Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe
- Size 209KB
- Sample260723-lsrstsvflb
- SHA256 b230662322050eefa10369c7de729ee6a4a3a9ed2c289290c6c2c3394fef4e7b
- MD5 cf542c534281b641bba17a37bfa56f53
- SHA1 34ce3c7da71ca15e8acdf619cdc2c29f845e6782
- SHA512 a3e7018ae245c61352de010ac988afb3e02fbd448493c1337f6cb243ff51955e06eb080565c43f653c6bfc4fb5b3167d9f117d5d6d08474cd6a95c0c85b6ed97
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf24pLthEjQT6n:/lZtbLWIgd1LZ9oECZbDlUd+LOOkEjR
- TLSH T198247C1236D2C073E4B7023188F6C7787BB6BDA19B36928B6BC03B4D6E715968E35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4112 XOV.exe 5384 NXYJ.exe 6036 VCD.exe 2444 WFHMAAL.exe 3080 YDUGH.exe 5008 KLBOUBH.exe 2712 XRBAW.exe 820 MMK.exe 5268 FPOAUPT.exe 3304 UFPZ.exe 5232 MFEWFC.exe 4260 SAPXT.exe 5380 RLSN.exe 1428 VBHNGPL.exe 5056 UJNTTGG.exe 3868 BAOKZ.exe 4244 NID.exe 2448 ESGAUZN.exe 5928 XLVTEAV.exe 1452 FYAAOZ.exe 1284 JGGA.exe 2548 MXPWI.exe 1956 ZZY.exe 364 DPMVI.exe 3344 JDD.exe 1620 WOUUTM.exe 5856 XRY.exe 3924 SECAJ.exe 2540 BME.exe 5752 CHIIZ.exe 1844 RKS.exe 5540 KFVQQ.exe 2928 TDJL.exe 2516 JTK.exe 5096 FZURUH.exe 3852 AMZ.exe 4796 RUBOIE.exe 5924 BVD.exe 1488 QYNXEW.exe 3612 KLRHPWX.exe 2972 FYWQ.exe 4612 AMBABW.exe 4100 APF.exe 636 EXLDT.exe 2776 KSL.exe 1532 ZNUQJU.exe 4588 YITRNXE.exe 4516 UOZ.exe 3408 JJITNT.exe 2120 IULJW.exe 3124 SRZ.exe 3948 SFR.exe 4200 NSWBP.exe 4584 RADBB.exe 3908 LOHSEN.exe 3160 MRL.exe 5304 GEQXT.exe 4480 MEYLKFF.exe 4520 SFFZT.exe 2484 NAKIEZ.exe 4964 TNJRICL.exe 3376 LQNNOS.exe 5716 DEXFEOI.exe 3916 XRCO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\CHIIZ.exe BME.exe File created C:\windows\SysWOW64\RUBOIE.exe AMZ.exe File opened for modification C:\windows\SysWOW64\FYWQ.exe KLRHPWX.exe File created C:\windows\SysWOW64\FHDONKL.exe XRCO.exe File opened for modification C:\windows\SysWOW64\VCD.exe NXYJ.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat ESGAUZN.exe File created C:\windows\SysWOW64\YITRNXE.exe.bat ZNUQJU.exe File opened for modification C:\windows\SysWOW64\IULJW.exe JJITNT.exe File created C:\windows\SysWOW64\ZAB.exe FFWSMI.exe File created C:\windows\SysWOW64\DIHCJ.exe.bat ZAB.exe File created C:\windows\SysWOW64\ZVG.exe.bat RPGQXAS.exe File created C:\windows\SysWOW64\CKK.exe HXFQQU.exe File created C:\windows\SysWOW64\JTK.exe.bat TDJL.exe File created C:\windows\SysWOW64\KSL.exe EXLDT.exe File opened for modification C:\windows\SysWOW64\KSL.exe EXLDT.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe ZNUQJU.exe File created C:\windows\SysWOW64\YYSOVFY.exe YTSZUS.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat YDUGH.exe File created C:\windows\SysWOW64\JDD.exe.bat DPMVI.exe File created C:\windows\SysWOW64\CHIIZ.exe BME.exe File opened for modification C:\windows\SysWOW64\DEXFEOI.exe LQNNOS.exe File created C:\windows\SysWOW64\FHDONKL.exe.bat XRCO.exe File opened for modification C:\windows\SysWOW64\RPGQXAS.exe GXDXPT.exe File created C:\windows\SysWOW64\JDD.exe DPMVI.exe File created C:\windows\SysWOW64\MMK.exe.bat XRBAW.exe File opened for modification C:\windows\SysWOW64\RUBOIE.exe AMZ.exe File created C:\windows\SysWOW64\KHLBWEN.exe.bat FHDONKL.exe File created C:\windows\SysWOW64\RPGQXAS.exe.bat GXDXPT.exe File opened for modification C:\windows\SysWOW64\WCDFKX.exe CGZW.exe File opened for modification C:\windows\SysWOW64\ZEO.exe YBCIGE.exe File created C:\windows\SysWOW64\OTVUYQ.exe.bat BJN.exe File created