Analysis
- max time kernel
84s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe
- Size 208KB
- Sample260724-xrazgaac93
- SHA256 aa0da519b245c599f43ed519304aeb4851d99022f1715f53f4004ff291045a67
- MD5 95af885365190f6632e8390a2f815e84
- SHA1 6244ed3813dc13bcf599ab7f5a095b97cc98272c
- SHA512 a8c21aa52242c90aac7b181bbbde99421bedb566c481d3f469ef13f5743bb27e5bd58a03ff532580f9bb70f0df93ec198ec29df0e80cdbaf0713d04ba595c854
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf44NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOQQEj1
- TLSH T1EF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2724 SVZM.exe 5016 QGQIXA.exe 5344 DRZH.exe 2128 JNYIIGG.exe 1284 ICJLD.exe 3208 MFH.exe 4192 BAZKOR.exe 3300 ATB.exe 6028 EBIAJXJ.exe 4444 IRPIV.exe 2652 RSRNYN.exe 1872 KKGYIO.exe 1540 CSIDTLR.exe 2376 UNMH.exe 2992 YDTH.exe 2760 QEVMO.exe 888 UUBUAJF.exe 1088 DUDZ.exe 2640 EXH.exe 5920 CVSYEK.exe 5096 VQE.exe 2540 FOKORII.exe 3724 XRNS.exe 4348 YUR.exe 3020 HUTBO.exe 2796 TKABAMJ.exe 5248 KVDRJS.exe 5884 LYP.exe 2976 ATYZHC.exe 1824 SWCUM.exe 2668 ACCJO.exe 3376 CZIDV.exe 2344 OAXFVKF.exe 540 UNWFA.exe 2312 SOETJ.exe 1712 JWGY.exe 3556 EJCQX.exe 2224 VWNINJ.exe 4236 VCNOOOE.exe 896 BCVC.exe 4972 MVYVG.exe 2676 HIDEQYB.exe 1628 QRFR.exe 1076 WREFCX.exe 5332 XUQ.exe 808 PPUEVDP.exe 1844 GCEWLIL.exe 1436 FYDXI.exe 4844 ZLAHSDP.exe 2552 WQGEZNJ.exe 3696 SOM.exe 52 YOTOXY.exe 2304 TKYYHYB.exe 5764 NXDH.exe 3596 ZPYAS.exe 2352 TDDJCFU.exe 1196 EVGCCN.exe 2188 QOJ.exe 5960 HBTFA.exe 4604 BOYWLRC.exe 4140 HKP.exe 3316 RXAPXQ.exe 2468 LKF.exe 2520 TQF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CSIDTLR.exe KKGYIO.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat KKGYIO.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat TKABAMJ.exe File created C:\windows\SysWOW64\JMXC.exe.bat OZTSPUW.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe EIY.exe File created C:\windows\SysWOW64\TKABAMJ.exe.bat HUTBO.exe File created C:\windows\SysWOW64\QOJ.exe EVGCCN.exe File created C:\windows\SysWOW64\QPCOUNK.exe WBXFS.exe File created C:\windows\SysWOW64\GFDFB.exe QPCOUNK.exe File created C:\windows\SysWOW64\TDOJN.exe ZQJ.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe ZQJ.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe JMXC.exe File created C:\windows\SysWOW64\IYFDD.exe EIY.exe File opened for modification C:\windows\SysWOW64\QGQIXA.exe SVZM.exe File created C:\windows\SysWOW64\KVDRJS.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\ATYZHC.exe LYP.exe File opened for modification C:\windows\SysWOW64\ACCJO.exe SWCUM.exe File opened for modification C:\windows\SysWOW64\YOTOXY.exe SOM.exe File created C:\windows\SysWOW64\TDOJN.exe.bat ZQJ.exe File opened for modification C:\windows\SysWOW64\EIY.exe DFUZLH.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe PXLKMQP.exe File created C:\windows\SysWOW64\MFH.exe ICJLD.exe File created C:\windows\SysWOW64\ATYZHC.exe LYP.exe File created C:\windows\SysWOW64\TKYYHYB.exe YOTOXY.exe File opened for modification C:\windows\SysWOW64\HKP.exe BOYWLRC.exe File opened for modification C:\windows\SysWOW64\IQI.exe IKQQZNC.exe File created C:\windows\SysWOW64\EIY.exe.bat DFUZLH.exe File created C:\windows\SysWOW64\PXLKMQP.exe TEBAIM.exe File created C:\windows\SysWOW64\ZVQXC.exe PXLKMQP.exe File created C:\windows\SysWOW64\HUTBO.exe.bat YUR.