1894234e62710f20b68b8a6105af77d0b3d3ef56f747b842ddcf070fff87f560

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Size 208KB
Sample260910-msfk8svxcv
SHA256 1894234e62710f20b68b8a6105af77d0b3d3ef56f747b842ddcf070fff87f560
MD5 c8f00a79a27307836716a2024bae8bea
SHA1 e0b9c8ef650fa3266612f307f53aabc80c003b73
SHA512 d5a623d1927ff9ef2ba9ccd0c6671e5659df8b218470abd4e778665172aee71d82f0cfb2bb578b003cadadf92a86206c9df0218b9b96da11a4207b480ff9474c
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFEL+LOfA4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlFU+LOokEj1
TLSH
T1D2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 16 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HPGU.exe	HPGU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DKMG.exe	DKMG.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FXMK.exe	FXMK.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YIGGYIY.exe	YIGGYIY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BXYRIR.exe	BXYRIR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QSKVPR.exe	QSKVPR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDTRE.exe	PDTRE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IGDUQNT.exe	IGDUQNT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWZAGR.exe	NWZAGR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IYVYWU.exe	IYVYWU.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ELPZUH.exe	ELPZUH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RVZQN.exe	RVZQN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GAJZ.exe	GAJZ.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVB.exe	EVB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KJJGVGM.exe	KJJGVGM.exe

