
        C:\windows\system32\RCTTHH.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 888
        6⤵
        Program crash
        
        PID:708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1028
      4⤵
      Program crash
      PID:3460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLYKV.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\windows\system\ZLYKV.exe
    C:\windows\system\ZLYKV.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 876
      4⤵
      Program crash
      PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1396
  2⤵
  - Program crash
  PID:2364

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e64a405f1e34fc26a04a83f17d097e0_elex_emotet_stop.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 808
  2⤵
  - Program crash
  PID:4832

C:\windows\SysWOW64\RCTTHH.exe
C:\windows\SysWOW64\RCTTHH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\FYRH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\windows\FYRH.exe
    C:\windows\FYRH.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\FEMOI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5932
    - - C:\windows\system\FEMOI.exe
        
        C:\windows\system\FEMOI.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 900
        6⤵
        Program crash
        
        PID:4088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1044
      4⤵
      Program crash
      PID:124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 1032
  2⤵
  - Program crash
  PID:1380

C:\windows\system\ZLYKV.exe
C:\windows\system\ZLYKV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 812
  2⤵
  - Program crash
  PID:3508

C:\windows\system\OUYFZT.exe
C:\windows\system\OUYFZT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQNPZLN.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\windows\SysWOW64\MQNPZLN.exe
    C:\windows\system32\MQNPZLN.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\XXAK.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\windows\XXAK.exe
        
        C:\windows\XXAK.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 844
        6⤵
        Program crash
        
        PID:4672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1400
      4⤵
      Program crash
      PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 944
  2⤵
  - Program crash
  PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2108 -ip 2108
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2200 -ip 2200
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1804 -ip 1804
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4484 -ip 4484
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4640 -ip 4640
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5100 -ip 5100
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3340 -ip 3340
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4228 -ip 4228
1⤵
PID:3928

C:\windows\FYRH.exe
C:\windows\FYRH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 788
  2⤵
  - Program crash
  PID:1752

C:\windows\SysWOW64\MQNPZLN.exe
C:\windows\SysWOW64\MQNPZLN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 816
  2⤵
  - Program crash
  PID:5908

C:\windows\system\FEMOI.exe
C:\windows\system\FEMOI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\GPL.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\windows\system\GPL.exe
    C:\windows\system\GPL.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\AYP.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5172
    - - C:\windows\system\AYP.exe
        
        C:\windows\system\AYP.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 916
        6⤵
        Program crash
        
        PID:2280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1048
      4⤵
      Program crash
      PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\XQP.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\windows\system\XQP.exe
    C:\windows\system\XQP.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\VNLR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\windows\system\VNLR.exe
        
        C:\windows\system\VNLR.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1380
      4⤵
      Program crash
      PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1336
  2⤵
  - Program crash
  PID:2308

C:\windows\XXAK.exe
C:\windows\XXAK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOI.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\windows\SysWOW64\NOI.exe
    C:\windows\system32\NOI.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\GPFTM.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\windows\system\GPFTM.exe
        
        C:\windows\system\GPFTM.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 836
        6⤵
        Program crash
        
        PID:4580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\MCPE.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\windows\SysWOW64\MCPE.exe
        
        C:\windows\system32\MCPE.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
        6⤵
        Program crash
        
        PID:1980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 1416
      4⤵
      Program crash
      PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 988
  2⤵
  - Program crash
  PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4732 -ip 4732
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4632 -ip 4632
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1312 -ip 1312
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5872 -ip 5872
1⤵
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2532 -ip 2532
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4788 -ip 4788
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1464 -ip 1464
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4356 -ip 4356
1⤵
PID:4796

C:\windows\system\GPL.exe
C:\windows\system\GPL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 808
  2⤵
  - Program crash
  PID:5728

C:\windows\SysWOW64\NOI.exe
C:\windows\SysWOW64\NOI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 840
  2⤵
  - Program crash
  PID:2956

C:\windows\system\XQP.exe
C:\windows\system\XQP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 812
  2⤵
  - Program crash
  PID:2452

C:\windows\system\AYP.exe
C:\windows\system\AYP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 832
  2⤵
  - Program crash
  PID:3936

C:\windows\system\VNLR.exe
C:\windows\system\VNLR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 808
  2⤵
  - Program crash
  PID:5160

C:\windows\SysWOW64\MCPE.exe
C:\windows\SysWOW64\MCPE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 868
  2⤵
  - Program crash
  PID:5704