C:\windows\SysWOW64\XOV.exe.bat 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe File created C:\windows\SysWOW64\FYWQ.exe KLRHPWX.exe File created C:\windows\SysWOW64\IULJW.exe.bat JJITNT.exe File created C:\windows\SysWOW64\KHLBWEN.exe FHDONKL.exe File opened for modification C:\windows\SysWOW64\HHWT.exe BHPFEZU.exe File created C:\windows\SysWOW64\XRBAW.exe KLBOUBH.exe File opened for modification C:\windows\SysWOW64\MMK.exe XRBAW.exe File created C:\windows\SysWOW64\TDJL.exe.bat KFVQQ.exe File created C:\windows\SysWOW64\JTK.exe TDJL.exe File created C:\windows\SysWOW64\DEXFEOI.exe.bat LQNNOS.exe File created C:\windows\SysWOW64\ZVG.exe RPGQXAS.exe File created C:\windows\SysWOW64\YTSZUS.exe.bat ZVG.exe File created C:\windows\SysWOW64\WCDFKX.exe CGZW.exe File opened for modification C:\windows\SysWOW64\NID.exe BAOKZ.exe File opened for modification C:\windows\SysWOW64\JGGA.exe FYAAOZ.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat BME.exe File created C:\windows\SysWOW64\KFVQQ.exe RKS.exe File opened for modification C:\windows\SysWOW64\KFVQQ.exe RKS.exe File created C:\windows\SysWOW64\IULJW.exe JJITNT.exe File created C:\windows\SysWOW64\DIHCJ.exe ZAB.exe File created C:\windows\SysWOW64\RPGQXAS.exe GXDXPT.exe File opened for modification C:\windows\SysWOW64\XLVTEAV.exe ESGAUZN.exe File created C:\windows\SysWOW64\DPMVI.exe ZZY.exe File created C:\windows\SysWOW64\DPMVI.exe.bat ZZY.exe File created C:\windows\SysWOW64\TDJL.exe KFVQQ.exe File created C:\windows\SysWOW64\RUBOIE.exe.bat AMZ.exe File opened for modification C:\windows\SysWOW64\FHDONKL.exe XRCO.exe File opened for modification C:\windows\SysWOW64\KHLBWEN.exe FHDONKL.exe File opened for modification C:\windows\SysWOW64\ZAB.exe FFWSMI.exe File created C:\windows\SysWOW64\XRBAW.exe.bat KLBOUBH.exe File created C:\windows\SysWOW64\MMK.exe XRBAW.exe File opened for modification C:\windows\SysWOW64\ZVG.exe RPGQXAS.exe File created C:\windows\SysWOW64\YTSZUS.exe ZVG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\KLRHPWX.exe QYNXEW.exe File opened for modification C:\windows\system\GXDXPT.exe IHSUCOV.exe File opened for modification C:\windows\system\WPKR.exe XXHBX.exe File created C:\windows\NXYJ.exe.bat XOV.exe File created C:\windows\GLGMNWB.exe.bat PYWT.exe File created C:\windows\system\VBHNGPL.exe.bat RLSN.exe File opened for modification C:\windows\system\RKS.exe CHIIZ.exe File created C:\windows\system\FZURUH.exe.bat JTK.exe File opened for modification C:\windows\QYNXEW.exe BVD.exe File created C:\windows\CGZW.exe.bat YYSOVFY.exe File created C:\windows\system\MEYLKFF.exe GEQXT.exe File created C:\windows\GLGMNWB.exe PYWT.exe File opened for modification C:\windows\GLGMNWB.exe PYWT.exe File created C:\windows\system\BMLJY.exe.bat GRG.exe File created C:\windows\system\YZQPYQ.exe.bat URJPMYF.exe File created C:\windows\system\SFR.exe.bat SRZ.exe File opened for modification C:\windows\system\TNJRICL.exe NAKIEZ.exe File opened for modification C:\windows\system\LQNNOS.exe TNJRICL.exe File created C:\windows\WDS.exe WPSBIWJ.exe File created C:\windows\PYWT.exe WDS.exe File opened for modification C:\windows\system\RLSN.exe SAPXT.exe File opened for modification C:\windows\system\XRY.exe WOUUTM.exe File created C:\windows\SECAJ.exe.bat XRY.exe File opened for modification C:\windows\system\APF.exe AMBABW.exe File opened for modification C:\windows\system\SRZ.exe IULJW.exe File opened for modification C:\windows\system\TCJG.exe