Analysis
- max time kernel
86s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe
- Size 208KB
- Sample260718-nvfvfsas9m
- SHA256 7a696c5be2ca59d83977508c9135ce3acd0feea96d1c6082867cf0ffca999a9d
- MD5 261d197ee6d405a3717e214e33e8e491
- SHA1 1a7fe99a467e3dd5cebda2104447bb1104175c5d
- SHA512 4c7a0214812a870647c4b81aa076e551882b89e881df03b76ac20b7939a15bbe48a082ffb3eaf9004d3ce15e09f3c0f79d949269d4b5946bcf25a5ea0ee6b00e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfq4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOiQEj1
- TLSH T19E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1240 LBWJGS.exe 2736 CEPUXD.exe 4816 HFLO.exe 5028 YFFBOQN.exe 5456 FARUUNV.exe 5136 IIXU.exe 4188 NJH.exe 1648 GMLAXRB.exe 1268 TXTZL.exe 3816 FFI.exe 5084 CFKB.exe 1292 GQU.exe 4324 OGVEAU.exe 3276 YEJZHD.exe 4416 PMXWUT.exe 4732 GNEBHC.exe 2624 FXOJP.exe 4524 YBSNVGK.exe 5780 GOXUFFF.exe 2072 GJJXLV.exe 4996 JESZEO.exe 2692 NHQU.exe 4564 TIYI.exe 5484 GSOY.exe 4304 WIPYII.exe 5752 UTSOR.exe 5264 YBZODGC.exe 3280 IKBTGD.exe 1384 INRPVN.exe 3352 QSDVFL.exe 3948 GIEV.exe 2784 SYXNZL.exe 4364 AEKCK.exe 1000 TRJA.exe 3676 EKZL.exe 2480 YCGW.exe 4780 HLIBT.exe 3668 IOMEZAZ.exe 1964 VQCVNLU.exe 2464 UJFLWR.exe 5244 HHFXY.exe 4912 PMSD.exe 4552 ZKXYQJX.exe 4568 MVOWEUS.exe 4128 WTTR.exe 1940 PWX.exe 4272 ZULHGB.exe 3856 HZPNR.exe 5436 GKAD.exe 5504 IIGY.exe 4512 MYMYTG.exe 3316 OLR.exe 1776 HOVLJ.exe 5160 NJUMOZF.exe 4676 RRBMA.exe 2908 LFGDCRQ.exe 3320 MIJZPH.exe 2156 QQQ.exe 4396 ZYSM.exe 4496 DGZMRPD.exe 5480 EJCQX.exe 5772 XCSB.exe 5980 SXXKR.exe 4120 HNYB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DGZMRPD.exe ZYSM.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe ZYSM.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat ZYSM.exe File opened for modification C:\windows\SysWOW64\SXXKR.exe XCSB.exe File created C:\windows\SysWOW64\WIPYII.exe.bat GSOY.exe File created C:\windows\SysWOW64\QSDVFL.exe INRPVN.exe File created C:\windows\SysWOW64\QSDVFL.exe.bat INRPVN.exe File created C:\windows\SysWOW64\AEKCK.exe SYXNZL.exe File opened for modification C:\windows\SysWOW64\PMSD.exe HHFXY.exe File created C:\windows\SysWOW64\HOVLJ.exe.bat OLR.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\JDD.exe HNYB.exe File created C:\windows\SysWOW64\NJH.exe.bat IIXU.exe File created C:\windows\SysWOW64\GNEBHC.exe PMXWUT.exe File opened for modification C:\windows\SysWOW64\GNEBHC.exe PMXWUT.exe File opened for modification C:\windows\SysWOW64\GJJXLV.exe GOXUFFF.exe File created C:\windows\SysWOW64\WIPYII.exe GSOY.exe File created C:\windows\SysWOW64\HZPNR.exe.bat ZULHGB.exe File created C:\windows\SysWOW64\SXXKR.exe XCSB.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe NEJX.exe File created C:\windows\SysWOW64\PMSD.exe HHFXY.exe File created C:\windows\SysWOW64\MVOWEUS.exe ZKXYQJX.exe File opened for modification C:\windows\SysWOW64\HZPNR.exe ZULHGB.exe File created C:\windows\SysWOW64\IKBTGD.exe YBZODGC.exe File opened for modification C:\windows\SysWOW64\IKBTGD.exe YBZODGC.exe File opened for modification C:\windows\SysWOW64\YCGW.exe EKZL.exe File created C:\windows\SysWOW64\HOVLJ.exe OLR.exe File opened for modification C:\windows\SysWOW64\JTK.exe IQGG.exe File created C:\windows\SysWOW64\HFLO.exe CEPUXD.exe File created C:\windows\SysWOW64\FARUUNV.exe.bat YFFBOQN.exe File created C:\windows\SysWOW64\GSOY.exe.bat TIYI.exe File opened for modification C:\windows\SysWOW64\WIPYII.exe GSOY.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe OLR.