Analysis
- max time kernel
89s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe
- Size 208KB
- Sample260718-b35sbsb19l
- SHA256 018f4c34f6d481c0f8f44fde100d44f70d7a1e6ccfbc2f330c813771691e9be8
- MD5 e47c043437caf873bb4b069debdcc2ea
- SHA1 e0d40f0653b3278ad4baa5913343de9a2d834799
- SHA512 965b10aed244e19d941f60f0f67e2fcadf95b9d29dfd21d88ed33e98d7cdeeead5f87d29a21cc74f661e467a7ded5f7ac90b7b787abe05af827498f5a2146478
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfv4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOHQEj1
- TLSH T17C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2096 LKXS.exe 3880 OASHOYN.exe 1300 KXFL.exe 2452 KBI.exe 4584 OJPOR.exe 2092 QGDJY.exe 2000 VHEL.exe 432 OKIHPG.exe 5932 IXN.exe 5708 ZYPDDD.exe 940 DOW.exe 6024 TOFWCVW.exe 5752 IRPIV.exe 3948 RSRNYN.exe 1952 DIX.exe 5480 WDBRQVW.exe 2012 GAPMX.exe 3188 YDTH.exe 3208 XOV.exe 5788 WZGNU.exe 124 APNN.exe 2828 EXTVTQ.exe 2220 MLYCDP.exe 1320 DLAHHUG.exe 1772 QWQGV.exe 3892 GMRX.exe 1424 TWAWQDM.exe 6004 NKFF.exe 3012 IXKPC.exe 4264 LKOYMDE.exe 3344 UTQLQ.exe 4092 DTSQTYI.exe 528 GOX.exe 2516 IED.exe 5576 XHMY.exe 720 GHODIYR.exe 6112 SXVLU.exe 3724 NLAVEQ.exe 988 CBBML.exe 1128 XOFWNM.exe 3364 RBK.exe 4888 HEURIY.exe 2116 QFWWUWW.exe 5820 HNYB.exe 3436 LVEJJT.exe 5952 RVM.exe 4516 AWOCW.exe 3348 QZX.exe 4444 KMCQ.exe 4312 TMEDDD.exe 2672 LVGI.exe 6032 PDNISB.exe 724 CNDH.exe 2744 GRBCGXL.exe 936 BBKTVHH.exe 4292 WPPC.exe 1512 AFVKJS.exe 4692 AAZ.exe 5988 ZSCWXVP.exe 2036 BQQQNEQ.exe 2716 FYWQ.exe 2964 WHYDC.exe 5680 KJH.exe 4756 TSJZUCL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\AAZ.exe AFVKJS.exe File created C:\windows\SysWOW64\FVBU.exe.bat SXBIYS.exe File opened for modification C:\windows\SysWOW64\HXA.exe SCRFX.exe File created C:\windows\SysWOW64\ZYPDDD.exe IXN.exe File opened for modification C:\windows\SysWOW64\AOLA.exe VJTLDS.exe File opened for modification C:\windows\SysWOW64\QGDJY.exe OJPOR.exe File created C:\windows\SysWOW64\FAPH.exe.bat TSJZUCL.exe File created C:\windows\SysWOW64\HUIX.exe WCF.exe File created C:\windows\SysWOW64\FYWQ.exe.bat BQQQNEQ.exe File created C:\windows\SysWOW64\NQOQR.exe.bat VVKUDRX.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe WPPC.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat WPPC.exe File created C:\windows\SysWOW64\SEMGKO.exe RBJCFYM.exe File created C:\windows\SysWOW64\NQOQR.exe VVKUDRX.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat KMCQ.exe File created C:\windows\SysWOW64\GRBCGXL.exe CNDH.exe File created C:\windows\SysWOW64\ZZO.exe.bat AOLA.exe File created C:\windows\SysWOW64\FXENNGF.exe.bat KSE.exe File created C:\windows\SysWOW64\XOV.exe.bat YDTH.exe File created C:\windows\SysWOW64\PDNISB.exe.bat LVGI.exe File created C:\windows\SysWOW64\ZZB.exe.bat RTXB.exe File opened for modification C:\windows\SysWOW64\OASHOYN.exe LKXS.exe File created C:\windows\SysWOW64\QZX.exe.bat AWOCW.exe File opened for modification C:\windows\SysWOW64\LKXS.exe 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe File created C:\windows\SysWOW64\BBKTVHH.exe.bat GRBCGXL.exe File created C:\windows\SysWOW64\KJH.exe.bat WHYDC.exe File created C:\windows\SysWOW64\KSE.exe ZZO.exe File opened for modification C:\windows\SysWOW64\APNN.exe WZGNU.exe File created C:\windows\SysWOW64\VNJXYY.exe RFCX.exe