EHACVM.exe File opened for modification C:\windows\system\XXHBX.exe WCDFKX.exe File created C:\windows\system\WPKR.exe.bat XXHBX.exe File created C:\windows\system\APF.exe.bat AMBABW.exe File opened for modification C:\windows\system\BMLJY.exe GRG.exe File created C:\windows\system\BUTYTCP.exe ZEO.exe File created C:\windows\system\JHAMBQQ.exe OTVUYQ.exe File created C:\windows\system\YDUGH.exe.bat WFHMAAL.exe File created C:\windows\system\SRZ.exe IULJW.exe File created C:\windows\system\EHACVM.exe LEWYIWI.exe File opened for modification C:\windows\OGFQPY.exe SJZTI.exe File opened for modification C:\windows\system\ZZY.exe MXPWI.exe File created C:\windows\system\XRY.exe.bat WOUUTM.exe File created C:\windows\system\UOZ.exe.bat YITRNXE.exe File created C:\windows\system\NSWBP.exe.bat SFR.exe File opened for modification C:\windows\PYWT.exe WDS.exe File created C:\windows\system\CDBCXB.exe.bat HHWT.exe File created C:\windows\LEWYIWI.exe.bat DZWKGR.exe File created C:\windows\OTSTWWI.exe CLLLK.exe File opened for modification C:\windows\YPH.exe OGFQPY.exe File created C:\windows\FFWSMI.exe YPH.exe File created C:\windows\system\MFEWFC.exe UFPZ.exe File opened for modification C:\windows\system\MXPWI.exe JGGA.exe File created C:\windows\system\BME.exe SECAJ.exe File created C:\windows\system\AMZ.exe.bat FZURUH.exe File opened for modification C:\windows\RADBB.exe NSWBP.exe File created C:\windows\LEWYIWI.exe DZWKGR.exe File opened for modification C:\windows\PKOULJ.exe WPKR.exe File created C:\windows\system\FKAG.exe BUTYTCP.exe File created C:\windows\ZNUQJU.exe.bat KSL.exe File created C:\windows\system\JJITNT.exe.bat UOZ.exe File created C:\windows\NAKIEZ.exe.bat SFFZT.exe File opened for modification C:\windows\GRG.exe GLGMNWB.exe File opened for modification C:\windows\system\DZWKGR.exe ZJPK.exe File opened for modification C:\windows\FYAAOZ.exe XLVTEAV.exe File created C:\windows\system\RKS.exe.bat CHIIZ.exe File opened for modification C:\windows\system\JJITNT.exe UOZ.exe File opened for modification C:\windows\BHPFEZU.exe BMLJY.exe File created C:\windows\GLI.exe.bat CDBCXB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5488 cmd.exe 2392 cmd.exe 1836 cmd.exe 5316 cmd.exe 3748 cmd.exe 488 cmd.exe 3008 cmd.exe 5196 cmd.exe 5780 cmd.exe 5760 cmd.exe 2956 cmd.exe 2400 cmd.exe 2864 cmd.exe 1860 cmd.exe 4368 cmd.exe 5952 cmd.exe 2284 cmd.exe 3884 cmd.exe 2580 cmd.exe 4792 cmd.exe 2408 cmd.exe 1520 cmd.exe 1748 cmd.exe 1776 cmd.exe 4068 cmd.exe 3444 cmd.exe 928 cmd.exe 5116 cmd.exe 968 cmd.exe 4568 cmd.exe 5932 cmd.exe 1976 cmd.exe 5940 cmd.exe 2560 cmd.exe 2064 cmd.exe 3912 cmd.exe 2996 cmd.exe 2672 cmd.exe 6136 cmd.exe 2704 cmd.exe 1600 cmd.exe 5592 cmd.exe 2068 cmd.exe 3244 cmd.exe 2896 cmd.exe 3844 cmd.exe 5504 cmd.exe 2352 cmd.exe 2664 cmd.exe 1252 cmd.exe 3872 cmd.exe 240 cmd.exe 2648 cmd.exe 4908 cmd.exe 5608 cmd.exe 2652 cmd.exe 2020 cmd.exe 2844 cmd.exe 4788 cmd.exe 3260 cmd.exe 3140 cmd.exe 6012 cmd.exe 3308 cmd.exe 3580 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3244 2312 WerFault.exe 87 4616 4112 WerFault.exe 92 1740 5384 WerFault.exe 99 3552 6036 WerFault.exe 104 4512 2444 WerFault.exe 109 2260 3080 WerFault.exe 114 4136 5008 WerFault.exe 119 1700 2712 WerFault.exe 124 1836 820 WerFault.exe 129 2196 5268 WerFault.exe 134 5540 3304 WerFault.exe 139 1248 5232 WerFault.exe 144 2516 4260 WerFault.exe 149 4208 5380 WerFault.exe 154 3852 1428 WerFault.exe 159 5732 5056 WerFault.exe 164 