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe TKABAMJ.exe File created C:\windows\SysWOW64\MVYVG.exe BCVC.exe File created C:\windows\SysWOW64\IQI.exe.bat IKQQZNC.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat BJEAJ.exe File created C:\windows\SysWOW64\EIY.exe DFUZLH.exe File created C:\windows\SysWOW64\PXLKMQP.exe.bat TEBAIM.exe File created C:\windows\SysWOW64\ZXXGJK.exe PPV.exe File created C:\windows\SysWOW64\TKABAMJ.exe HUTBO.exe File created C:\windows\SysWOW64\MVYVG.exe.bat BCVC.exe File opened for modification C:\windows\SysWOW64\QPCOUNK.exe WBXFS.exe File created C:\windows\SysWOW64\UOGLZ.exe BLC.exe File created C:\windows\SysWOW64\UOGLZ.exe.bat BLC.exe File opened for modification C:\windows\SysWOW64\MFH.exe ICJLD.exe File created C:\windows\SysWOW64\MFH.exe.bat ICJLD.exe File opened for modification C:\windows\SysWOW64\HUTBO.exe YUR.exe File created C:\windows\SysWOW64\SWCUM.exe ATYZHC.exe File created C:\windows\SysWOW64\SWCUM.exe.bat ATYZHC.exe File created C:\windows\SysWOW64\PPUEVDP.exe.bat XUQ.exe File created C:\windows\SysWOW64\IQI.exe IKQQZNC.exe File created C:\windows\SysWOW64\HKMWSR.exe BJEAJ.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe YDTH.exe File opened for modification C:\windows\SysWOW64\PXLKMQP.exe TEBAIM.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe HUTBO.exe File opened for modification C:\windows\SysWOW64\SWCUM.exe ATYZHC.exe File created C:\windows\SysWOW64\YOTOXY.exe SOM.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat YOTOXY.exe File created C:\windows\SysWOW64\JSQQ.exe JMXC.exe File created C:\windows\SysWOW64\JSQQ.exe.bat JMXC.exe File opened for modification C:\windows\SysWOW64\BLC.exe ZXXGJK.exe File created C:\windows\SysWOW64\ACCJO.exe SWCUM.exe File created C:\windows\SysWOW64\JMXC.exe OZTSPUW.exe File created C:\windows\SysWOW64\TNGHL.exe ZVQXC.exe File opened for modification C:\windows\SysWOW64\ZXXGJK.exe PPV.exe File created C:\windows\SysWOW64\QEVMO.exe.bat YDTH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ZQJ.exe EDEISV.exe File created C:\windows\BAZKOR.exe.bat MFH.exe File created C:\windows\ZWRID.exe.bat GBNMXO.exe File opened for modification C:\windows\system\XSNXQX.exe GFDFB.exe File opened for modification C:\windows\EDEISV.exe YCWU.exe File created C:\windows\DYMQU.exe.bat LQKL.exe File created C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File created C:\windows\system\WBXFS.exe.bat ZWRID.exe File created C:\windows\TEBAIM.exe HET.exe File created C:\windows\CVSYEK.exe.bat EXH.exe File opened for modification C:\windows\VQE.exe CVSYEK.exe File opened for modification C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File created C:\windows\LKF.exe.bat RXAPXQ.exe File opened for modification C:\windows\system\SVZM.exe 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe File opened for modification C:\windows\YDTH.exe UNMH.exe File opened for modification C:\windows\EVGCCN.exe TDDJCFU.exe File created C:\windows\system\MGXNMKT.exe IQI.exe File created C:\windows\system\TCPHAYU.exe HKMWSR.exe File opened for modification C:\windows\CZIDV.exe ACCJO.exe File created C:\windows\VWNINJ.exe.bat EJCQX.exe File created C:\windows\system\RSMCZZ.exe.bat WXPL.exe File opened for modification C:\windows\ICJLD.exe JNYIIGG.exe File opened for modification C:\windows\system\KKGYIO.exe RSRNYN.exe File created C:\windows\VCNOOOE.exe