Executes dropped EXE 30 IoCs

pid	Process
2412	HPGU.exe
1288	GAJZ.exe
4604	IYVYWU.exe
5700	HPGU.exe
2580	EVB.exe
2532	DKMG.exe
3872	IYVYWU.exe
4672	GAJZ.exe
4224	DKMG.exe
2668	EVB.exe
5792	KJJGVGM.exe
3916	ELPZUH.exe
1080	ELPZUH.exe
3308	KJJGVGM.exe
548	YIGGYIY.exe
1052	BXYRIR.exe
5928	BXYRIR.exe
5484	YIGGYIY.exe
4552	QSKVPR.exe
2680	RVZQN.exe
2520	RVZQN.exe
4568	QSKVPR.exe
3484	PDTRE.exe
5660	PDTRE.exe
4668	FXMK.exe
5396	IGDUQNT.exe
2044	NWZAGR.exe
4884	FXMK.exe
1956	IGDUQNT.exe
4728	NWZAGR.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\abefb2e = "C:\\windows\\SysWOW64\\FXMK.exe"	FXMK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\2afa9187 = "C:\\windows\\SysWOW64\\YIGGYIY.exe"	YIGGYIY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\209b5a88 = "C:\\windows\\SysWOW64\\BXYRIR.exe"	BXYRIR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fa611cdb = "C:\\windows\\SysWOW64\\QSKVPR.exe"	QSKVPR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\19f2d2a6 = "C:\\windows\\system\\RVZQN.exe"	RVZQN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\fad99512 = "C:\\windows\\IGDUQNT.exe"	IGDUQNT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ab9d109 = "C:\\windows\\SysWOW64\\EVB.exe"	EVB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\9ce5e196 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe"	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\9ce5e196 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe"	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4bf3b5f7 = "C:\\windows\\system\\GAJZ.exe"	GAJZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebc3d188 = "C:\\windows\\ELPZUH.exe"	ELPZUH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\1027296e = "C:\\windows\\SysWOW64\\KJJGVGM.exe"	KJJGVGM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\2afa9187 = "C:\\windows\\SysWOW64\\YIGGYIY.exe"	YIGGYIY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\19f2d2a6 = "C:\\windows\\system\\RVZQN.exe"	RVZQN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\56f3a9f8 = "C:\\windows\\SysWOW64\\HPGU.exe"	HPGU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d585e0b5 = "C:\\windows\\DKMG.exe"	DKMG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\fa611cdb = "C:\\windows\\SysWOW64\\QSKVPR.exe"	QSKVPR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\60e0fe73 = "C:\\windows\\PDTRE.exe"	PDTRE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\60e0fe73 = "C:\\windows\\PDTRE.exe"	PDTRE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d8743da8 = "C:\\windows\\system\\NWZAGR.exe"	NWZAGR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\34b0867d = "C:\\windows\\SysWOW64\\IYVYWU.exe"	IYVYWU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4bf3b5f7 = "C:\\windows\\system\\GAJZ.exe"	GAJZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ebc3d188 = "C:\\windows\\ELPZUH.exe"	ELPZUH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\19f2d2a6 = "C:\\windows\\system\\RVZQN.exe"	RVZQN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\d585e0b5 = "C:\\windows\\DKMG.exe"	DKMG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4ab9d109 = "C:\\windows\\SysWOW64\\EVB.exe"	EVB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\fa611cdb = "C:\\windows\\SysWOW64\\QSKVPR.exe"	QSKVPR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\d8743da8 = "C:\\windows\\system\\NWZAGR.exe"	NWZAGR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ab9d109 = "C:\\windows\\SysWOW64\\EVB.exe"	EVB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1027296e = "C:\\windows\\SysWOW64\\KJJGVGM.exe"	KJJGVGM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\209b5a88 = "C:\\windows\\SysWOW64\\BXYRIR.exe"	BXYRIR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\56f3a9f8 = "C:\\windows\\SysWOW64\\HPGU.exe"	HPGU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\34b0867d = "C:\\windows\\SysWOW64\\IYVYWU.exe"	IYVYWU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\d585e0b5 = "C:\\windows\\DKMG.exe"	DKMG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1027296e = "C:\\windows\\SysWOW64\\KJJGVGM.exe"	KJJGVGM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fad99512 = "C:\\windows\\IGDUQNT.exe"	IGDUQNT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\56f3a9f8 = "C:\\windows\\SysWOW64\\HPGU.exe"	HPGU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4ab9d109 = "C:\\windows\\SysWOW64\\EVB.exe"	EVB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fa611cdb = "C:\\windows\\SysWOW64\\QSKVPR.exe"	QSKVPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\abefb2e = "C:\\windows\\SysWOW64\\FXMK.exe"	FXMK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\fad99512 = "C:\\windows\\IGDUQNT.exe"	IGDUQNT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\abefb2e = "C:\\windows\\SysWOW64\\FXMK.exe"	FXMK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4bf3b5f7 = "C:\\windows\\system\\GAJZ.exe"	GAJZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9ce5e196 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe"	