5924 3868 WerFault.exe 169 4540 4244 WerFault.exe 174 1120 2448 WerFault.exe 179 5624 5928 WerFault.exe 184 3948 1452 WerFault.exe 189 1204 1284 WerFault.exe 194 2912 2548 WerFault.exe 199 264 1956 WerFault.exe 204 6136 364 WerFault.exe 209 1484 3344 WerFault.exe 214 5952 1620 WerFault.exe 219 2536 5856 WerFault.exe 224 5720 3924 WerFault.exe 229 5920 2540 WerFault.exe 234 5044 5752 WerFault.exe 239 5808 1844 WerFault.exe 244 5116 5540 WerFault.exe 249 5012 2928 WerFault.exe 254 3908 2516 WerFault.exe 259 4204 5096 WerFault.exe 264 5876 3852 WerFault.exe 269 2260 4796 WerFault.exe 274 3844 5924 WerFault.exe 279 3796 1488 WerFault.exe 284 5640 3612 WerFault.exe 289 5348 2972 WerFault.exe 294 3940 4612 WerFault.exe 299 1128 4100 WerFault.exe 304 1520 636 WerFault.exe 309 1240 2776 WerFault.exe 314 2304 1532 WerFault.exe 319 6096 4588 WerFault.exe 324 1804 4516 WerFault.exe 329 4848 3408 WerFault.exe 334 6028 2120 WerFault.exe 339 5932 3124 WerFault.exe 344 4316 3948 WerFault.exe 349 1128 4200 WerFault.exe 354 4968 4584 WerFault.exe 359 2464 3908 WerFault.exe 364 3012 3160 WerFault.exe 369 4652 5304 WerFault.exe 374 560 4480 WerFault.exe 379 2816 4520 WerFault.exe 384 5032 2484 WerFault.exe 389 1540 4964 WerFault.exe 394 3244 3376 WerFault.exe 399 5444 5716 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXDXPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXFQQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFWSMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLGMNWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAOKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHAMBQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHNGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBCIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPOAUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URJPMYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRBAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESGAUZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAPXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYNXEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXLDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPGQXAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKOULJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2312 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe 2312 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe 4112 XOV.exe 4112 XOV.exe 5384 NXYJ.exe 5384 NXYJ.exe 6036 VCD.exe 6036 VCD.exe 2444 WFHMAAL.exe 2444 WFHMAAL.exe 3080 YDUGH.exe 3080 YDUGH.exe 5008 KLBOUBH.exe 5008 KLBOUBH.exe 2712 XRBAW.exe 2712 XRBAW.exe 820 MMK.exe 820 MMK.exe 5268 FPOAUPT.exe 5268 FPOAUPT.exe 3304 UFPZ.exe 3304 UFPZ.exe 5232 MFEWFC.exe 5232 MFEWFC.exe 4260 SAPXT.exe 4260 SAPXT.exe 5380 RLSN.exe 5380 RLSN.exe 1428 VBHNGPL.exe 1428 VBHNGPL.exe 5056 UJNTTGG.exe 5056 UJNTTGG.exe 3868 BAOKZ.exe 3868 BAOKZ.exe 4244 NID.exe 4244 NID.exe 2448 ESGAUZN.exe 2448 ESGAUZN.exe 5928 XLVTEAV.exe 5928 XLVTEAV.exe 1452 FYAAOZ.exe 1452 FYAAOZ.exe 1284 JGGA.exe 1284 JGGA.exe 2548 MXPWI.exe 2548 MXPWI.exe 1956 ZZY.exe 1956 ZZY.exe 364 DPMVI.exe 364 DPMVI.exe 3344 JDD.exe 3344 JDD.exe 1620 WOUUTM.exe 1620 WOUUTM.exe 5856 XRY.exe 5856 XRY.exe 3924 SECAJ.exe 3924 SECAJ.exe 2540 BME.exe 2540 BME.exe 5752 CHIIZ.exe 5752 CHIIZ.exe 1844 RKS.exe 1844 RKS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2312 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe 2312 