C:\windows\system\GPFTM.exe
C:\windows\system\GPFTM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 832
  2⤵
  - Program crash
  PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 920 -ip 920
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5896 -ip 5896
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3196 -ip 3196
1⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4024 -ip 4024
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5520 -ip 5520
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1716 -ip 1716
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3284 -ip 3284
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5988 -ip 5988
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4992 -ip 4992
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4296 -ip 4296
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6004 -ip 6004
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4164 -ip 4164
1⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 484 -ip 484
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3116 -ip 3116
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FYRH.exe.bat

Path C:\Windows\FYRH.exe.bat
Size 54B
SHA256 580ca172c7bb349d9286f8f4266eab8c0f393aa28921824b9d28e60c8acecc80
MD5 2e147f28e5e40dc11e74c86d1da0a2bd
SHA1 89dedce2fe25eedcdf29671dedaecf76136fae32
SHA512 f5ba52ddd912f7dd93fc2bd11da9ea1909fa8bb79f4b8a5262d955b15b82569c72c74161ca4bbfdecc4da1e66c9157ca74a2d69e54f576571f23353c5bffddc7
MD5 SHA1 SHA512

Submit Download

MCPE.exe.bat

Path C:\Windows\SysWOW64\MCPE.exe.bat
Size 72B
SHA256 d6928bb12f16280db092458f30ed0f7f440c8a414d1ad67dbab9c0380eecc3ca
MD5 7e1110cf9fe98e0a34d7b42838cdb4db
SHA1 d1138a524e3c8d3d8c4f4aa16639d6d089fc601e
SHA512 38b6629504a3d2f4cc5af5aa2fd9673c90a9bfc931bca24d1967a427581ff1febb8811d9cec24ff6e22c6f35d708f910b42fbbd44a7c7f4a73d5d3ed538f9fb9
TLSH
T1CCA002300AC3A0E08CA4406DC3CA37220C2AF46A0312C020129528E3E80644F8A20CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MQNPZLN.exe.bat

Path C:\Windows\SysWOW64\MQNPZLN.exe.bat
Size 78B
SHA256 76ff332f2f61e441e37a82d61c3106c4758c80cee656a67c1bb22ffa3b44e2b7
MD5 a363ea85232df7fb629cfdee1d5c15f5
SHA1 631d6e23859fd117097cea5d8087052189738c91
SHA512 e28f51e2f1914b6da67353f41c24bb7642f87a82877c6234148eef4f40193aeb66175616e82cea4dbd088639e12ad5eeb7e66c94e8cb8940f1ff7e49a1c2dcc5
TLSH
T19CA004340DCD11D4441440DDD3C53F11041FF44503D040145D5574C1DC05CC74534C74
MD5 SHA1 SHA512 TLSH

Submit Download

NOI.exe.bat

Path C:\Windows\SysWOW64\NOI.exe.bat
Size 70B
SHA256 fc68a0042915135b3fbb55df71e2b20d6f4458cb796f684c90083af2de7fb4b6
MD5 dd80511655060c9f4eab5cf203c9a81e
SHA1 d96f2c880082ecf9e1c90a0c48640a166089c713
SHA512 50a39a8c137a54b4de8e04cd7ce5f0d4927ddb68bca2b14e4c6c5588cd819d23ca48aaf9755238d6536e11b7e7a829628491be9ade1d34a7f4de29d97ad86786
TLSH
T1E1A002300AC128E08824406DCB4A372804BAF4CA03100030129720C2E00444BCAB0EBC
MD5 SHA1 SHA512 TLSH

Submit Download

RCTTHH.exe.bat

Path C:\Windows\SysWOW64\RCTTHH.exe.bat
Size 76B
SHA256 c8c6f2838addfdfba2bc2921747fd2597726d13ca931b7b97a147670fb77d09b
MD5 441904a4ce7a2eb50e0543d37bd93aad
SHA1 a9bcce11bdc657062fb3c5efcfa772060db4b0e9
SHA512 e58639d2d83670b07cdc68d6d399cc92067574c55babb7a35d8acdb133b0ef51238f149df047522bb7a098e97b83779cdc3bc4621d9b1383c6cb944927b45cc8
TLSH
T143A00230BAC320E88824406DC34B3730042AF44A0B920C2033DDE0E3E086C7BCE28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