File opened for modification C:\windows\SysWOW64\ZZO.exe AOLA.exe File created C:\windows\SysWOW64\APNN.exe WZGNU.exe File opened for modification C:\windows\SysWOW64\QZX.exe AWOCW.exe File created C:\windows\SysWOW64\BBKTVHH.exe GRBCGXL.exe File created C:\windows\SysWOW64\AFVKJS.exe WPPC.exe File created C:\windows\SysWOW64\TSJZUCL.exe KJH.exe File opened for modification C:\windows\SysWOW64\GAPL.exe LFKBKDA.exe File opened for modification C:\windows\SysWOW64\VNJXYY.exe RFCX.exe File created C:\windows\SysWOW64\OASHOYN.exe LKXS.exe File created C:\windows\SysWOW64\FAPH.exe TSJZUCL.exe File created C:\windows\SysWOW64\LKXS.exe.bat 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\AAZ.exe AFVKJS.exe File created C:\windows\SysWOW64\GAU.exe FXENNGF.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat MLYCDP.exe File created C:\windows\SysWOW64\QZX.exe AWOCW.exe File created C:\windows\SysWOW64\KJH.exe WHYDC.exe File created C:\windows\SysWOW64\OIRMK.exe.bat FAPH.exe File created C:\windows\SysWOW64\HXA.exe.bat SCRFX.exe File created C:\windows\SysWOW64\FXENNGF.exe KSE.exe File created C:\windows\SysWOW64\IXN.exe.bat OKIHPG.exe File created C:\windows\SysWOW64\KMCQ.exe QZX.exe File opened for modification C:\windows\SysWOW64\AMJHGLQ.exe FZEYW.exe File opened for modification C:\windows\SysWOW64\IXN.exe OKIHPG.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe RBJCFYM.exe File created C:\windows\SysWOW64\RFCX.exe HXA.exe File opened for modification C:\windows\SysWOW64\NQOQR.exe VVKUDRX.exe File created C:\windows\SysWOW64\AAZ.exe.bat AFVKJS.exe File created C:\windows\SysWOW64\QGDJY.exe OJPOR.exe File created C:\windows\SysWOW64\IXN.exe OKIHPG.exe File created C:\windows\SysWOW64\APNN.exe.bat WZGNU.exe File created C:\windows\SysWOW64\PDVQPPL.exe OIRMK.exe File created C:\windows\SysWOW64\AMJHGLQ.exe FZEYW.exe File opened for modification C:\windows\SysWOW64\GAU.exe FXENNGF.exe File opened for modification C:\windows\SysWOW64\EXTVTQ.exe APNN.exe File created C:\windows\SysWOW64\DLAHHUG.exe MLYCDP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GHODIYR.exe.bat XHMY.exe File created C:\windows\system\AAQWQ.exe.bat AXMTCA.exe File created C:\windows\SCRFX.exe.bat JTPAMQ.exe File created C:\windows\VJTLDS.exe.bat XOU.exe File created C:\windows\system\GOX.exe.bat DTSQTYI.exe File created C:\windows\system\XHMY.exe.bat IED.exe File created C:\windows\system\XOFWNM.exe CBBML.exe File created C:\windows\YYN.exe FVBU.exe File created C:\windows\QFWWUWW.exe HEURIY.exe File created C:\windows\AWOCW.exe RVM.exe File created C:\windows\YYN.exe.bat FVBU.exe File created C:\windows\system\AAQWQ.exe AXMTCA.exe File created C:\windows\KXFL.exe.bat OASHOYN.exe File created C:\windows\KBI.exe KXFL.exe File opened for modification C:\windows\IRPIV.exe TOFWCVW.exe File created C:\windows\WDBRQVW.exe.bat DIX.exe File opened for modification C:\windows\CBBML.exe NLAVEQ.exe File created C:\windows\system\RBK.exe.bat XOFWNM.exe File created C:\windows\CNDH.exe PDNISB.exe File created C:\windows\EIEWUIZ.exe.bat AAQWQ.exe File opened for modification C:\windows\VHEL.exe QGDJY.exe File opened for modification C:\windows\YDTH.exe GAPMX.exe File created C:\windows\GMRX.exe.bat QWQGV.exe File opened for modification C:\windows\IED.exe GOX.exe File opened for