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe 4112 XOV.exe 4112 XOV.exe 5384 NXYJ.exe 5384 NXYJ.exe 6036 VCD.exe 6036 VCD.exe 2444 WFHMAAL.exe 2444 WFHMAAL.exe 3080 YDUGH.exe 3080 YDUGH.exe 5008 KLBOUBH.exe 5008 KLBOUBH.exe 2712 XRBAW.exe 2712 XRBAW.exe 820 MMK.exe 820 MMK.exe 5268 FPOAUPT.exe 5268 FPOAUPT.exe 3304 UFPZ.exe 3304 UFPZ.exe 5232 MFEWFC.exe 5232 MFEWFC.exe 4260 SAPXT.exe 4260 SAPXT.exe 5380 RLSN.exe 5380 RLSN.exe 1428 VBHNGPL.exe 1428 VBHNGPL.exe 5056 UJNTTGG.exe 5056 UJNTTGG.exe 3868 BAOKZ.exe 3868 BAOKZ.exe 4244 NID.exe 4244 NID.exe 2448 ESGAUZN.exe 2448 ESGAUZN.exe 5928 XLVTEAV.exe 5928 XLVTEAV.exe 1452 FYAAOZ.exe 1452 FYAAOZ.exe 1284 JGGA.exe 1284 JGGA.exe 2548 MXPWI.exe 2548 MXPWI.exe 1956 ZZY.exe 1956 ZZY.exe 364 DPMVI.exe 364 DPMVI.exe 3344 JDD.exe 3344 JDD.exe 1620 WOUUTM.exe 1620 WOUUTM.exe 5856 XRY.exe 5856 XRY.exe 3924 SECAJ.exe 3924 SECAJ.exe 2540 BME.exe 2540 BME.exe 5752 CHIIZ.exe 5752 CHIIZ.exe 1844 RKS.exe 1844 RKS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1916 2312 2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe 89 PID 1916 wrote to memory of 4112 1916 cmd.exe 92 PID 4112 wrote to memory of 5788 4112 XOV.exe 95 PID 5788 wrote to memory of 5384 5788 cmd.exe 99 PID 5384 wrote to memory of 244 5384 NXYJ.exe 100 PID 244 wrote to memory of 6036 244 cmd.exe 104 PID 6036 wrote to memory of 4368 6036 VCD.exe 105 PID 4368 wrote to memory of 2444 4368 cmd.exe 109 PID 2444 wrote to memory of 3008 2444 WFHMAAL.exe 110 PID 3008 wrote to memory of 3080 3008 cmd.exe 114 PID 3080 wrote to memory of 2084 3080 YDUGH.exe 115 PID 2084 wrote to memory of 5008 2084 cmd.exe 119 PID 5008 wrote to memory of 1820 5008 KLBOUBH.exe 120 PID 1820 wrote to memory of 2712 1820 cmd.exe 124 PID 2712 wrote to memory of 4852 2712 XRBAW.exe 125 PID 4852 wrote to memory of 820 4852 cmd.exe 129 PID 820 wrote to memory of 1748 820 MMK.exe 130 PID 1748 wrote to memory of 5268 1748 cmd.exe 134 PID 5268 wrote to memory of 780 5268 FPOAUPT.exe 135 PID 780 wrote to memory of 3304 780 cmd.exe 139 PID 3304 wrote to memory of 3628 3304 UFPZ.exe 140 PID 3628 wrote to memory of 5232 3628 cmd.exe 144 PID 5232 wrote to memory of 5248 5232 MFEWFC.exe 145 PID 5248 wrote to memory of 4260 5248 cmd.exe 149 PID 4260 wrote to memory of 1420 4260 SAPXT.exe 150 PID 1420 wrote to memory of 5380 1420 cmd.exe 154 PID 5380 wrote to memory of 240 5380 RLSN.exe 155 PID 240 wrote to memory of 1428 240 cmd.exe 159 PID 1428 wrote to memory of 2648 1428 VBHNGPL.exe 160 PID 2648 wrote to memory of 5056 2648 cmd.exe 164 PID 5056 wrote to memory of 1136 5056 UJNTTGG.exe 165 PID 1136 wrote to memory of 3868 1136 cmd.exe 169 PID 3868 wrote to memory of 1544 3868 BAOKZ.exe 170 PID 1544 wrote to memory of 4244 1544 cmd.exe 174 PID 4244 wrote to memory of 3260 4244 NID.exe 175 PID 3260 wrote to memory of 2448 3260 cmd.exe 179 PID 2448 wrote to memory of 3444 2448 ESGAUZN.exe 180 PID 3444 wrote to memory of 5928 3444 cmd.exe 184 PID 5928 wrote to memory of 3140 5928 XLVTEAV.exe 185 PID 3140 wrote to memory of 1452 3140 cmd.exe 189 PID 1452 wrote to memory of 4572 1452 FYAAOZ.exe 190 PID 4572 wrote to memory of 1284 4572 cmd.exe 194 PID 1284 wrote to memory of 4172 1284 JGGA.exe 195 PID 4172 wrote to memory of 2548 4172 cmd.exe 199 PID 2548 wrote to memory of 5588 2548 MXPWI.exe 200 PID 5588 wrote to memory of 1956 5588 cmd.exe 204 PID 1956 wrote to memory of 4908 1956 ZZY.exe 205 PID 4908 wrote to memory of 364 4908 cmd.exe 209 PID 364 wrote