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat NEJX.exe File created C:\windows\SysWOW64\ZZITPSY.exe.bat IZOOMU.exe File created C:\windows\SysWOW64\CVF.exe.bat UPFXLQU.exe File created C:\windows\SysWOW64\LBWJGS.exe.bat 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\NJH.exe IIXU.exe File created C:\windows\SysWOW64\JESZEO.exe GJJXLV.exe File opened for modification C:\windows\SysWOW64\GIEV.exe QSDVFL.exe File created C:\windows\SysWOW64\HZPNR.exe ZULHGB.exe File created C:\windows\SysWOW64\JDD.exe HNYB.exe File opened for modification C:\windows\SysWOW64\PCAALUK.exe GCYVI.exe File created C:\windows\SysWOW64\PFPJ.exe JFHNOBO.exe File created C:\windows\SysWOW64\WBAGHQA.exe STUGV.exe File created C:\windows\SysWOW64\PCAALUK.exe.bat GCYVI.exe File created C:\windows\SysWOW64\HKC.exe.bat PCAALUK.exe File created C:\windows\SysWOW64\NEJX.exe YJRSRI.exe File opened for modification C:\windows\SysWOW64\ZZITPSY.exe IZOOMU.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe JFHNOBO.exe File created C:\windows\SysWOW64\YPKXQ.exe.bat JZJGJLQ.exe File opened for modification C:\windows\SysWOW64\AEKCK.exe SYXNZL.exe File created C:\windows\SysWOW64\MIJZPH.exe LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\MIJZPH.exe LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe STUGV.exe File opened for modification C:\windows\SysWOW64\ANT.exe OEEKUG.exe File created C:\windows\SysWOW64\PCAALUK.exe GCYVI.exe File created C:\windows\SysWOW64\HKC.exe PCAALUK.exe File created C:\windows\SysWOW64\NEJX.exe.bat YJRSRI.exe File created C:\windows\SysWOW64\IKBTGD.exe.bat YBZODGC.exe File opened for modification C:\windows\SysWOW64\IIGY.exe GKAD.exe File created C:\windows\SysWOW64\IZOOMU.exe NEJX.exe File created C:\windows\SysWOW64\YPKXQ.exe JZJGJLQ.exe File created C:\windows\SysWOW64\FARUUNV.exe YFFBOQN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\LQNNOS.exe LLV.exe File opened for modification C:\windows\system\LQNNOS.exe LLV.exe File created C:\windows\system\ZBDL.exe.bat LQNNOS.exe File created C:\windows\GQU.exe.bat UAOFHG.exe File opened for modification C:\windows\system\INRPVN.exe IKBTGD.exe File created C:\windows\TRJA.exe.bat AEKCK.exe File opened for modification C:\windows\ZKXYQJX.exe PMSD.exe File created C:\windows\IJRGO.exe GLLMZ.exe File created C:\windows\system\LLV.exe PFPJ.exe File created C:\windows\system\YBSNVGK.exe.bat FXOJP.exe File opened for modification C:\windows\TIYI.exe NHQU.exe File created C:\windows\TRJA.exe AEKCK.exe File opened for modification C:\windows\TRJA.exe AEKCK.exe File created C:\windows\EKZL.exe TRJA.exe File opened for modification C:\windows\VQCVNLU.exe IOMEZAZ.exe File created C:\windows\WTTR.exe.bat MVOWEUS.exe File opened for modification C:\windows\system\STUGV.exe WOUUTM.exe File created C:\windows\system\TXTZL.exe.bat GMLAXRB.exe File created C:\windows\LFGDCRQ.exe.bat RRBMA.exe File created C:\windows\system\STUGV.exe WOUUTM.exe File created C:\windows\IJRGO.exe.bat GLLMZ.exe File opened for modification C:\windows\URYGSOI.exe IJRGO.exe File created C:\windows\system\AFFIL.exe OMCQ.exe File created C:\windows\JFHNOBO.exe AFFIL.exe File created C:\windows\system\LLV.exe.bat PFPJ.exe File created C:\windows\system\GOXUFFF.exe.bat YBSNVGK.exe File created C:\windows\system\IOMEZAZ.exe.bat HLIBT.exe File created C:\windows\system\SFX.exe.bat UNMD.exe File created C:\windows\system\JZJGJLQ.exe.bat ZBDL.exe File created C:\windows\YFFBOQN.exe.bat HFLO.exe File opened for modification C:\windows\GQU.exe UAOFHG.exe File created C:\windows\system\YEJZHD.exe.bat OGVEAU.exe File opened for modification C:\windows\system\NHQU.exe JESZEO.exe File created C:\windows\system\INRPVN.exe.bat IKBTGD.exe File opened for modification C:\windows\system\QQQ.exe MIJZPH.exe File created C:\windows\system\LQNNOS.exe.bat