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\34b0867d = "C:\\windows\\SysWOW64\\IYVYWU.exe"	IYVYWU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9ce5e196 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe"	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\34b0867d = "C:\\windows\\SysWOW64\\IYVYWU.exe"	IYVYWU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebc3d188 = "C:\\windows\\ELPZUH.exe"	ELPZUH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d8743da8 = "C:\\windows\\system\\NWZAGR.exe"	NWZAGR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\4bf3b5f7 = "C:\\windows\\system\\GAJZ.exe"	GAJZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ebc3d188 = "C:\\windows\\ELPZUH.exe"	ELPZUH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\209b5a88 = "C:\\windows\\SysWOW64\\BXYRIR.exe"	BXYRIR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2afa9187 = "C:\\windows\\SysWOW64\\YIGGYIY.exe"	YIGGYIY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\d8743da8 = "C:\\windows\\system\\NWZAGR.exe"	NWZAGR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\1027296e = "C:\\windows\\SysWOW64\\KJJGVGM.exe"	KJJGVGM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\56f3a9f8 = "C:\\windows\\SysWOW64\\HPGU.exe"	HPGU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2afa9187 = "C:\\windows\\SysWOW64\\YIGGYIY.exe"	YIGGYIY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\209b5a88 = "C:\\windows\\SysWOW64\\BXYRIR.exe"	BXYRIR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\abefb2e = "C:\\windows\\SysWOW64\\FXMK.exe"	FXMK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d585e0b5 = "C:\\windows\\DKMG.exe"	DKMG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\60e0fe73 = "C:\\windows\\PDTRE.exe"	PDTRE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\60e0fe73 = "C:\\windows\\PDTRE.exe"	PDTRE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fad99512 = "C:\\windows\\IGDUQNT.exe"	IGDUQNT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\19f2d2a6 = "C:\\windows\\system\\RVZQN.exe"	RVZQN.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\QSKVPR.exe	YIGGYIY.exe
File opened for modification	C:\windows\SysWOW64\FXMK.exe	BXYRIR.exe
File created	C:\windows\SysWOW64\HPGU.exe.bat	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\SysWOW64\EVB.exe	GAJZ.exe
File created	C:\windows\SysWOW64\KJJGVGM.exe	DKMG.exe
File created	C:\windows\SysWOW64\FXMK.exe	BXYRIR.exe
File opened for modification	C:\windows\SysWOW64\IYVYWU.exe	HPGU.exe
File created	C:\windows\SysWOW64\IYVYWU.exe.bat	HPGU.exe
File created	C:\windows\SysWOW64\YIGGYIY.exe	DKMG.exe
File opened for modification	C:\windows\SysWOW64\YIGGYIY.exe	DKMG.exe
File created	C:\windows\SysWOW64\YIGGYIY.exe.bat	DKMG.exe
File created	C:\windows\SysWOW64\BXYRIR.exe.bat	ELPZUH.exe
File created	C:\windows\SysWOW64\QSKVPR.exe.bat	YIGGYIY.exe
File created	C:\windows\SysWOW64\HPGU.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\EVB.exe.bat	GAJZ.exe
File opened for modification	C:\windows\SysWOW64\KJJGVGM.exe	DKMG.exe
File opened for modification	C:\windows\SysWOW64\BXYRIR.exe	ELPZUH.exe
File created	C:\windows\SysWOW64\FXMK.exe.bat	BXYRIR.exe
File opened for modification	C:\windows\SysWOW64\HPGU.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\IYVYWU.exe	HPGU.exe
File created	C:\windows\SysWOW64\EVB.exe	GAJZ.exe
File created	C:\windows\SysWOW64\KJJGVGM.exe.bat	DKMG.exe
File created	C:\windows\SysWOW64\BXYRIR.exe	ELPZUH.exe
File created	C:\windows\SysWOW64\QSKVPR.exe	YIGGYIY.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\windows\PDTRE.exe.bat	YIGGYIY.exe
File created	C:\windows\system\GAJZ.exe.bat	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\windows\ELPZUH.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\ELPZUH.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\windows\ELPZUH.exe.bat	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\system\RVZQN.exe	BXYRIR.exe
File opened for modification	C:\windows\PDTRE.exe	YIGGYIY.exe
File created	C:\windows\system\NWZAGR.exe	PDTRE.exe
File created	C:\windows\IGDUQNT.exe	QSKVPR.exe
File created	C:\windows\system\GAJZ.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\system\GAJZ.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\system\NWZAGR.exe	PDTRE.exe
File created	C:\windows\system\NWZAGR.exe.bat	PDTRE.exe
File opened for modification	C:\windows\IGDUQNT.exe	QSKVPR.exe
File created	C:\windows\system\RVZQN.exe	BXYRIR.exe
File created	C:\windows\system\RVZQN.exe.bat	BXYRIR.exe
File created	C:\windows\PDTRE.exe	YIGGYIY.exe
File created	C:\windows\IGDUQNT.exe.bat	QSKVPR.exe
File created	C:\windows\DKMG.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File opened for modification	C:\windows\DKMG.exe	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
File created	C:\windows\DKMG.exe.bat	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5784	cmd.exe
5112	cmd.exe
2076	cmd.exe
5424	cmd.exe
2876	cmd.exe
264	cmd.exe
3460	cmd.exe
4412	cmd.exe
3344	cmd.exe
4116	cmd.exe
248	cmd.exe
6116	cmd.exe
620	cmd.exe
4272	cmd.exe
5232	cmd.exe