to memory of 2220 364 DPMVI.exe 210 PID 2220 wrote to memory of 3344 2220 cmd.exe 214 PID 3344 wrote to memory of 5940 3344 JDD.exe 215 PID 5940 wrote to memory of 1620 5940 cmd.exe 219 PID 1620 wrote to memory of 5744 1620 WOUUTM.exe 220 PID 5744 wrote to memory of 5856 5744 cmd.exe 224 PID 5856 wrote to memory of 2508 5856 XRY.exe 225 PID 2508 wrote to memory of 3924 2508 cmd.exe 229 PID 3924 wrote to memory of 4540 3924 SECAJ.exe 230 PID 4540 wrote to memory of 2540 4540 cmd.exe 234 PID 2540 wrote to memory of 2500 2540 BME.exe 235 PID 2500 wrote to memory of 5752 2500 cmd.exe 239 PID 5752 wrote to memory of 4812 5752 CHIIZ.exe 240 PID 4812 wrote to memory of 1844 4812 cmd.exe 244 PID 1844 wrote to memory of 4884 1844 RKS.exe 245 PID 4884 wrote to memory of 5540 4884 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_cf542c534281b641bba17a37bfa56f53_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOV.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\SysWOW64\XOV.exeC:\windows\system32\XOV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXYJ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\NXYJ.exeC:\windows\NXYJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\SysWOW64\VCD.exeC:\windows\system32\VCD.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFHMAAL.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\WFHMAAL.exeC:\windows\system\WFHMAAL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRBAW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\SysWOW64\XRBAW.exeC:\windows\system32\XRBAW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMK.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\SysWOW64\MMK.exeC:\windows\system32\MMK.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFEWFC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\system\MFEWFC.exeC:\windows\system\MFEWFC.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYAAOZ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\windows\FYAAOZ.exeC:\windows\FYAAOZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGGA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\JGGA.exeC:\windows\system32\JGGA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPMVI.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\SysWOW64\DPMVI.exeC:\windows\system32\DPMVI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\XRY.exeC:\windows\system\XRY.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SECAJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\SECAJ.exeC:\windows\SECAJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BME.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\BME.exeC:\windows\system\BME.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RKS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\system\RKS.exeC:\windows\system\RKS.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFVQQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\SysWOW64\KFVQQ.exeC:\windows\system32\KFVQQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDJL.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\windows\SysWOW64\TDJL.exeC:\windows\system32\TDJL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTK.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2560 -
C:\windows\SysWOW64\JTK.exeC:\windows\system32\JTK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZURUH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5488 -