LLV.exe File created C:\windows\system\UJFLWR.exe VQCVNLU.exe File opened for modification C:\windows\PWX.exe WTTR.exe File created C:\windows\system\FZURUH.exe JTK.exe File created C:\windows\system\GCYVI.exe.bat FZURUH.exe File created C:\windows\YJRSRI.exe.bat AVA.exe File created C:\windows\system\IAHXTS.exe.bat SFX.exe File created C:\windows\system\FUVL.exe XEUUTI.exe File created C:\windows\system\YBZODGC.exe UTSOR.exe File opened for modification C:\windows\system\ZYSM.exe QQQ.exe File created C:\windows\BIXHSSO.exe.bat MFODH.exe File created C:\windows\IQGG.exe.bat BIXHSSO.exe File opened for modification C:\windows\YJRSRI.exe AVA.exe File created C:\windows\system\EMRBL.exe XRIW.exe File created C:\windows\TIYI.exe.bat NHQU.exe File created C:\windows\WTTR.exe MVOWEUS.exe File created C:\windows\system\FUVL.exe.bat XEUUTI.exe File opened for modification C:\windows\system\UPFXLQU.exe FUVL.exe File created C:\windows\URYGSOI.exe.bat IJRGO.exe File created C:\windows\system\AFFIL.exe.bat OMCQ.exe File created C:\windows\system\CFKB.exe.bat FFI.exe File opened for modification C:\windows\FXOJP.exe GNEBHC.exe File created C:\windows\system\ZBDL.exe LQNNOS.exe File created C:\windows\system\PMXWUT.exe YEJZHD.exe File opened for modification C:\windows\system\NJUMOZF.exe HOVLJ.exe File created C:\windows\LFGDCRQ.exe RRBMA.exe File opened for modification C:\windows\HNYB.exe SXXKR.exe File opened for modification C:\windows\system\FZURUH.exe JTK.exe File created C:\windows\AVA.exe BYHPZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2680 cmd.exe 4444 cmd.exe 4448 cmd.exe 1196 cmd.exe 5728 cmd.exe 1420 cmd.exe 2472 cmd.exe 3840 cmd.exe 4632 cmd.exe 2116 cmd.exe 1792 cmd.exe 5960 cmd.exe 2068 cmd.exe 3336 cmd.exe 2840 cmd.exe 4104 cmd.exe 2240 cmd.exe 936 cmd.exe 3096 cmd.exe 3224 cmd.exe 5944 cmd.exe 3100 cmd.exe 2936 cmd.exe 4572 cmd.exe 5912 cmd.exe 5788 cmd.exe 4804 cmd.exe 6044 cmd.exe 832 cmd.exe 3052 cmd.exe 5628 cmd.exe 5492 cmd.exe 5280 cmd.exe 3296 cmd.exe 5824 cmd.exe 4284 cmd.exe 3272 cmd.exe 5836 cmd.exe 1428 cmd.exe 1192 cmd.exe 3584 cmd.exe 3508 cmd.exe 952 cmd.exe 5564 cmd.exe 5452 cmd.exe 3004 cmd.exe 1716 cmd.exe 2564 cmd.exe 2816 cmd.exe 2292 cmd.exe 3216 cmd.exe 1316 cmd.exe 3504 cmd.exe 1204 cmd.exe 3200 cmd.exe 3524 cmd.exe 4608 cmd.exe 4320 cmd.exe 4768 cmd.exe 4164 cmd.exe 3300 cmd.exe 1520 cmd.exe 1900 cmd.exe 2308 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3332 3540 WerFault.exe 87 1224 1240 WerFault.exe 93 5684 2736 WerFault.exe 99 5668 4816 WerFault.exe 104 2128 5028 WerFault.exe 109 3416 5456 WerFault.exe 114 3208 5136 WerFault.exe 119 1896 4188 WerFault.exe 124 2712 1648 WerFault.exe 129 3520 1268 WerFault.exe 134 4336 3816 WerFault.exe 139 5100 5084 WerFault.exe 144 5352 1244 WerFault.exe 149 4340 1292 WerFault.exe 154 1144 4324 WerFault.exe 159 2560 3276 WerFault.exe 164 5660 4416 WerFault.exe 169 4172 4732 WerFault.exe 173 5880 2624 WerFault.exe 179 1608 4524 WerFault.exe 184 3552 5780 WerFault.exe 189 5652 2072 WerFault.exe 194 3064 4996 WerFault.exe 199 5920 2692 WerFault.exe 203 1888 4564 WerFault.exe 209 4768 5484 WerFault.exe 214 6116 4304 WerFault.exe 219 5040 5752 WerFault.exe 224 996 5264 WerFault.exe 229 2364 3280 WerFault.exe 234 5180 1384 WerFault.exe 239 5628 3352 WerFault.exe 244 1412 3948 WerFault.exe 249 5928 2784 WerFault.exe 254 6052 4364 WerFault.exe 259 5736 1000 WerFault.exe 265 4124 3676 WerFault.exe 270 2456 2480 WerFault.exe 275 3936 4780 WerFault.exe 280 680 3668 WerFault.exe 285 1704 1964 WerFault.exe 290 2256 2464 WerFault.exe 295 3824 5244 WerFault.exe 300 4656 4912 WerFault.exe 305 3472 4552 WerFault.exe 310 5572 4568 