Program crash 23 IoCs

pid	pid_target	Process	procid_target
3384	4604	WerFault.exe	103
5388	4672	WerFault.exe	112
1092	1512	WerFault.exe	88
1804	2412	WerFault.exe	94
1356	1288	WerFault.exe	95
5688	2580	WerFault.exe	107
2260	5700	WerFault.exe	106
3156	3872	WerFault.exe	111
3440	2668	WerFault.exe	116
5988	4224	WerFault.exe	115
1492	1080	WerFault.exe	145
5596	4136	WerFault.exe	105
5672	5792	WerFault.exe	139
5192	3308	WerFault.exe	146
968	2532	WerFault.exe	108
2020	3916	WerFault.exe	142
1864	5484	WerFault.exe	164
4584	2680	WerFault.exe	178
4112	2520	WerFault.exe	182
5768	4568	WerFault.exe	181
4280	5928	WerFault.exe	163
2972	548	WerFault.exe	158
4596	5660	WerFault.exe	195

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXYRIR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXYRIR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IYVYWU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAJZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IYVYWU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DKMG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ELPZUH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVZQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NWZAGR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EVB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FXMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPGU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAJZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YIGGYIY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YIGGYIY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDTRE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDTRE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FXMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NWZAGR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EVB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPGU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KJJGVGM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IGDUQNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IGDUQNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DKMG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QSKVPR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVZQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QSKVPR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KJJGVGM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ELPZUH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
2412	HPGU.exe
2412	HPGU.exe
1288	GAJZ.exe
1288	GAJZ.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
2412	HPGU.exe
2412	HPGU.exe
1288	GAJZ.exe
1288	GAJZ.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
2412	HPGU.exe
2412	HPGU.exe
4604	IYVYWU.exe
4604	IYVYWU.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1288	GAJZ.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1288	GAJZ.exe
5700	HPGU.exe
5700	HPGU.exe
2580	EVB.exe
2580	EVB.exe
2532	DKMG.exe
2532	DKMG.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
2412	HPGU.exe
2412	HPGU.exe
4604	IYVYWU.exe
4604	IYVYWU.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1288	GAJZ.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1288	GAJZ.exe
5700	HPGU.exe
5700	HPGU.exe
2580	EVB.exe
2580	EVB.exe
2532	DKMG.exe
2532	DKMG.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
3872	IYVYWU.exe
3872	IYVYWU.exe
4672	GAJZ.exe
4672	GAJZ.exe
2412	HPGU.exe
2412	HPGU.exe
4604	IYVYWU.exe
4604	IYVYWU.exe
1288	GAJZ.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1288	GAJZ.exe
5700	HPGU.exe
5700	HPGU.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
2412	HPGU.exe
2412	HPGU.exe
1288	GAJZ.exe
1288	GAJZ.exe
4604	IYVYWU.exe
4604	IYVYWU.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
5700	HPGU.exe
5700	HPGU.exe
2580	EVB.exe
2580	EVB.exe
2532	DKMG.exe
2532	DKMG.exe
3872	IYVYWU.exe
3872	IYVYWU.exe
4672	GAJZ.exe
4672	GAJZ.exe
4224	DKMG.exe
4224	DKMG.exe
2668	EVB.exe
2668	EVB.exe
5792	KJJGVGM.exe
5792	KJJGVGM.exe
3916	ELPZUH.exe
3916	ELPZUH.exe
1080	ELPZUH.exe
1080	ELPZUH.exe
3308	KJJGVGM.exe
3308	KJJGVGM.exe
548	YIGGYIY.exe
548	YIGGYIY.exe
1052	BXYRIR.exe
1052	BXYRIR.exe
5928	BXYRIR.exe
5928	BXYRIR.exe
5484	YIGGYIY.exe
5484	YIGGYIY.exe
4552	QSKVPR.exe
4552	QSKVPR.exe
2680	RVZQN.exe
2680	RVZQN.exe
2520	RVZQN.exe
2520	RVZQN.exe
4568	QSKVPR.exe
4568	QSKVPR.exe
3484	PDTRE.exe
3484	PDTRE.exe
5660	PDTRE.exe
5660	PDTRE.exe
4668	FXMK.exe
4668	FXMK.exe
5396	IGDUQNT.exe
5396	IGDUQNT.exe
2044	NWZAGR.exe
2044	NWZAGR.exe
1956	IGDUQNT.exe
1956	IGDUQNT.exe
4884	FXMK.exe
4884	FXMK.exe
4728	NWZAGR.exe
4728	NWZAGR.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 620	1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe	90
PID 1512 wrote to memory of 264	1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe	92
PID 620 wrote to memory of 2412	620	cmd.exe	94
PID 264 wrote to memory of 1288	264	cmd.exe	95
PID 2412 wrote to memory of 3460	2412	HPGU.exe	96
PID 1288 wrote to memory of 5784	1288	GAJZ.exe	100
PID 1512 wrote to memory of 4272	1512	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe	102
PID 3460 wrote to memory of 4604	3460	cmd.exe	103
PID 5784 wrote to memory of 2580	5784	cmd.exe	107
PID 4272 wrote to memory of 2532	4272	cmd.exe	108
PID 4224 wrote to memory of 248	4224	DKMG.exe	137
PID 248 wrote to memory of 5792	248	cmd.exe	139
PID 4136 wrote to memory of 4412	4136	2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe	140
PID 4412 wrote to memory of 3916	4412	cmd.exe	142
PID 2532 wrote to memory of 5232	2532	DKMG.exe	155
PID 5232 wrote to memory of 548	5232	cmd.exe	158
PID 3916 wrote to memory of 3344	3916	ELPZUH.exe	157
PID 3344 wrote to memory of 1052	3344	cmd.exe	160
PID 548 wrote to memory of 6116	548	YIGGYIY.exe	173
PID 6116 wrote to memory of 4552	6116	cmd.exe	175
PID 1052 wrote to memory of 4116	1052	BXYRIR.exe	176
PID 4116 wrote to memory of 2680	4116	cmd.exe	178
PID 548 wrote to memory of 2876	548	YIGGYIY.exe	191
PID 2876 wrote to memory of 3484	2876	cmd.exe	193
PID 1052 wrote to memory of 5112	1052	BXYRIR.exe	200
PID 5112 wrote to memory of 4668	5112	cmd.exe	202
PID 4552 wrote to memory of 2076	4552	QSKVPR.exe	203
PID 3484 wrote to memory of 5424	3484	PDTRE.exe	205
PID 2076 wrote to memory of 5396	2076	cmd.exe	207
PID 5424 wrote to memory of 2044	5424	cmd.exe	208

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\windows\SysWOW64\HPGU.exe
    C:\windows\system32\HPGU.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\windows\SysWOW64\IYVYWU.exe
        
        C:\windows\system32\IYVYWU.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 820
        6⤵
        Program crash
        
        PID:3384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 1396
      4⤵
      Program crash
      PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJZ.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\windows\system\GAJZ.exe
    C:\windows\system\GAJZ.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\windows\SysWOW64\EVB.exe
        
        C:\windows\system32\EVB.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 900
        6⤵
        Program crash
        
        PID:5688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1372
      4⤵
      Program crash
      PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\DKMG.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\windows\DKMG.exe
    C:\windows\DKMG.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\YIGGYIY.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5232
    - - C:\windows\SysWOW64\YIGGYIY.exe
        
        C:\windows\system32\YIGGYIY.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:548
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSKVPR.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6116
        
        C:\windows\SysWOW64\QSKVPR.exe
        
        C:\windows\system32\QSKVPR.exe
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\IGDUQNT.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\windows\IGDUQNT.exe
        
        C:\windows\IGDUQNT.exe
        9⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5396
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\PDTRE.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\windows\PDTRE.exe
        
        C:\windows\PDTRE.exe
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\NWZAGR.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5424
        
        C:\windows\system\NWZAGR.exe
        
        C:\windows\system\NWZAGR.exe
        9⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 1244
        6⤵
        Program crash
        
        PID:2972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1044
      4⤵
      Program crash
      PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1436
  2⤵
  - Program crash
  PID:1092

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-10_c8f00a79a27307836716a2024bae8bea_elex_emotet_stop.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\ELPZUH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\windows\ELPZUH.exe
    C:\windows\ELPZUH.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXYRIR.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3344
    - - C:\windows\SysWOW64\BXYRIR.exe
        
        C:\windows\system32\BXYRIR.exe
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1052
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system\RVZQN.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\windows\system\RVZQN.exe
        
        C:\windows\system\RVZQN.exe
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 836
        8⤵
        Program crash
        
        PID:4584
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXMK.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\windows\SysWOW64\FXMK.exe
        
        C:\windows\system32\FXMK.exe
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1364
      4⤵
      Program crash
      PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1324
  2⤵
  - Program crash
  PID:5596