AYP.exe.bat

Path C:\Windows\System\AYP.exe.bat
Size 66B
SHA256 ce3854a16a3745b7cbb9299d0fbf0f1981eb9603e21d804fa2bfeebe48eaa3e3
MD5 b499dcbcac70ada1acd8b85a55beab0d
SHA1 8cf247f7085469ce669075d91236810e087030d9
SHA512 8130a466ea539b20658a864d818ce353b1fce401061bc251b4928bf1cc78b9d57445614a81875423df40c0a6f646d2dd47970825128dac1955f505228c6286c8
TLSH
T111A002380EC32CF3882440ED434A3700242AFC6A03300028929580A2E0044E3CF20BB8
MD5 SHA1 SHA512 TLSH

Submit Download

FEMOI.exe.bat

Path C:\Windows\System\FEMOI.exe.bat
Size 70B
SHA256 aad4ffaa9fefbb4d3d799c1493ca55d592340e4e8c1842fddd6f6f9a2bc0cfb9
MD5 2439824fdd0c38b9738b61aad6d95297
SHA1 10e24797e96c834aad05f96bc3bc32d7b918b0b9
SHA512 ce0803fe9af6d74a3d9ce3668e050f27e372ebe1a57e0bd359c50de92d12da129737679cee16a8e0e69526431b3d9fdc4e91a2c852f28e9158e531b156f81099
TLSH
T142A0023C0EC122EAE824407D4B6B370004EAF64A0310382012970282E00C4738A20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

GPFTM.exe.bat

Path C:\Windows\System\GPFTM.exe.bat
Size 70B
SHA256 216a3dc336fdd9e4cc1abda1f9b999c20a1615877a3d2b663988d194c8cf3258
MD5 fb86483e78c9c1d724dbad9b4f1fe1b4
SHA1 bef6ea0d83761f5778cd013444658e1be7f33728
SHA512 d738296e3fe84fd49a5d026a92d7383a066c5f4985bddfcf88e34852b67d94495de4a35ac764e29a817846eac6cde15834db110fce5b6eb7783b24a7dd8c3267
TLSH
T1B5A002300FC12AE2E824E26DFBCE3700043BF4420330022C32950082E00446B8A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

GPL.exe.bat

Path C:\Windows\System\GPL.exe.bat
Size 66B
SHA256 d24bd2e4ccbf18bc0fde6da595593fa423fe6bb44d817b24bf5f9968eb2564a6
MD5 24e57fbdc6bebeb6b1bbcc09954f7997
SHA1 2a85f922f805c8cbedddfdee7fe5a8bf82225073
SHA512 1acdcc31694ae75d0077ca461a41d14aa00c99ba9451cd71f09b01d0afe386a0e970719cd57c2446e92188be714fa3213ba1f0997fc58ad719cefd7a4aebfdcb
TLSH
T152A002300EC120E2A824C06D6B4A3700842BF4620338002812952082E00CC638A208BA
MD5 SHA1 SHA512 TLSH

Submit Download

OUYFZT.exe.bat

Path C:\Windows\System\OUYFZT.exe.bat
Size 72B
SHA256 ec113739f107dce57dc70f703498d24830da333844ed2d6a081729141caee8c6
MD5 fbf029369a7bfac7503ac7694241d21e
SHA1 d249db172a2b11506ea5a220765facd36bb7f581
SHA512 7e94c5289533c9fe52de5830c3d76bb2e95af69132a75f994ac4bba069d7ed0a7a0f80ae7f0062f078057700dbfb971df20a0e23d1cbb077929280013b1c1b7f
TLSH
T184A00230AFE120F2EA24406F434B3780242AF44383108E2012970082E284C638A228BC
MD5 SHA1 SHA512 TLSH

Submit Download

VNLR.exe.bat

Path C:\Windows\System\VNLR.exe.bat
Size 68B
SHA256 1de3e901a4db4e972bd59090d52874279810e7af0e69ff65a4dd89d907e0654d
MD5 9c3d151a3baf0fe7c4494fab7ff882ec
SHA1 ad88adad72e784c16b77f8390f1e59412f076fe1
SHA512 6d4d6bd230fffc32e80147dbe305005ac198594dd37b19007d611e08dab8f80474c659a9bccd3be052c5b0c63d0dc5a87d65e7ff94c3bd9adf204ce85b5a0311
TLSH
T1E2A002300EC128E28824406F634EBF00042AF44223100B3012D50082E0044EF8AF08B8
MD5 SHA1 SHA512 TLSH

