Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe
- Size 448KB
- Sample260718-eflbysax6s
- SHA256 3bcfde376a498af10a6999d04a4aa4f04c90bf6db8be1784d158f9eee556cf7d
- MD5 5297517d201003357f45f82d5dc28d3e
- SHA1 bfef181ba799759011d0025f3631a6a34ee51abf
- SHA512 6cb75d34c32496e8641755f5ba135f0c3eb2b4b46393029f47003161063af3cad95d78ae3ee098e0a8ed9dd139354713bc84c48752afde9a92f19e3e3ff560ab
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO6kEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LO6kmZzcukG2/
- TLSH T1D3A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 624 DRAGISV.exe 4240 ZJRXQKE.exe 3304 JHXRXS.exe 4432 HSHHG.exe 3020 IVYVUP.exe 5064 FWZFY.exe 2304 PTFS.exe 5952 IMUD.exe 4804 BPYHCL.exe 1272 QFZYJ.exe 3756 CVSYEK.exe 4268 LVUDIHS.exe 5728 FOKORII.exe 2556 JRIJZ.exe 4500 HOTM.exe 5824 XFUETCH.exe 2036 KPLCH.exe 1132 LKOYMDE.exe 2772 TYBNXBA.exe 5732 BDGTIA.exe 5696 JRSASY.exe 5508 QHTR.exe 3428 CPAZDMC.exe 4912 VSEVRC.exe 4736 YAK.exe 4228 HOKR.exe 5788 KWRSJS.exe 1780 WOGCAS.exe 1716 LEHC.exe 4636 PUOCLYJ.exe 6072 BCVC.exe 5288 MVYVG.exe 4080 QLE.exe 2644 UTLDE.exe 2640 TEOT.exe 5692 CMQYQM.exe 3148 NFTRQBK.exe 1084 XCYLGK.exe 5384 SQD.exe 3624 YQL.exe 5940 HQNNDJL.exe 2468 WTWA.exe 2028 OUYFZT.exe 5504 GXC.exe 3708 CZT.exe 2456 CNL.exe 5888 PQBMIK.exe 1528 GYD.exe 2144 EYLFV.exe 5372 VZFKGP.exe 4788 LCWO.exe 6064 YAW.exe 2232 EAEOC.exe 2784 PSHHLX.exe 3932 TIN.exe 1444 UDRKCFN.exe 1768 YUYKO.exe 3436 YZYZQ.exe 2324 PMIRGZ.exe 2420 TPHM.exe 5256 NDMVQS.exe 1948 TDT.exe 720 FWOC.exe 5348 ZJTLRB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\PFPJ.exe JFHNOBO.exe File created C:\windows\SysWOW64\TEATYQ.exe.bat NIA.exe File created C:\windows\SysWOW64\OZDRITB.exe AXZLDB.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe BDGTIA.exe File created C:\windows\SysWOW64\VSEVRC.exe CPAZDMC.exe File created C:\windows\SysWOW64\UTLDE.exe QLE.exe File created C:\windows\SysWOW64\EYLFV.exe.bat GYD.exe File created C:\windows\SysWOW64\NIA.exe JSUTID.exe File opened for modification C:\windows\SysWOW64\YPFXWHV.exe QCAQMIA.exe File created C:\windows\SysWOW64\UNTDZ.exe.bat UHTP.exe File created C:\windows\SysWOW64\YAK.exe VSEVRC.exe File created C:\windows\SysWOW64\QLE.exe.bat MVYVG.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat FJB.exe File created C:\windows\SysWOW64\QCAQMIA.exe KBSCC.exe File created C:\windows\SysWOW64\HPJB.exe HJI.exe File opened for modification C:\windows\SysWOW64\UNTDZ.exe UHTP.exe File opened for modification C:\windows\SysWOW64\HSHHG.exe JHXRXS.exe File created C:\windows\SysWOW64\XFUETCH.exe HOTM.exe File opened for modification C:\windows\SysWOW64\UTLDE.exe QLE.exe File created C:\windows\SysWOW64\SQD.exe XCYLGK.exe File created C:\windows\SysWOW64\WTWA.exe HQNNDJL.exe File created C:\windows\SysWOW64\DRAGISV.exe.bat 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe File created C:\windows\SysWOW64\UTLDE.exe.bat QLE.exe File created C:\windows\SysWOW64\EPSLZBG.exe BUNBPB.exe File opened for modification C:\windows\SysWOW64\LOYSJCD.exe IGP.exe File created C:\windows\SysWOW64\LOYSJCD.exe.bat IGP.exe File opened for modification C:\windows\SysWOW64\HPJB.exe HJI.exe File created C:\windows\SysWOW64\KIC.exe UNTDZ.exe File created C:\windows\SysWOW64\HSHHG.exe JHXRXS.exe File created C:\windows\SysWOW64\BPYHCL.exe IMUD.exe File created C:\windows\SysWOW64\WTWA.exe.bat HQNNDJL.exe File created C:\windows\SysWOW64\IGP.exe.bat GIBJ.exe File created C:\windows\SysWOW64\BQW.exe YVF.exe File created C:\windows\SysWOW64\HSHHG.exe.bat JHXRXS.