C:\windows\SysWOW64\HPGU.exe
C:\windows\SysWOW64\HPGU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 852
  2⤵
  - Program crash
  PID:2260

C:\windows\SysWOW64\IYVYWU.exe
C:\windows\SysWOW64\IYVYWU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 852
  2⤵
  - Program crash
  PID:3156

C:\windows\system\GAJZ.exe
C:\windows\system\GAJZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 860
  2⤵
  - Program crash
  PID:5388

C:\windows\DKMG.exe
C:\windows\DKMG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJJGVGM.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\windows\SysWOW64\KJJGVGM.exe
    C:\windows\system32\KJJGVGM.exe
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 888
      4⤵
      Program crash
      PID:5672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 992
  2⤵
  - Program crash
  PID:5988

C:\windows\SysWOW64\EVB.exe
C:\windows\SysWOW64\EVB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 848
  2⤵
  - Program crash
  PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4604 -ip 4604
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4672 -ip 4672
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 1512 -ip 1512
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2412 -ip 2412
1⤵
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1288 -ip 1288
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2580 -ip 2580
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5700 -ip 5700
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 252 -p 3872 -ip 3872
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2668 -ip 2668
1⤵
PID:2968

C:\windows\ELPZUH.exe
C:\windows\ELPZUH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 812
  2⤵
  - Program crash
  PID:1492

C:\windows\SysWOW64\KJJGVGM.exe
C:\windows\SysWOW64\KJJGVGM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 868
  2⤵
  - Program crash
  PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4224 -ip 4224
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1080 -ip 1080
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4136 -ip 4136
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5792 -ip 5792
1⤵
PID:1344

C:\windows\SysWOW64\BXYRIR.exe
C:\windows\SysWOW64\BXYRIR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 844
  2⤵
  - Program crash
  PID:4280

C:\windows\SysWOW64\YIGGYIY.exe
C:\windows\SysWOW64\YIGGYIY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 848
  2⤵
  - Program crash
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 3308
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2532 -ip 2532
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3916 -ip 3916
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 252 -p 5484 -ip 5484
1⤵
PID:5044

C:\windows\SysWOW64\QSKVPR.exe
C:\windows\SysWOW64\QSKVPR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 844
  2⤵
  - Program crash
  PID:5768

C:\windows\system\RVZQN.exe
C:\windows\system\RVZQN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 824
  2⤵
  - Program crash
  PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2680 -ip 2680
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2520 -ip 2520
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4568 -ip 4568
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5928 -ip 5928
1⤵
PID:3624

C:\windows\PDTRE.exe
C:\windows\PDTRE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 820
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 548 -ip 548
1⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5660 -ip 5660
1⤵
PID:2592

C:\windows\SysWOW64\FXMK.exe
C:\windows\SysWOW64\FXMK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4884

C:\windows\IGDUQNT.exe
C:\windows\IGDUQNT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1956

C:\windows\system\NWZAGR.exe
C:\windows\system\NWZAGR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DKMG.exe.bat

Path C:\Windows\DKMG.exe.bat
Size 54B
SHA256 405db6cce97f6260ba6b10fb5ffa687464af4a19fdcf0ef8ea817009560de8e9
MD5 7762c46ee0b6d7afda9afbd4ea6544a2
SHA1 4adacbbd8443904cf74c37e8c2d2960479d55e8c
SHA512 8136323ca294fbb783e6a48c2632712164b26e43fb9391586349e606be5f884b4a1b1ebe8251e6e980485c1c1d3ea83c316512cfddd71e108f2ac34a2f033a86
MD5 SHA1 SHA512

Submit Download

ELPZUH.exe.bat

Path C:\Windows\ELPZUH.exe.bat
Size 58B
SHA256 89f7931f83cba00d9a1938bd4061e2f82f6bfec4f81d48b7b6b6f75dd4d38e7c
MD5 4541b165d7fd3f8652b9b77e2562d57f
SHA1 bfc91a6ebf776a62649361e8146b45ff032abf7e
SHA512 4983b8f2e8d3e8717e1dca5ad1cbe45651b13a7e0a2008a5543b0987640b7f160b1c9874d1ad5f9e206098ebe630bb06faf58f596a0332070608eed0da7561d2
MD5 SHA1 SHA512

Submit Download

IGDUQNT.exe.bat

Path C:\Windows\IGDUQNT.exe.bat
Size 60B
SHA256 6f4c13080626d2b59228e1a505fabc518e9ba0e5eef6ad8820a8b2ec27384733
MD5 508a5b49f828381c9216469972f7cffb
SHA1 ea1a7f6f4870f3f28a90dce1a5187a1424d41a6c
SHA512 72ad7d5ae547603492a67f0ee38cd2530d1492b5f17ee4135d66a8738917d178b817f01fe270738942d82de3071e8db0322860899fa7e1711baa90d64bcf25f9
TLSH
T11DA002388AC130C8C82460CB4B4A37800C0AF4400A10AB08321700F0788E44380088F0
MD5 SHA1 SHA512 TLSH