Submit Download

XQP.exe.bat

Path C:\Windows\System\XQP.exe.bat
Size 66B
SHA256 e837cde52403d3d6b09fbdec3e9c84e35204530fb8ac0185b5086737b14d6723
MD5 0bd4996f102d9c068fb145faf75538ac
SHA1 4cffa64de4140c42d36ce0048f358a9e6391dcbe
SHA512 67b6affd5d60801bf6047494c21adf27c776ee01fc0b8b7eec53f5e26582abc350a7c4c26c64ad74d11a0b1ff2d15bc5abb8695858953e63354d0cffe3f97b23
TLSH
T13DA002380EC128E38A2C40ED4B4E3702242AF44A03300030129500A2E22467BCA20EBA
MD5 SHA1 SHA512 TLSH

Submit Download

ZLYKV.exe.bat

Path C:\Windows\System\ZLYKV.exe.bat
Size 70B
SHA256 b003745cfccb724d4298fae22f99655acb501bdf410974e52894e61ae5ee74be
MD5 86c0c99b750acdbc0c537fd71ac16955
SHA1 c8b895f48547a811c1079d030bfd52ae8076f16f
SHA512 37adf526955ea8529a0a3c3ea7e8c6468e7d36930bac5863af2b8e152faad0834369ef9078ad63cc3da7e41d31163bf154a14a185fd0cae1984e9e0e4854a563
TLSH
T129A002B00EC130E28834406D6BCA3708243AF443033080281EB50082F004C63AA20ABA
MD5 SHA1 SHA512 TLSH

Submit Download

XXAK.exe.bat

Path C:\Windows\XXAK.exe.bat
Size 54B
SHA256 b1caac2d6eb5d31401e21663a1f90321a1ebecea11466eaf6ab1df56d750941d
MD5 712465ca12ccf01b4ce944b21073b796
SHA1 58f183c888eca56de63e61350a1ae3292a87d688
SHA512 47729ce70b919167f6faa7af23ba24fdcba67f0293d726f2c74fa840fb2ff0746c35f361829a88019d452e7d2ac99df355790c2ad5e89c8978fad0adb2a08ae1
MD5 SHA1 SHA512

Submit Download

MQNPZLN.exe

Path C:\windows\SysWOW64\MQNPZLN.exe
Size 208KB
SHA256 2137a1efb2af681380fe12a495cdef4c19d63c0a1b0b09f2a59b4f2a12f8c9ce
MD5 07c721ee38fbfa2367b3a03e85ac837d
SHA1 b0437d993b70eded4ced3783c8585ca35f8ab039
SHA512 74ebc5f54ad06f3416e95eef2d9912e3afdc0b30da9f6d89a0f3c02c63c1f7f73a418e7199abb164dc9ea068677e047efc9b3e6e5bcebf1cd12d562ed1374a4c
SSDEEP 3072:i5MkVYPMp0HxrGWGCGEGIDy5DpQSHRapuuJWJAJh9MPQJIU4pLthEjQT6j:2dp0HHNeRapZWJAJhZIUkEj1
TLSH
T15C246C0371AA8113E49F577008F2C7B82D7BBC62EF68879B7260BB1F48716691C5B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCTTHH.exe

Path C:\windows\SysWOW64\RCTTHH.exe
Size 208KB
SHA256 481fb14e96bc472eefdedbe72e815016c6036819ecd22464d465ff85029568a3
MD5 5b07fc141ba2c2e03c7825a41a4f7a07
SHA1 abdd1ebebe87a6775297abbcb3dd41ee79dda0e7
SHA512 4b15201947da5f7b8ab9ca0d59bf77a5864dac18568aecde1df96b44be91bf47d320d719038b781f772bd767058a49352927f5dd9f9bfaefd81917a19863b051
SSDEEP 3072:yRtiX181q+3ct4vTjUGLVpgFcaFFpiDZysuc0l4pLthEjQT6j:yRKuYiV6N/piDZysucEkEj1
TLSH
T171248D427251CB86D1BB7A369CEFABE81696FC70BFA442DFB984334D18761640C30B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XXAK.exe

Path C:\windows\XXAK.exe
Size 208KB
SHA256 cb1ed5324c3800643d0eb936357f0f79f822166178d2436c2b50ec7514bcabb7
MD5 b93b5112b47255955a2e671424ec7edb
SHA1 7f9dd932850c93ed6c6859278d68aab0406eca57
SHA512 d92b6423fa16542dd80351e7c6e598f6aa3546e8cb236555114a0792254eaa64332141625f654f99d5dd5d2f28f6be407cbb82909b46aa0dbe3be2b3d577d4fb
SSDEEP 3072:RhWzi7s/Jkug/mBHRasCyKY11vW20ALoE5NPp5+T2WM/tRE4pLthEjQT6j:RhYSJ/mlMWKY11exE5Bp5+aW2EkEj1
TLSH
T17D248E02B1C0D89BD9B316700AF396949A7EFC31EB63811FB240772EEC36BA54A71755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPFTM.exe