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe TEOT.exe File opened for modification C:\windows\SysWOW64\NIA.exe JSUTID.exe File created C:\windows\SysWOW64\LOYSJCD.exe IGP.exe File opened for modification C:\windows\SysWOW64\KIC.exe UNTDZ.exe File opened for modification C:\windows\SysWOW64\BPYHCL.exe IMUD.exe File created C:\windows\SysWOW64\BPYHCL.exe.bat IMUD.exe File created C:\windows\SysWOW64\EYLFV.exe GYD.exe File created C:\windows\SysWOW64\YPFXWHV.exe QCAQMIA.exe File created C:\windows\SysWOW64\BQW.exe.bat YVF.exe File created C:\windows\SysWOW64\TFP.exe HPJB.exe File created C:\windows\SysWOW64\IVYVUP.exe HSHHG.exe File created C:\windows\SysWOW64\QFZYJ.exe.bat BPYHCL.exe File created C:\windows\SysWOW64\JRSASY.exe BDGTIA.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe QBXQG.exe File created C:\windows\SysWOW64\IGP.exe GIBJ.exe File created C:\windows\SysWOW64\GTM.exe.bat QIN.exe File created C:\windows\SysWOW64\YPFXWHV.exe.bat QCAQMIA.exe File created C:\windows\SysWOW64\UNTDZ.exe UHTP.exe File opened for modification C:\windows\SysWOW64\DRAGISV.exe 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe File created C:\windows\SysWOW64\VSEVRC.exe.bat CPAZDMC.exe File created C:\windows\SysWOW64\PSHHLX.exe EAEOC.exe File created C:\windows\SysWOW64\JZHHNO.exe FJB.exe File created C:\windows\SysWOW64\NIA.exe.bat JSUTID.exe File opened for modification C:\windows\SysWOW64\IGP.exe GIBJ.exe File opened for modification C:\windows\SysWOW64\OZDRITB.exe AXZLDB.exe File created C:\windows\SysWOW64\CMQYQM.exe.bat TEOT.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat EAEOC.exe File opened for modification C:\windows\SysWOW64\JZHHNO.exe FJB.exe File opened for modification C:\windows\SysWOW64\TEATYQ.exe NIA.exe File created C:\windows\SysWOW64\QCAQMIA.exe.bat KBSCC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SOZIK.exe.bat SJZTI.exe File created C:\windows\system\WOGCAS.exe KWRSJS.exe File created C:\windows\system\VZFKGP.exe EYLFV.exe File created C:\windows\GIBJ.exe.bat NPUQ.exe File opened for modification C:\windows\system\BWOB.exe BQW.exe File created C:\windows\system\RRMPMEJ.exe XZXWUET.exe File created C:\windows\CNL.exe CZT.exe File opened for modification C:\windows\system\JHXRXS.exe ZJRXQKE.exe File opened for modification C:\windows\CVSYEK.exe QFZYJ.exe File created C:\windows\LVUDIHS.exe CVSYEK.exe File created C:\windows\LEHC.exe.bat WOGCAS.exe File created C:\windows\system\PUOCLYJ.exe LEHC.exe File created C:\windows\system\PUOCLYJ.exe.bat LEHC.exe File created C:\windows\system\FJB.exe ZJTLRB.exe File created C:\windows\system\TEOT.exe UTLDE.exe File created C:\windows\system\NFTRQBK.exe CMQYQM.exe File opened for modification C:\windows\system\UDRKCFN.exe TIN.exe File created C:\windows\system\YZYZQ.exe YUYKO.exe File opened for modification C:\windows\system\FJB.exe ZJTLRB.exe File created C:\windows\AXZLDB.exe PEESV.exe File opened for modification C:\windows\EXCUMEQ.exe OZDRITB.exe File created C:\windows\system\BWOB.exe.bat BQW.exe File opened for modification C:\windows\LCWO.exe VZFKGP.exe File opened for modification C:\windows\system\HOTM.exe JRIJZ.exe File opened for modification C:\windows\system\GXC.exe OUYFZT.exe File opened for modification C:\windows\TYBNXBA.exe