Submit Download

PDTRE.exe.bat

Path C:\Windows\PDTRE.exe.bat
Size 56B
SHA256 85b25dcc8dc17a3b6d93b02302655c7494e290042f60a81f2cf08c654e0bdcb3
MD5 a276a95a13c88f858cee8ea8d8c47394
SHA1 c69857cad506bf5b2884c53fc02fad9f2db71faa
SHA512 56c9ce2e49d03b31e23512bd11be731907a559fee7c7ee46309de80a388e57dd6e17ab4dcf35b0aed98a264dc7f165b754436e1aca4508ac3c63f2548bc656a4
MD5 SHA1 SHA512

Submit Download

BXYRIR.exe.bat

Path C:\Windows\SysWOW64\BXYRIR.exe.bat
Size 76B
SHA256 f2862344043573b937e279d095d04bdd4783b60ca7b3ec9cda133bb0025be723
MD5 93974ad399b033734a263e90fc75bb75
SHA1 880f36a4f3b9870e11bd8979536403c648c9ffd8
SHA512 fe9e83edaa987656aaaa81b64c0458e1dd49a7df6039e062bbc816d6d30590d3f7ec7d564cebe2d862a24de167558d9a900c6d84b06f635ef3e2d09760a44009
TLSH
T10EA002300AC928F0CC24C06DC34A3730843AF46E83300028129520E3F20444F8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

EVB.exe.bat

Path C:\Windows\SysWOW64\EVB.exe.bat
Size 70B
SHA256 be8843a367c4a094840593e4984ee3e98a776fb1d028d65af0998a3c0995a7b7
MD5 a97ca8761ba557f2bc2ef957cff8ed2e
SHA1 cda41cbaeba84e50c3a12c64c574152f36e81852
SHA512 10f98ebad854fcb2f1ce540d51f77448d6f32a412c0de0d30fd21a917bf6e5f82088da73deba73a48ee593f0ef68c15e7ff8702c49528cb620744c0203a2daa0
TLSH
T133A002300AC120E0A824406FC34AB720042AF44E039000E0129520C2F004C4B8E28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

FXMK.exe.bat

Path C:\Windows\SysWOW64\FXMK.exe.bat
Size 72B
SHA256 72076bc34cbd55a4ed539c6762e856cc66c73992d63f7497746c88e8e3171809
MD5 4abe6b53cbd71deebaa4fcdcd70d2b3d
SHA1 1d12e5be06168ad15a531c4423b330c12aa7a611
SHA512 0b68c19980d23c58e6de5d56ca5b9fe3cb38be734333e3f39c98460d852a32e6ff2452f05fad358ba4dace84e72edb0322dea827458522586496f25478912608
TLSH
T184A002328EC12AF08824406FC34A37AC042AF44A031C2A20929520C2E20C44F8B20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

HPGU.exe.bat

Path C:\Windows\SysWOW64\HPGU.exe.bat
Size 72B
SHA256 9aa85a587395b08974ef10502fdb563fbecb4691eb3d7230a97fb41044318149
MD5 6e74ba7cd6518db0cc235818306afb1c
SHA1 6d9428904e341a08f02d88af5092850e49c5bf22
SHA512 4972f7916ecebafe09e8686576cca9377a030a9aa1633085540db446c8727905bdfb5fefa07f76bff28ba2c3fba3a9161b8460c75ce3762afc4e8b56bcc21aa7
TLSH
T146A002308AC9A0E0882440EDE34A3730A4AAFC4A03320020129520C2E00CE4B8A22CB8
MD5 SHA1 SHA512 TLSH

Submit Download

IYVYWU.exe.bat

Path C:\Windows\SysWOW64\IYVYWU.exe.bat
Size 76B
SHA256 8c93346b4988939c31dbf5e0f92ac40388dc306aa928f5fb077bf82379587856
MD5 c4f713882f0992cf280b7187a4658452
SHA1 3e16758ba2f5efa035f898c1a57dba27744b25ca
SHA512 c987559f1a510b6a3b444bcf85291876bd0bd14cea784d0f336278df9acac28cb58642e565acc787d113d8f4ea74681a712004b7902197dd4a54aec876a7356f
TLSH
T1BAA002302AE120E0882440FDC34A3F20842AF44A03100020129DA8C3F004CCB8A28CB8
MD5 SHA1 SHA512 TLSH

Submit Download

KJJGVGM.exe.bat

Path C:\Windows\SysWOW64\KJJGVGM.exe.bat
Size 78B
SHA256 90d6b5e68876733a1a88ab414246f9cab18086ba44b328597cbbd76c9ad60930
MD5 6449da4d93555d5cd0c31a88d8dfc542
SHA1 7325275d9b138b7d06e73b9085ffb4514df3e257
SHA512 57b784fee506799db6e5918c02396b5868669767a77eddebb2355d17630d5c5ddd99801307ef1ba9e77982e90a21658855b44c8cc6b46d9b78c16a6fa1c1e686
TLSH
T1A2A002320AC920F8A8A44A6DE3CA372004BAF46A0B180320129528C2E00C4CF8A30CB8
MD5 SHA1 SHA512 TLSH