modification C:\windows\LVEJJT.exe HNYB.exe File created C:\windows\KOWZIAO.exe BOUUED.exe File created C:\windows\TLKZQ.exe YYN.exe File opened for modification C:\windows\ZBMLZ.exe ZOLHC.exe File created C:\windows\system\QWQGV.exe.bat DLAHHUG.exe File opened for modification C:\windows\ZSCWXVP.exe AAZ.exe File created C:\windows\VHEL.exe.bat QGDJY.exe File created C:\windows\system\QWQGV.exe DLAHHUG.exe File created C:\windows\WHYDC.exe FYWQ.exe File created C:\windows\BOUUED.exe GAPL.exe File created C:\windows\KOWZIAO.exe.bat BOUUED.exe File created C:\windows\system\ZOLHC.exe.bat VNJXYY.exe File opened for modification C:\windows\XOU.exe NQOQR.exe File created C:\windows\system\RTXB.exe.bat GAU.exe File created C:\windows\VHEL.exe QGDJY.exe File created C:\windows\IRPIV.exe.bat TOFWCVW.exe File opened for modification C:\windows\system\WZGNU.exe XOV.exe File created C:\windows\system\WZGNU.exe.bat XOV.exe File opened for modification C:\windows\system\LVGI.exe TMEDDD.exe File created C:\windows\BOUUED.exe.bat GAPL.exe File created C:\windows\system\OKIHPG.exe.bat VHEL.exe File opened for modification C:\windows\system\QWQGV.exe DLAHHUG.exe File opened for modification C:\windows\NKFF.exe TWAWQDM.exe File created C:\windows\DTSQTYI.exe UTQLQ.exe File opened for modification C:\windows\DTSQTYI.exe UTQLQ.exe File created C:\windows\KXFL.exe OASHOYN.exe File opened for modification C:\windows\GMRX.exe QWQGV.exe File created C:\windows\system\GOX.exe DTSQTYI.exe File created C:\windows\system\NLAVEQ.exe.bat SXVLU.exe File opened for modification C:\windows\system\RBK.exe XOFWNM.exe File opened for modification C:\windows\system\RVM.exe LVEJJT.exe File created C:\windows\system\BQQQNEQ.exe ZSCWXVP.exe File created C:\windows\GAPMX.exe WDBRQVW.exe File opened for modification C:\windows\system\IXKPC.exe NKFF.exe File created C:\windows\WPPC.exe BBKTVHH.exe File created C:\windows\ZBMLZ.exe ZOLHC.exe File opened for modification C:\windows\system\RSRNYN.exe IRPIV.exe File opened for modification C:\windows\GAPMX.exe WDBRQVW.exe File created C:\windows\system\MLYCDP.exe EXTVTQ.exe File created C:\windows\CBBML.exe NLAVEQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3156 cmd.exe 2624 cmd.exe 2240 cmd.exe 780 cmd.exe 1876 cmd.exe 5244 cmd.exe 3668 cmd.exe 3840 cmd.exe 944 cmd.exe 1256 cmd.exe 2572 cmd.exe 2908 cmd.exe 2736 cmd.exe 4260 cmd.exe 912 cmd.exe 5912 cmd.exe 4936 cmd.exe 4644 cmd.exe 3464 cmd.exe 4228 cmd.exe 3028 cmd.exe 5276 cmd.exe 4124 cmd.exe 5464 cmd.exe 2848 cmd.exe 4316 cmd.exe 3748 cmd.exe 1532 cmd.exe 2536 cmd.exe 3564 cmd.exe 4788 cmd.exe 5632 cmd.exe 240 cmd.exe 1556 cmd.exe 3708 cmd.exe 6128 cmd.exe 4772 cmd.exe 2564 cmd.exe 2732 cmd.exe 3372 cmd.exe 5132 cmd.exe 2816 cmd.exe 4564 cmd.exe 1468 cmd.exe 2432 cmd.exe 2896 cmd.exe 5304 cmd.exe 5252 cmd.exe 3692 cmd.exe 4376 cmd.exe 3396 cmd.exe 4368 cmd.exe 4764 cmd.exe 2040 cmd.exe 4528 cmd.exe 3416 cmd.exe 4372 cmd.exe 424 cmd.exe 2104 cmd.exe 4224 cmd.exe 5320 cmd.exe 1820 cmd.exe 5144 cmd.exe 2212 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1720 2820 WerFault.exe 87 4260 2096 WerFault.exe 93 5064 3880 WerFault.exe 99 3612 1300 WerFault.exe 104 4936 2452 WerFault.exe 109 2272 4584 WerFault.exe 114 4816 2092 WerFault.exe 119 3008 2000 WerFault.exe 124 4924 432 WerFault.exe 