LKOYMDE.exe File created C:\windows\system\CPAZDMC.exe.bat QHTR.exe File created C:\windows\YUYKO.exe UDRKCFN.exe File created C:\windows\FWOC.exe TDT.exe File created C:\windows\system\DYLA.exe TFP.exe File created C:\windows\system\XTEPTR.exe IYV.exe File opened for modification C:\windows\system\RRMPMEJ.exe XZXWUET.exe File created C:\windows\LCWO.exe.bat VZFKGP.exe File created C:\windows\system\KWRSJS.exe.bat HOKR.exe File created C:\windows\system\FWZFY.exe.bat IVYVUP.exe File opened for modification C:\windows\KPLCH.exe XFUETCH.exe File created C:\windows\TYBNXBA.exe.bat LKOYMDE.exe File created C:\windows\system\YZYZQ.exe.bat YUYKO.exe File created C:\windows\system\PQBMIK.exe.bat CNL.exe File created C:\windows\system\QHTR.exe.bat JRSASY.exe File opened for modification C:\windows\system\WOGCAS.exe KWRSJS.exe File opened for modification C:\windows\system\JRIJZ.exe FOKORII.exe File created C:\windows\system\HOTM.exe JRIJZ.exe File created C:\windows\XZXWUET.exe.bat XTEPTR.exe File opened for modification C:\windows\system\FOKORII.exe LVUDIHS.exe File created C:\windows\system\CPAZDMC.exe QHTR.exe File created C:\windows\GYD.exe.bat PQBMIK.exe File opened for modification C:\windows\system\VZFKGP.exe EYLFV.exe File opened for modification C:\windows\system\TIN.exe PSHHLX.exe File opened for modification C:\windows\JSUTID.exe PFPJ.exe File opened for modification C:\windows\GIBJ.exe NPUQ.exe File created C:\windows\XZXWUET.exe XTEPTR.exe File created C:\windows\system\FWZFY.exe IVYVUP.exe File created C:\windows\system\YVF.exe YPFXWHV.exe File opened for modification C:\windows\SOZIK.exe SJZTI.exe File created C:\windows\system\UHTP.exe.bat RRMPMEJ.exe File created C:\windows\system\FOKORII.exe.bat LVUDIHS.exe File created C:\windows\GYD.exe PQBMIK.exe File opened for modification C:\windows\system\XLCZENO.exe RAGAZV.exe File opened for modification C:\windows\IYV.exe DYLA.exe File created C:\windows\system\UHTP.exe RRMPMEJ.exe File created C:\windows\system\PTFS.exe FWZFY.exe File created C:\windows\system\KWRSJS.exe HOKR.exe File created C:\windows\BCVC.exe PUOCLYJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5844 cmd.exe 2156 cmd.exe 928 cmd.exe 4348 cmd.exe 2788 cmd.exe 5596 cmd.exe 3704 cmd.exe 1268 cmd.exe 2056 cmd.exe 2856 cmd.exe 3944 cmd.exe 5184 cmd.exe 4572 cmd.exe 3404 cmd.exe 4684 cmd.exe 4652 cmd.exe 2956 cmd.exe 1356 cmd.exe 3896 cmd.exe 3152 cmd.exe 5176 cmd.exe 1480 cmd.exe 1872 cmd.exe 3580 cmd.exe 2544 cmd.exe 3476 cmd.exe 1220 cmd.exe 5880 cmd.exe 4968 cmd.exe 5068 cmd.exe 5652 cmd.exe 5368 cmd.exe 956 cmd.exe 5896 cmd.exe 2528 cmd.exe 2328 cmd.exe 2400 cmd.exe 2260 cmd.exe 1488 cmd.exe 1472 cmd.exe 2164 cmd.exe 1568 cmd.exe 2652 cmd.exe 5516 cmd.exe 2136 cmd.exe 2184 cmd.exe 3080 cmd.exe 1904 cmd.exe 5532 cmd.exe 908 cmd.exe 6096 cmd.exe 5860 cmd.exe 1812 cmd.exe 6024 cmd.exe 1944 cmd.exe 5836 cmd.exe 3232 cmd.exe 3860 cmd.exe 4860 cmd.exe 4936 cmd.exe 4104 cmd.exe 5552 cmd.exe 3392 cmd.exe 3244 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1252 5816 WerFault.exe 87 3364 624 WerFault.exe 93 6076 4240 WerFault.exe 99 1872 3304 WerFault.exe 104 1560 4432 WerFault.exe 109 5644 3020 WerFault.exe 114 2900 5064 WerFault.exe 119 4920 2304 WerFault.exe 124 3332 5952 WerFault.exe 129 1704 4804 WerFault.exe 134 2232 1272 WerFault.exe 139 4076 3756 WerFault.exe 144 5456 4268 WerFault.exe 149 3148 5728 WerFault.exe 154 