Submit Download

QSKVPR.exe.bat

Path C:\Windows\SysWOW64\QSKVPR.exe.bat
Size 76B
SHA256 49d4922b69f79729e882115144004983dc31d3f84e96e1c08b332962cc0d6844
MD5 fd34ce91fa1bdc92f136a8d7f29172d9
SHA1 d5bada23bdcb8deeb392a50b735758d7b62d069b
SHA512 7914b705670eeb1023929d025220ad0b982c4fd1733034b2feb294a178d20090865c691d4aa85fce9eaefd0f7ab24117361a0a2dbec9bc18578773a6d5e586e9
TLSH
T150A002380AC120E0883E4E7DC34A3722042AF4CA0B30003012F520C3E00644F8A30EFE
MD5 SHA1 SHA512 TLSH

Submit Download

YIGGYIY.exe.bat

Path C:\Windows\SysWOW64\YIGGYIY.exe.bat
Size 78B
SHA256 0827e8598eab1e4cff1e8b31f46231cff1537ae068df6fbbc7388a50a7bc57a2
MD5 81bf06e4152e0b983d71e7cfccb1329d
SHA1 cc91d08de6dd111d84b81b77f117ca6eaf0cf3d7
SHA512 17a435fa80955622489428c27e8cd8ee5ddb37ced98874d283336720636d3c662e8c5fd7231b1bb7ac3cb10c9f4789ab21fe6d6abcf31dc7dccc49e7fc546230
TLSH
T128A002300AC920F88C244C6DC34A37B0843EF44A8310002012DF22CBE0044CF8AB0CB8
MD5 SHA1 SHA512 TLSH

Submit Download

GAJZ.exe

Path C:\Windows\System\GAJZ.exe
Size 208KB
SHA256 21d506c17e56de7f7b32c308dc439e4be046fef5bd852bb9294c40707e51a689
MD5 3b54513dd0c5b62eafc63f7de85efd46
SHA1 d457a1f6ac6d8616f82f467eb192c93ff25b1aba
SHA512 d36b032da84edabe4aa92ef6a245d4c8bd9b90996a94728cedfd1fca38b5bd267aaace8aa89337878430ee9c653ce35bf8f51514d41bf06654c400d96b8cd98b
SSDEEP 3072:q+yV7Jku8lKVsv9kDdTP4XtFEtj49Wy48zDbKGDEfkRpJv7cF4pLthEjQT6j:Tg72bKelxXLEtU9o8CfkV7cFkEj1
TLSH
T1EC249D12F769E042E2E796388CE2C7B4067AFE55AB709F0B3999F36F1D304A64940771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GAJZ.exe.bat

Path C:\Windows\System\GAJZ.exe.bat
Size 68B
SHA256 806d3a6b95d3fd8058a7e4e4a927a2896a7f88245fa3cc61a882ee3fd205a754
MD5 1a00fb933b12e215cdebe9047c4833dc
SHA1 800efe3953eaff91b569bac163ee1199a4306ede
SHA512 618a85fd076e10ed502d80d924c846416bcc398436f8a76d490d6a398149054252d8d4b3389f36f63de435ae11e9c7383ae6fad47b121d5098992f8189737b4e
TLSH
T154A002320FE320E2882C406DE34AB700042FFC42031220281A958082E0064638B208B8
MD5 SHA1 SHA512 TLSH

Submit Download

NWZAGR.exe.bat

Path C:\Windows\System\NWZAGR.exe.bat
Size 72B
SHA256 f2d28359b44a07333165617db70ae98d4ac5683e3c020c7df1fb7087e01877d1
MD5 a0b0782281adfb224e1b82e5b79fd4b6
SHA1 ca96823eb6aeca35f2a54a65284ddb463fcc3e0d
SHA512 3c8d80efbc725b70e2b52df3babe9717d51d2dfe294ac21a9a0ff23bc116546967f2efabca4f6c21330550ac03082f1002947a751bf625d6ffac6b5770503a44
TLSH
T18FA002B08EF320E28824406FC36A370004AAF4720310002012D72082E00446B8A308BA
MD5 SHA1 SHA512 TLSH

Submit Download

RVZQN.exe.bat

Path C:\Windows\System\RVZQN.exe.bat
Size 70B
SHA256 8d0b4cdd9daeb70a5a7b14b475b8b5275544c028843701428fe0cbdf20bd8ac1
MD5 669cd450fe4614d4cfe7a49ac0c19959
SHA1 b157963a82c1af39b5974d31b983ac00513f85f7
SHA512 57a9b7f6ef71cffde82f48b82c583978bbef14c24443efd4c23dbacbe9802d064f8d2b1e9a12811bac441b761b376ae7d6f2f6d207a7e5dfcea467df2bf0f5de
TLSH
T16EA002380EC12AF2CEE440ED434A3700062EF44203F000229A970AE2F0044638A208B8
MD5 SHA1 SHA512 TLSH

Submit Download

PDTRE.exe

Path C:\windows\PDTRE.exe
Size 208KB
SHA256 e0f29f7d71a668aa8371a706d3c6da4701f371b0c8370a6c60ab130c81f09bae
MD5 010d582c0cb6f5d75fd0d472ed92f13a
SHA1 307d089f2e41b7a0c6ae5bae06e306bc9a9b10e5
SHA512 c7c12794e38106473f7bb590385ecfc84b74bf924defb221f462db6063f00f403a41e38f191a25f54ad25d810df96b82c770bd79a167b61b8f32be734e2b27f9
SSDEEP 6144:arYTgEMnRNL+I3YHBc/7MYRbbdfHKMkEj1:OBrI8Q8IMkC
TLSH
T14C246B057A9AC483E0B2063685D286642675BCB7BBFBE52B3AC4331F89B15A03D45F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXMK.exe