C:\windows\system\FZURUH.exeC:\windows\system\FZURUH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMZ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3456 -
C:\windows\system\AMZ.exeC:\windows\system\AMZ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBOIE.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2352 -
C:\windows\SysWOW64\RUBOIE.exeC:\windows\system32\RUBOIE.exe75⤵
- Executes dropped EXE
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVD.exe.bat" "76⤵PID:3864
-
C:\windows\system\BVD.exeC:\windows\system\BVD.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "78⤵PID:1052
-
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLRHPWX.exe.bat" "80⤵PID:1512
-
C:\windows\system\KLRHPWX.exeC:\windows\system\KLRHPWX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYWQ.exe.bat" "82⤵PID:5048
-
C:\windows\SysWOW64\FYWQ.exeC:\windows\system32\FYWQ.exe83⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMBABW.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2392 -
C:\windows\system\AMBABW.exeC:\windows\system\AMBABW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APF.exe.bat" "86⤵PID:4592
-
C:\windows\system\APF.exeC:\windows\system\APF.exe87⤵
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXLDT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\windows\system\EXLDT.exeC:\windows\system\EXLDT.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSL.exe.bat" "90⤵PID:5080
-
C:\windows\SysWOW64\KSL.exeC:\windows\system32\KSL.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNUQJU.exe.bat" "92⤵PID:1616
-
C:\windows\ZNUQJU.exeC:\windows\ZNUQJU.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YITRNXE.exe.bat" "94⤵PID:5892
-
C:\windows\SysWOW64\YITRNXE.exeC:\windows\system32\YITRNXE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "96⤵PID:5308
-
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5608 -
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IULJW.exe.bat" "100⤵PID:4376
-
C:\windows\SysWOW64\IULJW.exeC:\windows\system32\IULJW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SRZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1600 -
C:\windows\system\SRZ.exeC:\windows\system\SRZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFR.exe.bat" "104⤵PID:3112
-
C:\windows\system\SFR.exeC:\windows\system\SFR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSWBP.exe.bat" "106⤵PID:4392
-
C:\windows\system\NSWBP.exeC:\windows\system\NSWBP.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RADBB.exe.bat" "108⤵PID:5356
-
C:\windows\RADBB.exeC:\windows\RADBB.exe109⤵
- Executes dropped EXE
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOHSEN.exe.bat" "110⤵PID:264
-
C:\windows\LOHSEN.exeC:\windows\LOHSEN.exe111⤵
- Executes dropped EXE
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRL.exe.bat" "112⤵PID:1108
-
C:\windows\system\MRL.exeC:\windows\system\MRL.exe113⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEQXT.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\windows\GEQXT.exeC:\windows\GEQXT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEYLKFF.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\windows\system\MEYLKFF.exeC:\windows\system\MEYLKFF.exe117⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFFZT.exe.bat" "118⤵PID:1816
-
C:\windows\SFFZT.exeC:\windows\SFFZT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAKIEZ.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2064 -
C:\windows\NAKIEZ.exeC:\windows\NAKIEZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-