WerFault.exe 315 5816 4128 WerFault.exe 320 3508 1940 WerFault.exe 325 3376 4272 WerFault.exe 330 4952 3856 WerFault.exe 335 1012 5436 WerFault.exe 340 1460 5504 WerFault.exe 345 1336 4512 WerFault.exe 350 5652 3316 WerFault.exe 355 2752 1776 WerFault.exe 360 3708 5160 WerFault.exe 365 4192 4676 WerFault.exe 370 1352 2908 WerFault.exe 375 620 3320 WerFault.exe 380 2952 2156 WerFault.exe 385 3940 4396 WerFault.exe 390 2980 4496 WerFault.exe 395 6056 5480 WerFault.exe 400 5100 5772 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKBTGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMLAXRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQCVNLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEEKUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZURUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXTZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZKXYQJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFFBOQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLIBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXXKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOMEZAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRBMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBSNVGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBWJGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAOFHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOUUTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGZMRPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJRSRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLLMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URYGSOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3540 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe 3540 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe 1240 LBWJGS.exe 1240 LBWJGS.exe 2736 CEPUXD.exe 2736 CEPUXD.exe 4816 HFLO.exe 4816 HFLO.exe 5028 YFFBOQN.exe 5028 YFFBOQN.exe 5456 FARUUNV.exe 5456 FARUUNV.exe 5136 IIXU.exe 5136 IIXU.exe 4188 NJH.exe 4188 NJH.exe 1648 GMLAXRB.exe 1648 GMLAXRB.exe 1268 TXTZL.exe 1268 TXTZL.exe 3816 FFI.exe 3816 FFI.exe 1244 UAOFHG.exe 1244 UAOFHG.exe 1292 GQU.exe 1292 GQU.exe 4324 OGVEAU.exe 4324 OGVEAU.exe 3276 YEJZHD.exe 3276 YEJZHD.exe 4416 PMXWUT.exe 4416 PMXWUT.exe 4732 GNEBHC.exe 4732 GNEBHC.exe 2624 FXOJP.exe 2624 FXOJP.exe 4524 YBSNVGK.exe 4524 YBSNVGK.exe 5780 GOXUFFF.exe 5780 GOXUFFF.exe 2072 GJJXLV.exe 2072 GJJXLV.exe 4996 JESZEO.exe 4996 JESZEO.exe 2692 NHQU.exe 2692 NHQU.exe 4564 TIYI.exe 4564 TIYI.exe 5484 GSOY.exe 5484 GSOY.exe 4304 WIPYII.exe 4304 WIPYII.exe 5752 UTSOR.exe 5752 UTSOR.exe 5264 YBZODGC.exe 5264 YBZODGC.exe 3280 IKBTGD.exe 3280 IKBTGD.exe 1384 INRPVN.exe 1384 INRPVN.exe 3352 QSDVFL.exe 3352 QSDVFL.exe 3948 GIEV.exe 3948 GIEV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3540 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe 3540 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe 1240 LBWJGS.exe 1240 LBWJGS.exe 2736 CEPUXD.exe 2736 CEPUXD.exe 4816 HFLO.exe 4816 HFLO.exe 5028 YFFBOQN.exe 5028 YFFBOQN.exe 5456 FARUUNV.exe 5456 FARUUNV.exe 5136 IIXU.exe 5136 IIXU.exe 4188 NJH.exe 4188 NJH.exe 1648 GMLAXRB.exe 1648 GMLAXRB.exe 1268 TXTZL.exe 1268 TXTZL.exe 3816 FFI.exe 3816 FFI.exe 1244 UAOFHG.exe 1244 UAOFHG.exe 1292 GQU.exe 1292 GQU.exe 4324 OGVEAU.exe 4324 OGVEAU.exe 3276 YEJZHD.exe 3276 YEJZHD.exe 4416 PMXWUT.exe 4416 PMXWUT.exe 4732 GNEBHC.exe 4732 GNEBHC.exe 2624 FXOJP.exe 2624 FXOJP.exe 4524 YBSNVGK.exe 4524 YBSNVGK.exe 5780 GOXUFFF.exe 5780 GOXUFFF.exe 2072 GJJXLV.exe 2072 GJJXLV.exe 4996 JESZEO.exe 4996 JESZEO.exe 2692 NHQU.exe 2692 NHQU.exe 4564 TIYI.exe 4564 TIYI.exe 5484 GSOY.exe 5484 GSOY.exe 4304 