VWNINJ.exe File created C:\windows\system\VAB.exe RSMCZZ.exe File opened for modification C:\windows\DRZH.exe QGQIXA.exe File opened for modification C:\windows\system\UNMH.exe CSIDTLR.exe File created C:\windows\QOFMV.exe.bat VAB.exe File created C:\windows\system\UNMH.exe.bat CSIDTLR.exe File created C:\windows\CZIDV.exe.bat ACCJO.exe File opened for modification C:\windows\VCNOOOE.exe VWNINJ.exe File created C:\windows\HIDEQYB.exe.bat MVYVG.exe File created C:\windows\system\KKGYIO.exe.bat RSRNYN.exe File opened for modification C:\windows\system\QRFR.exe HIDEQYB.exe File created C:\windows\LKF.exe RXAPXQ.exe File created C:\windows\system\HWZR.exe QOFMV.exe File created C:\windows\system\FZHHY.exe XMDSNG.exe File created C:\windows\system\QRFR.exe HIDEQYB.exe File opened for modification C:\windows\NXDH.exe TKYYHYB.exe File created C:\windows\TQF.exe LKF.exe File created C:\windows\system\QRFR.exe.bat HIDEQYB.exe File created C:\windows\system\RXAPXQ.exe HKP.exe File opened for modification C:\windows\system\SOM.exe WQGEZNJ.exe File opened for modification C:\windows\DYMQU.exe LQKL.exe File created C:\windows\system\JNYIIGG.exe DRZH.exe File created C:\windows\system\UNWFA.exe OAXFVKF.exe File created C:\windows\BOYWLRC.exe HBTFA.exe File created C:\windows\FYDXI.exe GCEWLIL.exe File opened for modification C:\windows\system\LQKL.exe TNGHL.exe File opened for modification C:\windows\system\FZHHY.exe XMDSNG.exe File created C:\windows\system\EBIAJXJ.exe.bat ATB.exe File opened for modification C:\windows\LYP.exe KVDRJS.exe File created C:\windows\system\OAXFVKF.exe TFSVLK.exe File created C:\windows\VCNOOOE.exe.bat VWNINJ.exe File created C:\windows\TQF.exe.bat LKF.exe File opened for modification C:\windows\system\TCPHAYU.exe HKMWSR.exe File created C:\windows\YCWU.exe TCPHAYU.exe File created C:\windows\YUR.exe.bat XRNS.exe File created C:\windows\system\JWGY.exe.bat SOETJ.exe File opened for modification C:\windows\system\MGTDP.exe IYFDD.exe File opened for modification C:\windows\HET.exe MGTDP.exe File created C:\windows\system\UNMH.exe CSIDTLR.exe File created C:\windows\system\FOKORII.exe.bat VQE.exe File opened for modification C:\windows\system\HBTFA.exe QOJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1280 cmd.exe 4160 cmd.exe 5592 cmd.exe 4680 cmd.exe 748 cmd.exe 1716 cmd.exe 4600 cmd.exe 1512 cmd.exe 5932 cmd.exe 4268 cmd.exe 6108 cmd.exe 3112 cmd.exe 5000 cmd.exe 1468 cmd.exe 4736 cmd.exe 1128 cmd.exe 2280 cmd.exe 4136 cmd.exe 4764 cmd.exe 5644 cmd.exe 3016 cmd.exe 4428 cmd.exe 4476 cmd.exe 3344 cmd.exe 3700 cmd.exe 5628 cmd.exe 1904 cmd.exe 2612 cmd.exe 4372 cmd.exe 2112 cmd.exe 4548 cmd.exe 5952 cmd.exe 5228 cmd.exe 5008 cmd.exe 3952 cmd.exe 5380 cmd.exe 1504 cmd.exe 2924 cmd.exe 3220 cmd.exe 2756 cmd.exe 5484 cmd.exe 4812 cmd.exe 2120 cmd.exe 1596 cmd.exe 5796 cmd.exe 5472 cmd.exe 3872 cmd.exe 5804 cmd.exe 5132 cmd.exe 2828 cmd.exe 1380 cmd.exe 5976 cmd.exe 6092 cmd.exe 2400 cmd.exe 4088 cmd.exe 4248 cmd.exe 2064 cmd.exe 5820 cmd.exe 4564 cmd.exe 3120 cmd.exe 5772 cmd.exe 2252 cmd.exe 5812 cmd.exe 3028 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 564 3704 WerFault.exe 87 2996 2724 WerFault.exe 93 4752 5016 WerFault.exe 99 1680 5344 WerFault.exe 104 3728 2128 WerFault.exe 109 4084 1284 WerFault.exe 114 6008 3208 WerFault.exe 118 4520 4192 WerFault.exe 124 2368 3300 