Path C:\windows\system\GPFTM.exe
Size 208KB
SHA256 e345c9da2e427e315183e3e57ed91d269678843fd4145a036c4465714c9011d1
MD5 a347933595d6838567eb766514381c32
SHA1 5928d047c318f23e8f9cc967d0c486e2c33be62a
SHA512 5542cbe1df50c318106b62577746d2087f46aa64e39493f6d73d8dca3042c369cc8ff805e88b896e13624aab7e653214bde7802e701c2f1bd377f551652fb104
SSDEEP 6144:ufgXxJdOrXdFHFFBHy6aV0a6r5q0pkEj1:u8x2dFHFytmr5NkC
TLSH
T1D9248D0235C1CA66D067AB354CE682F80765BCE9AFB2572B3284731E3E316D90F55B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPL.exe

Path C:\windows\system\GPL.exe
Size 208KB
SHA256 e0f6d1827e5f4912fb4468cf4544ce5481dbcd9bc1c7b43106ebccbd11f4ba56
MD5 1f39ba69ed37c24d6a8ce8318ce0959e
SHA1 ceb718470540c6a89b78272492385e9ecdc14b97
SHA512 fd5c056cd8dd038d2a37268dac1814a92342649579b8cd6fd471387eedae7482554faf67580c7e254a8b083b11b561dc7a663652985a8918bdf2f5f1f47b0e89
SSDEEP 3072:hFNPkvg1wA3v05HYZ8hrU6zmPyTzPTyjc4pLthEjQT6j:hfCgCA3vo4ZyA6zmPGeAkEj1
TLSH
T13B246A01B24BE4ABE3731F7C0CF7D7656B6ABC738FA6962B6285336D19331410856722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUYFZT.exe

Path C:\windows\system\OUYFZT.exe
Size 208KB
SHA256 23484e6f03f07967f5529076e7cf6fa843b5ef120d1390afa72353348d2c4d6c
MD5 d80228de2c89cc8e7dd8a49c927f9558
SHA1 a534901c42d42daec7e683c36f91f9c6bd4bc238
SHA512 eff1d820f49e1a3674a72b7a34fe9b5750e2a8e72f16a32d5425fde62b2eb1609a99ef489d3bf082510a1f8c0be58c2e5c41f43ddcccae5ad14a9a391fa32050
SSDEEP 6144:uCEm+ZJXwLHfbYYBzcwv4jeILV/i2Zzwjagk07tE9kEj1:QJXwLHf1vw1ZUugk07tE9kC
TLSH
T138247C0036C5D112E38F5B36C9E1EB6809ABFD61EFB1961F7E42731D6FB16621822361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XQP.exe

Path C:\windows\system\XQP.exe
Size 208KB
SHA256 53ded4a01bed9c470b859659b9f5a998193abc7b62d63197fcd2ff18d5599b68
MD5 51c6b31017716aa2b816b06900563f34
SHA1 637cd573256fa67bec0ba518358be478a6a66eaa
SHA512 716679c5dc55c9c30921854f223b80f4190151f6f2608b13bc5650da513f737eadf5c16df7858edc9d4f12b87493f03bb599de6e96f0cd420815d6c7ad8da725
SSDEEP 3072:UjnGarGKZTskWIV6A3JQLW8cwHYH3wMN4jO4pLthEjQT6j:UjGarGcTsPIV6AZgPxjOkEj1
TLSH
T16E246D027FE8C002EE77463188E686A8966BBCEE8FB39207B448779F7DF154C8515752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-229-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/484-244-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/920-232-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/920-140-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1312-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1464-164-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1716-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1716-215-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1804-52-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1804-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2108-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2108-50-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2200-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2200-51-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2532-113-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2532-121-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3116-231-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3116-245-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3196-163-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3196-234-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3284-238-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3340-49-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3340-84-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4024-236-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4164-227-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4164-243-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4228-83-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4228-47-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4296-241-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4356-165-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4484-37-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4484-53-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4632-82-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4632-118-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4640-43-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4640-54-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4732-117-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4732-80-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4788-126-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4992-221-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4992-240-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5100-85-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5100-46-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5520-237-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5520-211-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5872-120-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5896-233-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5988-235-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6004-225-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/6004-242-0x0000000000400000-0x0000000000438000-memory.dmp

Download