WIPYII.exe 4304 WIPYII.exe 5752 UTSOR.exe 5752 UTSOR.exe 5264 YBZODGC.exe 5264 YBZODGC.exe 3280 IKBTGD.exe 3280 IKBTGD.exe 1384 INRPVN.exe 1384 INRPVN.exe 3352 QSDVFL.exe 3352 QSDVFL.exe 3948 GIEV.exe 3948 GIEV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4448 3540 2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe 89 PID 4448 wrote to memory of 1240 4448 cmd.exe 93 PID 1240 wrote to memory of 2396 1240 LBWJGS.exe 95 PID 2396 wrote to memory of 2736 2396 cmd.exe 99 PID 2736 wrote to memory of 1196 2736 CEPUXD.exe 100 PID 1196 wrote to memory of 4816 1196 cmd.exe 104 PID 4816 wrote to memory of 2916 4816 HFLO.exe 105 PID 2916 wrote to memory of 5028 2916 cmd.exe 109 PID 5028 wrote to memory of 4484 5028 YFFBOQN.exe 110 PID 4484 wrote to memory of 5456 4484 cmd.exe 114 PID 5456 wrote to memory of 3300 5456 FARUUNV.exe 115 PID 3300 wrote to memory of 5136 3300 cmd.exe 119 PID 5136 wrote to memory of 1716 5136 IIXU.exe 120 PID 1716 wrote to memory of 4188 1716 cmd.exe 124 PID 4188 wrote to memory of 1380 4188 NJH.exe 125 PID 1380 wrote to memory of 1648 1380 cmd.exe 129 PID 1648 wrote to memory of 992 1648 GMLAXRB.exe 130 PID 992 wrote to memory of 1268 992 cmd.exe 134 PID 1268 wrote to memory of 1640 1268 TXTZL.exe 135 PID 1640 wrote to memory of 3816 1640 cmd.exe 139 PID 3816 wrote to memory of 4820 3816 FFI.exe 140 PID 4820 wrote to memory of 5084 4820 cmd.exe 144 PID 5460 wrote to memory of 1244 5460 cmd.exe 149 PID 1244 wrote to memory of 2564 1244 UAOFHG.exe 150 PID 2564 wrote to memory of 1292 2564 cmd.exe 154 PID 1292 wrote to memory of 2788 1292 GQU.exe 155 PID 2788 wrote to memory of 4324 2788 cmd.exe 159 PID 4324 wrote to memory of 4840 4324 OGVEAU.exe 160 PID 4840 wrote to memory of 3276 4840 cmd.exe 164 PID 3276 wrote to memory of 5728 3276 YEJZHD.exe 165 PID 5728 wrote to memory of 4416 5728 cmd.exe 169 PID 4416 wrote to memory of 3580 4416 PMXWUT.exe 170 PID 3580 wrote to memory of 4732 3580 cmd.exe 173 PID 4732 wrote to memory of 952 4732 GNEBHC.exe 175 PID 952 wrote to memory of 2624 952 cmd.exe 179 PID 2624 wrote to memory of 4660 2624 FXOJP.exe 180 PID 4660 wrote to memory of 4524 4660 cmd.exe 184 PID 4524 wrote to memory of 1204 4524 YBSNVGK.exe 185 PID 1204 wrote to memory of 5780 1204 cmd.exe 189 PID 5780 wrote to memory of 1420 5780 GOXUFFF.exe 190 PID 1420 wrote to memory of 2072 1420 cmd.exe 194 PID 2072 wrote to memory of 3484 2072 GJJXLV.exe 195 PID 3484 wrote to memory of 4996 3484 cmd.exe 199 PID 4996 wrote to memory of 5916 4996 JESZEO.exe 200 PID 5916 wrote to memory of 2692 5916 cmd.exe 203 PID 2692 wrote to memory of 5788 2692 NHQU.exe 205 PID 5788 wrote to memory of 4564 5788 cmd.exe 209 PID 4564 wrote to memory of 5156 4564 TIYI.exe 210 PID 5156 wrote to memory of 5484 5156 cmd.exe 214 PID 5484 wrote to memory of 580 5484 GSOY.exe 215 PID 580 wrote to memory of 4304 580 cmd.exe 219 PID 4304 wrote to memory of 4580 4304 WIPYII.exe 220 PID 4580 wrote to memory of 5752 4580 cmd.exe 224 PID 5752 wrote to memory of 5424 5752 UTSOR.exe 225 PID 5424 wrote to memory of 5264 5424 cmd.exe 229 PID 5264 wrote to memory of 5432 5264 YBZODGC.exe 230 PID 5432 wrote to memory of 3280 5432 cmd.exe 234 PID 3280 wrote to memory of 5672 3280 IKBTGD.exe 235 PID 5672 wrote to memory of 1384 5672 cmd.exe 239 PID 1384 wrote to memory of 936 1384 INRPVN.exe 240 PID 936 wrote to memory of 3352 936 cmd.exe 244 PID 3352 wrote to memory of 2472 3352 QSDVFL.exe 245 PID 2472 wrote to memory of 3948 2472 cmd.exe 249 PID 3948 wrote to memory of 4684 3948 GIEV.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_261d197ee6d405a3717e214e33e8e491_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBWJGS.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\SysWOW64\LBWJGS.exeC:\windows\system32\LBWJGS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEPUXD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\system\CEPUXD.exeC:\windows\system\CEPUXD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFLO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\SysWOW64\HFLO.exeC:\windows\system32\HFLO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFFBOQN.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\YFFBOQN.exeC:\windows\YFFBOQN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FARUUNV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\FARUUNV.exeC:\windows\system32\FARUUNV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIXU.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\IIXU.exeC:\windows\IIXU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJH.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\SysWOW64\NJH.exeC:\windows\system32\NJH.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMLAXRB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\GMLAXRB.exeC:\windows\GMLAXRB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXTZL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\system\TXTZL.exeC:\windows\system\TXTZL.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\system\FFI.exeC:\windows\system\FFI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFKB.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\system\CFKB.exeC:\windows\system\CFKB.exe23⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAOFHG.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\SysWOW64\UAOFHG.exeC:\windows\system32\UAOFHG.exe25⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQU.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\GQU.exeC:\windows\GQU.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVEAU.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\system\OGVEAU.exeC:\windows\system\OGVEAU.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEJZHD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\YEJZHD.exeC:\windows\system\YEJZHD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PMXWUT.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\PMXWUT.exeC:\windows\system\PMXWUT.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNEBHC.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\SysWOW64\GNEBHC.exeC:\windows\system32\GNEBHC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXOJP.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\FXOJP.exeC:\windows\FXOJP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBSNVGK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\system\YBSNVGK.exeC:\windows\system\YBSNVGK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOXUFFF.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\GOXUFFF.exeC:\windows\system\GOXUFFF.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJJXLV.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\SysWOW64\GJJXLV.exeC:\windows\system32\GJJXLV.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\SysWOW64\JESZEO.exeC:\windows\system32\JESZEO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHQU.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\system\NHQU.exeC:\windows\system\NHQU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIYI.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\TIYI.exeC:\windows\TIYI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSOY.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SysWOW64\GSOY.exeC:\windows\system32\GSOY.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIPYII.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\windows\SysWOW64\WIPYII.exeC:\windows\system32\WIPYII.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTSOR.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\UTSOR.exeC:\windows\system\UTSOR.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBZODGC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\YBZODGC.exeC:\windows\system\YBZODGC.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKBTGD.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\windows\SysWOW64\IKBTGD.exeC:\windows\system32\IKBTGD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSDVFL.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\SysWOW64\QSDVFL.exeC:\windows\system32\QSDVFL.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe65⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYXNZL.exe.bat" "66⤵PID:4684
-
C:\windows\SYXNZL.exeC:\windows\SYXNZL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3096 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRJA.exe.bat" "70⤵PID:3892
-
C:\windows\TRJA.exeC:\windows\TRJA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKZL.exe.bat" "72⤵PID:264
-
C:\windows\EKZL.exeC:\windows\EKZL.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe75⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLIBT.exe.bat" "76⤵PID:3252
-
C:\windows\HLIBT.exeC:\windows\HLIBT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2816 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQCVNLU.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3200 -
C:\windows\VQCVNLU.exeC:\windows\VQCVNLU.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "82⤵PID:5732
-
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe83⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHFXY.exe.bat" "84⤵PID:5180
-
C:\windows\HHFXY.exeC:\windows\HHFXY.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "86⤵PID:2820
-
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZKXYQJX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\ZKXYQJX.exeC:\windows\ZKXYQJX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "90⤵PID:5888
-
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "92⤵PID:4508
-
C:\windows\WTTR.exeC:\windows\WTTR.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "94⤵PID:4712
-
C:\windows\PWX.exeC:\windows\PWX.exe95⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "96⤵PID:2544
-
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZPNR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2292 -
C:\windows\SysWOW64\HZPNR.exeC:\windows\system32\HZPNR.exe99⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKAD.exe.bat" "100⤵PID:624
-
C:\windows\system\GKAD.exeC:\windows\system\GKAD.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "102⤵PID:4144
-
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe103⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe105⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "106⤵PID:4180
-
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOVLJ.exe.bat" "108⤵PID:3772
-
C:\windows\SysWOW64\HOVLJ.exeC:\windows\system32\HOVLJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJUMOZF.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3296 -
C:\windows\system\NJUMOZF.exeC:\windows\system\NJUMOZF.exe111⤵
- Executes dropped EXE
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "112⤵PID:5744
-
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5944 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5564 -
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYSM.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5836 -
C:\windows\system\ZYSM.exeC:\windows\system\ZYSM.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-