129 4496 5932 WerFault.exe 134 716 5708 WerFault.exe 139 4752 940 WerFault.exe 144 4412 5392 WerFault.exe 149 2808 6024 WerFault.exe 154 1640 5752 WerFault.exe 159 2992 3948 WerFault.exe 164 4552 1952 WerFault.exe 169 3692 5480 WerFault.exe 174 2912 2012 WerFault.exe 179 1536 3188 WerFault.exe 184 4788 3208 WerFault.exe 189 4312 5788 WerFault.exe 194 5816 124 WerFault.exe 199 2756 2828 WerFault.exe 204 1776 2220 WerFault.exe 209 4484 1320 WerFault.exe 214 1420 1772 WerFault.exe 219 2128 3892 WerFault.exe 224 5108 1424 WerFault.exe 229 3564 6004 WerFault.exe 234 1964 3012 WerFault.exe 239 4440 4264 WerFault.exe 244 4752 3344 WerFault.exe 249 4412 4092 WerFault.exe 254 1268 528 WerFault.exe 259 4484 2516 WerFault.exe 264 1144 5576 WerFault.exe 269 3032 720 WerFault.exe 275 1512 6112 WerFault.exe 280 4124 3724 WerFault.exe 285 1528 988 WerFault.exe 290 4988 1128 WerFault.exe 295 1588 3364 WerFault.exe 300 4808 4888 WerFault.exe 305 5572 2116 WerFault.exe 310 2888 5820 WerFault.exe 315 2760 3436 WerFault.exe 320 3412 5952 WerFault.exe 325 5208 4516 WerFault.exe 330 2980 3348 WerFault.exe 335 1296 4444 WerFault.exe 340 464 4312 WerFault.exe 345 2412 2672 WerFault.exe 350 4980 6032 WerFault.exe 355 2956 724 WerFault.exe 360 3720 2744 WerFault.exe 365 5144 936 WerFault.exe 370 2004 4292 WerFault.exe 375 4772 1512 WerFault.exe 380 4636 4692 WerFault.exe 385 4240 5988 WerFault.exe 390 5728 2036 WerFault.exe 395 2916 2716 WerFault.exe 400 1948 2964 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBJCFYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWQGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOFWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWAWQDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAQWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRPIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLYCDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSJZUCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXTVTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJSTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBANZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSRNYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVEJJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMJHGLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKOYMDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHYDC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe 2820 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe 2096 LKXS.exe 2096 LKXS.exe 3880 OASHOYN.exe 3880 OASHOYN.exe 1300 KXFL.exe 1300 KXFL.exe 2452 KBI.exe 2452 KBI.exe 4584 OJPOR.exe 4584 OJPOR.exe 2092 QGDJY.exe 2092 QGDJY.exe 2000 VHEL.exe 2000 VHEL.exe 432 OKIHPG.exe 432 OKIHPG.exe 5932 IXN.exe 5932 IXN.exe 5708 ZYPDDD.exe 5708 ZYPDDD.exe 5392 YBANZ.exe 5392 YBANZ.exe 6024 TOFWCVW.exe 6024 TOFWCVW.exe 5752 IRPIV.exe 5752 IRPIV.exe 3948 RSRNYN.exe 3948 RSRNYN.exe 1952 DIX.exe 1952 DIX.exe 5480 WDBRQVW.exe 5480 WDBRQVW.exe 2012 GAPMX.exe 2012 GAPMX.exe 3188 YDTH.exe 3188 YDTH.exe 3208 XOV.exe 3208 XOV.exe 5788 WZGNU.exe 5788 WZGNU.exe 124 APNN.exe 124 APNN.exe 2828 EXTVTQ.exe 2828 EXTVTQ.exe 2220 MLYCDP.exe 2220 MLYCDP.exe 1320 DLAHHUG.exe 1320 DLAHHUG.exe 1772 QWQGV.exe 1772 QWQGV.exe 3892 GMRX.exe 3892 GMRX.exe 1424 TWAWQDM.exe 1424 TWAWQDM.exe 6004 NKFF.exe 