6120 2556 WerFault.exe 159 4548 4500 WerFault.exe 164 5744 5824 WerFault.exe 169 5080 2036 WerFault.exe 174 3316 1132 WerFault.exe 179 4788 2772 WerFault.exe 184 3472 5732 WerFault.exe 189 5792 5696 WerFault.exe 194 1200 5508 WerFault.exe 199 4964 3428 WerFault.exe 204 4748 4912 WerFault.exe 209 532 4736 WerFault.exe 214 2760 4228 WerFault.exe 219 3052 5788 WerFault.exe 224 5540 1780 WerFault.exe 229 1380 1716 WerFault.exe 234 4440 4636 WerFault.exe 239 5612 6072 WerFault.exe 244 3700 5288 WerFault.exe 249 3568 4080 WerFault.exe 254 2012 2644 WerFault.exe 259 1444 2640 WerFault.exe 264 3068 5692 WerFault.exe 269 3704 3148 WerFault.exe 274 5080 1084 WerFault.exe 279 2840 5384 WerFault.exe 284 3896 3624 WerFault.exe 289 4376 5940 WerFault.exe 294 6104 2468 WerFault.exe 299 5268 2028 WerFault.exe 304 992 5504 WerFault.exe 309 4176 3708 WerFault.exe 314 2320 2456 WerFault.exe 319 5040 5888 WerFault.exe 324 2252 1528 WerFault.exe 329 5016 2144 WerFault.exe 334 3536 5372 WerFault.exe 339 4792 4788 WerFault.exe 344 3720 6064 WerFault.exe 349 1812 2232 WerFault.exe 354 2300 2784 WerFault.exe 359 5812 3932 WerFault.exe 364 2560 1444 WerFault.exe 369 2816 1768 WerFault.exe 374 4348 3436 WerFault.exe 379 3924 2324 WerFault.exe 384 1472 2420 WerFault.exe 389 4896 5256 WerFault.exe 394 4816 1948 WerFault.exe 399 3200 720 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFHNOBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUNBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHXRXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXZLDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZDRITB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAGAZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRSASY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLCZENO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBSCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPFXWHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJZTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPYHCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZFKGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWRSJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWZFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPLCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSHHLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEESV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5816 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe 5816 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe 624 DRAGISV.exe 624 DRAGISV.exe 4240 ZJRXQKE.exe 4240 ZJRXQKE.exe 3304 JHXRXS.exe 3304 JHXRXS.exe 4432 HSHHG.exe 4432 HSHHG.exe 3020 IVYVUP.exe 3020 IVYVUP.exe 5064 FWZFY.exe 5064 FWZFY.exe 2304 PTFS.exe 2304 PTFS.exe 5952 IMUD.exe 5952 IMUD.exe 4804 BPYHCL.exe 4804 BPYHCL.exe 1272 QFZYJ.exe 1272 QFZYJ.exe 3756 CVSYEK.exe 3756 CVSYEK.exe 4268 LVUDIHS.exe 4268 LVUDIHS.exe 5728 FOKORII.exe 5728 FOKORII.exe 2556 JRIJZ.exe 2556 JRIJZ.exe 4500 HOTM.exe 4500 HOTM.exe 5824 XFUETCH.exe 5824 XFUETCH.exe 2036 KPLCH.exe 2036 KPLCH.exe 1132 LKOYMDE.exe 1132 LKOYMDE.exe 2772 TYBNXBA.exe 2772 TYBNXBA.exe 5732 BDGTIA.exe 5732 BDGTIA.exe 5696 JRSASY.exe 5696 JRSASY.exe 5508 QHTR.exe 5508 QHTR.exe 3428 CPAZDMC.exe 3428 CPAZDMC.exe 4912 VSEVRC.exe 4912 VSEVRC.exe 4736 YAK.exe 4736 YAK.exe 4228 HOKR.exe 4228 HOKR.exe 5788 KWRSJS.exe 5788 KWRSJS.exe 1780 WOGCAS.exe 1780 WOGCAS.exe 1716 