Path C:\windows\SysWOW64\FXMK.exe
Size 208KB
SHA256 23638be38a5d1c7e7514ac7bf9ad3a468edf31aeb407ea3a8df6e2eea5aaf1dc
MD5 44d730e6032ad75a3cc8cb32f89e4b75
SHA1 45a619061ee848b21e1329a8a2e9cf21a1a4d654
SHA512 058f10be5822f6fe308ee7e50e25d785311bb109962b854db16b1aed8888409a902b2db7e8a5e83ed9826145cfd4a0e14c106d2ace766b99955be0af6a36a20d
SSDEEP 6144:coB7UOg58/3cQPwM22RT1xBEl6JElKrKsp1DdkEj1:coB7UOi8/3cQPQ2RRN3kC
TLSH
T1E5249E067260F4F6F1636938C4F6C6E88AF27C20DF75525BBA84338F44B15A81D6AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IYVYWU.exe

Path C:\windows\SysWOW64\IYVYWU.exe
Size 208KB
SHA256 62798d7520fd410ca8bf708d59fa4ef2dc69a2b9889a285c210880dbbf61f7c1
MD5 210860810bcfb5a90744c24f316387b1
SHA1 14af79cdedb180884130e02768c2350583bb01dc
SHA512 f193b083b1dca4b2131ae2cd89c00985896bd27fff2c31df9806b55c24e173bcab13c64d47f41ac250ad21e3c72856ca450623466d957ce6f3ab85e85eff0c74
SSDEEP 6144:arYTgEMnRNL+I3YHBc/7MYRbbdfHKLkEj1:OBrI8Q8ILkC
TLSH
T1D4246B057A9AC483E0B2063685D286642675BCB7BBFBD52B3AC4331F89B15A03D45F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KJJGVGM.exe

Path C:\windows\SysWOW64\KJJGVGM.exe
Size 208KB
SHA256 2527201d00004b87c9f0f98e656d560af5ae944a4a023e7ec5fbe6ae436d8f8f
MD5 35f959bde45385286a3c58eccee20c76
SHA1 2c0f3152a08c67c79c3418b312a180dbe7780bd1
SHA512 8e12024cef8dae4e166a08fdadae59c783ade74b6e3c5faea321affdcf9a1fa524eeb296a86d5b4090c0e1937340519d04ba957d606cac454a3905cdc0b21512
SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlFEL+LOfv4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlFU+LOXkEj1
TLSH
T100247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QSKVPR.exe

Path C:\windows\SysWOW64\QSKVPR.exe
Size 208KB
SHA256 62c6300aaea42322242e4381aff4f26095abded69a31a1e19fa9b3cb22cc021a
MD5 edcb4d7b092f313b149f6434038ab131
SHA1 0c9be293d69130d0df5462124d0d7029e16fc400
SHA512 030ecacc0ff510228419c16c5e26a88296caee945125ae9cc91358e0df14753d3050cbe86e2cdee74c6d95a09678c4b7e9f75fb8a86773c8903a781b8d156851
SSDEEP 6144:arYTgEMnRNL+I3YHBc/7MYRbbdfHKUkEj1:OBrI8Q8IUkC
TLSH
T1A2246B057A9AC483E0B2063685D286642679BCB7BBFBD52B3AC4331F89B15A03D45F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIGGYIY.exe

Path C:\windows\SysWOW64\YIGGYIY.exe
Size 208KB
SHA256 89d1fd068e58b8b4fc0916949a092c35de00548eed81a529ea2eb92622175a4e
MD5 8fc1a2153e8f633d21aa647d6764b3c7
SHA1 b8d54487333630e6f9be878daa8dd4e70f96d4f1
SHA512 d8dd876c884273fdc45b552fab60a818c83ee775eeba720312a18b0dd31bb01b5f4e8d97e36294e0693a85a80ed1975590ca0e75b6a027baec055c22c902573a
SSDEEP 6144:9Iw7icXljIc6Q5R7dqdKdcyn6QK0pkEj1:9p7icXlJ6Q5R7d8KpnBkC
TLSH
T1E0247C8035C682D2DE77533108F29E8C5AFEBED1CF66A12B2684776D6E764430C17B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-212-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/548-147-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1052-262-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1052-151-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1080-117-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1080-121-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1288-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1288-83-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1512-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1512-81-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1956-260-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2044-255-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2412-82-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2412-26-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2520-193-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2520-189-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2532-152-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2580-67-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2580-84-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2668-78-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2668-87-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2680-192-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2680-187-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3308-157-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3308-119-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3484-209-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3872-86-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3872-73-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3916-158-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3916-115-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4136-122-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4224-120-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4224-77-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4552-177-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4568-191-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4568-194-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4604-79-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4604-64-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4668-239-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4672-74-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4672-80-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4728-261-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4884-259-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5396-251-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5484-156-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5484-159-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5660-213-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5660-211-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5700-85-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-123-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5792-105-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5928-195-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5928-155-0x0000000000400000-0x0000000000438000-memory.dmp

Download