6004 NKFF.exe 3012 IXKPC.exe 3012 IXKPC.exe 4264 LKOYMDE.exe 4264 LKOYMDE.exe 3344 UTQLQ.exe 3344 UTQLQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2820 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe 2820 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe 2096 LKXS.exe 2096 LKXS.exe 3880 OASHOYN.exe 3880 OASHOYN.exe 1300 KXFL.exe 1300 KXFL.exe 2452 KBI.exe 2452 KBI.exe 4584 OJPOR.exe 4584 OJPOR.exe 2092 QGDJY.exe 2092 QGDJY.exe 2000 VHEL.exe 2000 VHEL.exe 432 OKIHPG.exe 432 OKIHPG.exe 5932 IXN.exe 5932 IXN.exe 5708 ZYPDDD.exe 5708 ZYPDDD.exe 5392 YBANZ.exe 5392 YBANZ.exe 6024 TOFWCVW.exe 6024 TOFWCVW.exe 5752 IRPIV.exe 5752 IRPIV.exe 3948 RSRNYN.exe 3948 RSRNYN.exe 1952 DIX.exe 1952 DIX.exe 5480 WDBRQVW.exe 5480 WDBRQVW.exe 2012 GAPMX.exe 2012 GAPMX.exe 3188 YDTH.exe 3188 YDTH.exe 3208 XOV.exe 3208 XOV.exe 5788 WZGNU.exe 5788 WZGNU.exe 124 APNN.exe 124 APNN.exe 2828 EXTVTQ.exe 2828 EXTVTQ.exe 2220 MLYCDP.exe 2220 MLYCDP.exe 1320 DLAHHUG.exe 1320 DLAHHUG.exe 1772 QWQGV.exe 1772 QWQGV.exe 3892 GMRX.exe 3892 GMRX.exe 1424 TWAWQDM.exe 1424 TWAWQDM.exe 6004 NKFF.exe 6004 NKFF.exe 3012 IXKPC.exe 3012 IXKPC.exe 4264 LKOYMDE.exe 4264 LKOYMDE.exe 3344 UTQLQ.exe 3344 UTQLQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2736 2820 2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe 89 PID 2736 wrote to memory of 2096 2736 cmd.exe 93 PID 2096 wrote to memory of 5808 2096 LKXS.exe 95 PID 5808 wrote to memory of 3880 5808 cmd.exe 99 PID 3880 wrote to memory of 4156 3880 OASHOYN.exe 100 PID 4156 wrote to memory of 1300 4156 cmd.exe 104 PID 1300 wrote to memory of 6124 1300 KXFL.exe 105 PID 6124 wrote to memory of 2452 6124 cmd.exe 109 PID 2452 wrote to memory of 1532 2452 KBI.exe 110 PID 1532 wrote to memory of 4584 1532 cmd.exe 114 PID 4584 wrote to memory of 1092 4584 OJPOR.exe 115 PID 1092 wrote to memory of 2092 1092 cmd.exe 119 PID 2092 wrote to memory of 3028 2092 QGDJY.exe 120 PID 3028 wrote to memory of 2000 3028 cmd.exe 124 PID 2000 wrote to memory of 4372 2000 VHEL.exe 125 PID 4372 wrote to memory of 432 4372 cmd.exe 129 PID 432 wrote to memory of 424 432 OKIHPG.exe 130 PID 424 wrote to memory of 5932 424 cmd.exe 134 PID 5932 wrote to memory of 4128 5932 IXN.exe 135 PID 4128 wrote to memory of 5708 4128 cmd.exe 139 PID 5708 wrote to memory of 3504 5708 ZYPDDD.exe 140 PID 3504 wrote to memory of 940 3504 cmd.exe 144 PID 240 wrote to memory of 5392 240 cmd.exe 149 PID 5392 wrote to memory of 2732 5392 YBANZ.exe 150 PID 2732 wrote to memory of 6024 2732 cmd.exe 154 PID 6024 wrote to memory of 5756 6024 TOFWCVW.exe 155 PID 5756 wrote to memory of 5752 5756 cmd.exe 159 PID 5752 wrote to memory of 800 5752 IRPIV.exe 160 PID 800 wrote to memory of 3948 800 cmd.exe 164 PID 3948 wrote to memory of 1208 3948 RSRNYN.exe 165 PID 1208 wrote to memory of 1952 1208 cmd.exe 169 PID 1952 wrote to memory of 4900 1952 DIX.exe 170 PID 4900 wrote to memory of 5480 4900 cmd.exe 174 PID 5480 wrote to memory of 2104 5480 WDBRQVW.exe 175 PID 2104 wrote to memory of 2012 2104 cmd.exe 179 PID 2012 wrote to memory of 948 2012 GAPMX.exe 180 PID 948 wrote to memory of 3188 948 cmd.exe 184 PID 3188 wrote to memory of 5132 3188 YDTH.exe 185 PID 5132 wrote to memory of 3208 5132 cmd.exe 189 PID 3208 wrote to memory of 1380 3208 XOV.exe 190 PID 1380 wrote to