LEHC.exe 1716 LEHC.exe 4636 PUOCLYJ.exe 4636 PUOCLYJ.exe 6072 BCVC.exe 6072 BCVC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5816 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe 5816 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe 624 DRAGISV.exe 624 DRAGISV.exe 4240 ZJRXQKE.exe 4240 ZJRXQKE.exe 3304 JHXRXS.exe 3304 JHXRXS.exe 4432 HSHHG.exe 4432 HSHHG.exe 3020 IVYVUP.exe 3020 IVYVUP.exe 5064 FWZFY.exe 5064 FWZFY.exe 2304 PTFS.exe 2304 PTFS.exe 5952 IMUD.exe 5952 IMUD.exe 4804 BPYHCL.exe 4804 BPYHCL.exe 1272 QFZYJ.exe 1272 QFZYJ.exe 3756 CVSYEK.exe 3756 CVSYEK.exe 4268 LVUDIHS.exe 4268 LVUDIHS.exe 5728 FOKORII.exe 5728 FOKORII.exe 2556 JRIJZ.exe 2556 JRIJZ.exe 4500 HOTM.exe 4500 HOTM.exe 5824 XFUETCH.exe 5824 XFUETCH.exe 2036 KPLCH.exe 2036 KPLCH.exe 1132 LKOYMDE.exe 1132 LKOYMDE.exe 2772 TYBNXBA.exe 2772 TYBNXBA.exe 5732 BDGTIA.exe 5732 BDGTIA.exe 5696 JRSASY.exe 5696 JRSASY.exe 5508 QHTR.exe 5508 QHTR.exe 3428 CPAZDMC.exe 3428 CPAZDMC.exe 4912 VSEVRC.exe 4912 VSEVRC.exe 4736 YAK.exe 4736 YAK.exe 4228 HOKR.exe 4228 HOKR.exe 5788 KWRSJS.exe 5788 KWRSJS.exe 1780 WOGCAS.exe 1780 WOGCAS.exe 1716 LEHC.exe 1716 LEHC.exe 4636 PUOCLYJ.exe 4636 PUOCLYJ.exe 6072 BCVC.exe 6072 BCVC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5816 wrote to memory of 1432 5816 2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe 89 PID 1432 wrote to memory of 624 1432 cmd.exe 93 PID 624 wrote to memory of 1288 624 DRAGISV.exe 95 PID 1288 wrote to memory of 4240 1288 cmd.exe 99 PID 4240 wrote to memory of 5264 4240 ZJRXQKE.exe 100 PID 5264 wrote to memory of 3304 5264 cmd.exe 104 PID 3304 wrote to memory of 5880 3304 JHXRXS.exe 105 PID 5880 wrote to memory of 4432 5880 cmd.exe 109 PID 4432 wrote to memory of 3248 4432 HSHHG.exe 110 PID 3248 wrote to memory of 3020 3248 cmd.exe 114 PID 3020 wrote to memory of 1796 3020 IVYVUP.exe 115 PID 1796 wrote to memory of 5064 1796 cmd.exe 119 PID 5064 wrote to memory of 2040 5064 FWZFY.exe 120 PID 2040 wrote to memory of 2304 2040 cmd.exe 124 PID 2304 wrote to memory of 4968 2304 PTFS.exe 125 PID 4968 wrote to memory of 5952 4968 cmd.exe 129 PID 5952 wrote to memory of 5628 5952 IMUD.exe 130 PID 5628 wrote to memory of 4804 5628 cmd.exe 134 PID 4804 wrote to memory of 3096 4804 BPYHCL.exe 135 PID 3096 wrote to memory of 1272 3096 cmd.exe 139 PID 1272 wrote to memory of 2652 1272 QFZYJ.exe 140 PID 2652 wrote to memory of 3756 2652 cmd.exe 144 PID 3756 wrote to memory of 2528 3756 CVSYEK.exe 145 PID 4268 wrote to memory of 6096 4268 LVUDIHS.exe 150 PID 6096 wrote to memory of 5728 6096 cmd.exe 154 PID 5728 wrote to memory of 5068 5728 FOKORII.exe 155 PID 5068 wrote to memory of 2556 5068 cmd.exe 159 PID 2556 wrote to memory of 3240 2556 JRIJZ.exe 160 PID 3240 wrote to memory of 4500 3240 cmd.exe 164 PID 4500 wrote to memory of 4564 4500 HOTM.exe 165 PID 4564 wrote to memory of 5824 4564 cmd.exe 169 PID 5824 wrote to memory of 1376 5824 XFUETCH.exe 170 PID 1376 wrote to memory of 2036 1376 cmd.exe 174 PID 2036 wrote to memory of 5516 2036 KPLCH.exe 175 PID 5516 wrote to memory of 1132 5516 cmd.exe 179 PID 1132 wrote to memory of 5972 1132 LKOYMDE.exe 180 PID 5972 wrote to memory of 2772 5972 cmd.exe 184 PID 2772 wrote to memory of 1868 2772 TYBNXBA.exe 185 PID 1868 wrote to memory of 5732 1868 cmd.exe 189 PID 5732 wrote to memory of 4776 5732 BDGTIA.exe 190 PID 4776 wrote to memory of 5696 4776 cmd.exe 194 PID 5696 