memory of 5788 1380 cmd.exe 194 PID 5788 wrote to memory of 2536 5788 WZGNU.exe 195 PID 2536 wrote to memory of 124 2536 cmd.exe 199 PID 124 wrote to memory of 508 124 APNN.exe 200 PID 508 wrote to memory of 2828 508 cmd.exe 204 PID 2828 wrote to memory of 4260 2828 EXTVTQ.exe 205 PID 4260 wrote to memory of 2220 4260 cmd.exe 209 PID 2220 wrote to memory of 5620 2220 MLYCDP.exe 210 PID 5620 wrote to memory of 1320 5620 cmd.exe 214 PID 1320 wrote to memory of 2420 1320 DLAHHUG.exe 215 PID 2420 wrote to memory of 1772 2420 cmd.exe 219 PID 1772 wrote to memory of 2816 1772 QWQGV.exe 220 PID 2816 wrote to memory of 3892 2816 cmd.exe 224 PID 3892 wrote to memory of 1516 3892 GMRX.exe 225 PID 1516 wrote to memory of 1424 1516 cmd.exe 229 PID 1424 wrote to memory of 1556 1424 TWAWQDM.exe 230 PID 1556 wrote to memory of 6004 1556 cmd.exe 234 PID 6004 wrote to memory of 5904 6004 NKFF.exe 235 PID 5904 wrote to memory of 3012 5904 cmd.exe 239 PID 3012 wrote to memory of 3156 3012 IXKPC.exe 240 PID 3156 wrote to memory of 4264 3156 cmd.exe 244 PID 4264 wrote to memory of 3700 4264 LKOYMDE.exe 245 PID 3700 wrote to memory of 3344 3700 cmd.exe 249 PID 3344 wrote to memory of 4564 3344 UTQLQ.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e47c043437caf873bb4b069debdcc2ea_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKXS.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\SysWOW64\LKXS.exeC:\windows\system32\LKXS.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OASHOYN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\SysWOW64\OASHOYN.exeC:\windows\system32\OASHOYN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXFL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\KXFL.exeC:\windows\KXFL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KBI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\KBI.exeC:\windows\KBI.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJPOR.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\windows\system\OJPOR.exeC:\windows\system\OJPOR.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGDJY.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\SysWOW64\QGDJY.exeC:\windows\system32\QGDJY.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHEL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\VHEL.exeC:\windows\VHEL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXN.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\SysWOW64\IXN.exeC:\windows\system32\IXN.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\DOW.exeC:\windows\DOW.exe23⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBANZ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\system\YBANZ.exeC:\windows\system\YBANZ.exe25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\DIX.exeC:\windows\DIX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDBRQVW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\WDBRQVW.exeC:\windows\WDBRQVW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\windows\YDTH.exeC:\windows\YDTH.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\SysWOW64\APNN.exeC:\windows\system32\APNN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\GMRX.exeC:\windows\GMRX.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKFF.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\NKFF.exeC:\windows\NKFF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTQLQ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\UTQLQ.exeC:\windows\UTQLQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTSQTYI.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4564 -
C:\windows\DTSQTYI.exeC:\windows\DTSQTYI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5244 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1468 -
C:\windows\IED.exeC:\windows\IED.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "72⤵PID:3580
-
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHODIYR.exe.bat" "74⤵PID:5684
-
C:\windows\GHODIYR.exeC:\windows\GHODIYR.exe75⤵
- Executes dropped EXE
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXVLU.exe.bat" "76⤵PID:3420
-
C:\windows\system\SXVLU.exeC:\windows\system\SXVLU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBBML.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3564 -
C:\windows\CBBML.exeC:\windows\CBBML.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5276 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBK.exe.bat" "84⤵PID:5236
-
C:\windows\system\RBK.exeC:\windows\system\RBK.exe85⤵
- Executes dropped EXE
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "86⤵PID:236
-
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFWWUWW.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3668 -
C:\windows\QFWWUWW.exeC:\windows\QFWWUWW.exe89⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "90⤵
- Executes a command shell one-liner
PID:2432 -
C:\windows\HNYB.exeC:\windows\HNYB.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVEJJT.exe.bat" "92⤵PID:1276
-
C:\windows\LVEJJT.exeC:\windows\LVEJJT.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVM.exe.bat" "94⤵PID:4212
-
C:\windows\system\RVM.exeC:\windows\system\RVM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWOCW.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\windows\AWOCW.exeC:\windows\AWOCW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "98⤵PID:5108
-
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2212 -
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVGI.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:244 -
C:\windows\system\LVGI.exeC:\windows\system\LVGI.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDNISB.exe.bat" "106⤵
- Executes a command shell one-liner
PID:912 -
C:\windows\SysWOW64\PDNISB.exeC:\windows\system32\PDNISB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNDH.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\windows\CNDH.exeC:\windows\CNDH.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GRBCGXL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1196 -
C:\windows\SysWOW64\GRBCGXL.exeC:\windows\system32\GRBCGXL.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBKTVHH.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5912 -
C:\windows\SysWOW64\BBKTVHH.exeC:\windows\system32\BBKTVHH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4936 -
C:\windows\WPPC.exeC:\windows\WPPC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2624 -
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "118⤵PID:3048
-
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSCWXVP.exe.bat" "120⤵PID:5504
-
C:\windows\ZSCWXVP.exeC:\windows\ZSCWXVP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-