wrote to memory of 944 5696 JRSASY.exe 195 PID 944 wrote to memory of 5508 944 cmd.exe 199 PID 5508 wrote to memory of 5860 5508 QHTR.exe 200 PID 5860 wrote to memory of 3428 5860 cmd.exe 204 PID 3428 wrote to memory of 1268 3428 CPAZDMC.exe 205 PID 1268 wrote to memory of 4912 1268 cmd.exe 209 PID 4912 wrote to memory of 3364 4912 VSEVRC.exe 210 PID 3364 wrote to memory of 4736 3364 cmd.exe 214 PID 4736 wrote to memory of 1640 4736 YAK.exe 215 PID 1640 wrote to memory of 4228 1640 cmd.exe 219 PID 4228 wrote to memory of 5652 4228 HOKR.exe 220 PID 5652 wrote to memory of 5788 5652 cmd.exe 224 PID 5788 wrote to memory of 4324 5788 KWRSJS.exe 225 PID 4324 wrote to memory of 1780 4324 cmd.exe 229 PID 1780 wrote to memory of 1912 1780 WOGCAS.exe 230 PID 1912 wrote to memory of 1716 1912 cmd.exe 234 PID 1716 wrote to memory of 4372 1716 LEHC.exe 235 PID 4372 wrote to memory of 4636 4372 cmd.exe 239 PID 4636 wrote to memory of 4172 4636 PUOCLYJ.exe 240 PID 4172 wrote to memory of 6072 4172 cmd.exe 244 PID 6072 wrote to memory of 5988 6072 BCVC.exe 245 PID 5988 wrote to memory of 5288 5988 cmd.exe 249 PID 5288 wrote to memory of 4616 5288 MVYVG.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5297517d201003357f45f82d5dc28d3e_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRAGISV.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\SysWOW64\DRAGISV.exeC:\windows\system32\DRAGISV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSHHG.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\SysWOW64\HSHHG.exeC:\windows\system32\HSHHG.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVYVUP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\SysWOW64\IVYVUP.exeC:\windows\system32\IVYVUP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTFS.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\PTFS.exeC:\windows\system\PTFS.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMUD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\system\IMUD.exeC:\windows\system\IMUD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPYHCL.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\SysWOW64\BPYHCL.exeC:\windows\system32\BPYHCL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFZYJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\SysWOW64\QFZYJ.exeC:\windows\system32\QFZYJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "24⤵
- Executes a command shell one-liner
PID:2528 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPAZDMC.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\CPAZDMC.exeC:\windows\system\CPAZDMC.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSEVRC.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\SysWOW64\VSEVRC.exeC:\windows\system32\VSEVRC.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEHC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\LEHC.exeC:\windows\LEHC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCVC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\BCVC.exeC:\windows\BCVC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLE.exe.bat" "66⤵PID:4616
-
C:\windows\SysWOW64\QLE.exeC:\windows\system32\QLE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2156 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "70⤵PID:5640
-
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMQYQM.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2136 -
C:\windows\SysWOW64\CMQYQM.exeC:\windows\system32\CMQYQM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "74⤵PID:5520
-
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe75⤵
- Executes dropped EXE
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCYLGK.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2056 -
C:\windows\system\XCYLGK.exeC:\windows\system\XCYLGK.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQD.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\windows\SysWOW64\SQD.exeC:\windows\system32\SQD.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQL.exe.bat" "80⤵PID:728
-
C:\windows\system\YQL.exeC:\windows\system\YQL.exe81⤵
- Executes dropped EXE
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "82⤵PID:1380
-
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTWA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2856 -
C:\windows\SysWOW64\WTWA.exeC:\windows\system32\WTWA.exe85⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUYFZT.exe.bat" "86⤵PID:5048
-
C:\windows\system\OUYFZT.exeC:\windows\system\OUYFZT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "88⤵PID:2272
-
C:\windows\system\GXC.exeC:\windows\system\GXC.exe89⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZT.exe.bat" "90⤵
- Executes a command shell one-liner
PID:2328 -
C:\windows\CZT.exeC:\windows\CZT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\CNL.exeC:\windows\CNL.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2260 -
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\windows\GYD.exeC:\windows\GYD.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "98⤵PID:3164
-
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VZFKGP.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5844 -
C:\windows\system\VZFKGP.exeC:\windows\system\VZFKGP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCWO.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4232 -
C:\windows\LCWO.exeC:\windows\LCWO.exe103⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAW.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\system\YAW.exeC:\windows\system\YAW.exe105⤵
- Executes dropped EXE
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EAEOC.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5368 -
C:\windows\system\EAEOC.exeC:\windows\system\EAEOC.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSHHLX.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2184 -
C:\windows\SysWOW64\PSHHLX.exeC:\windows\system32\PSHHLX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIN.exe.bat" "110⤵PID:6092
-
C:\windows\system\TIN.exeC:\windows\system\TIN.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDRKCFN.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\windows\system\UDRKCFN.exeC:\windows\system\UDRKCFN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUYKO.exe.bat" "114⤵PID:1060
-
C:\windows\YUYKO.exeC:\windows\YUYKO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZYZQ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1488 -
C:\windows\system\YZYZQ.exeC:\windows\system\YZYZQ.exe117⤵
- Executes dropped EXE
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMIRGZ.exe.bat" "118⤵PID:2000
-
C:\windows\PMIRGZ.exeC:\windows\PMIRGZ.exe119⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPHM.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4120 -
C:\windows\TPHM.exeC:\windows\TPHM.exe121⤵
- Executes dropped EXE
PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-