WerFault.exe 129 4924 6028 WerFault.exe 134 3056 4444 WerFault.exe 139 4212 2652 WerFault.exe 144 464 1872 WerFault.exe 148 4484 1540 WerFault.exe 154 2816 2376 WerFault.exe 159 2316 2992 WerFault.exe 164 4664 2760 WerFault.exe 169 4488 888 WerFault.exe 173 6076 1088 WerFault.exe 179 1876 2640 WerFault.exe 184 3960 5920 WerFault.exe 189 1300 5096 WerFault.exe 194 3108 2540 WerFault.exe 199 2304 3724 WerFault.exe 204 1556 4348 WerFault.exe 209 4968 3020 WerFault.exe 214 1608 2796 WerFault.exe 219 1116 5248 WerFault.exe 224 4600 5884 WerFault.exe 229 5980 2976 WerFault.exe 234 5400 1824 WerFault.exe 239 4340 2668 WerFault.exe 244 5612 3376 WerFault.exe 249 3940 4432 WerFault.exe 254 4288 2344 WerFault.exe 259 1168 540 WerFault.exe 264 5812 2312 WerFault.exe 269 2352 1712 WerFault.exe 274 2568 3556 WerFault.exe 280 2984 2224 WerFault.exe 285 3720 4236 WerFault.exe 290 1312 896 WerFault.exe 295 3060 4972 WerFault.exe 300 4872 2676 WerFault.exe 305 4764 1628 WerFault.exe 310 2520 1076 WerFault.exe 315 1256 5332 WerFault.exe 320 476 808 WerFault.exe 325 4692 1844 WerFault.exe 330 5948 1436 WerFault.exe 335 5440 4844 WerFault.exe 340 4336 2552 WerFault.exe 345 4140 3696 WerFault.exe 350 4704 52 WerFault.exe 355 4752 2304 WerFault.exe 360 4492 5764 WerFault.exe 365 4128 3596 WerFault.exe 370 4928 2352 WerFault.exe 375 2496 1196 WerFault.exe 380 4852 2188 WerFault.exe 385 1312 5960 WerFault.exe 390 5148 4604 WerFault.exe 395 5576 4140 WerFault.exe 400 4996 3316 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEVMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGXNMKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEISV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNGHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFSVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGEZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVSYEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBTFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRPIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUTBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWRID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEKNDVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOKORII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYMQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMDSNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNWFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJEAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFUZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYFDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVGCCN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3704 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe 3704 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe 2724 SVZM.exe 2724 SVZM.exe 5016 QGQIXA.exe 5016 QGQIXA.exe 5344 DRZH.exe 5344 DRZH.exe 2128 JNYIIGG.exe 2128 JNYIIGG.exe 1284 ICJLD.exe 1284 ICJLD.exe 3208 MFH.exe 3208 MFH.exe 4192 BAZKOR.exe 4192 BAZKOR.exe 3300 ATB.exe 3300 ATB.exe 6028 EBIAJXJ.exe 6028 EBIAJXJ.exe 4444 IRPIV.exe 4444 IRPIV.exe 2652 RSRNYN.exe 2652 RSRNYN.exe 1872 KKGYIO.exe 1872 KKGYIO.exe 1540 CSIDTLR.exe 1540 CSIDTLR.exe 2376 UNMH.exe 2376 UNMH.exe 2992 YDTH.exe 2992 YDTH.exe 2760 QEVMO.exe 2760 QEVMO.exe 888 UUBUAJF.exe 888 UUBUAJF.exe 1088 DUDZ.exe 1088 DUDZ.exe 2640 EXH.exe 2640 EXH.exe 5920 CVSYEK.exe 5920 CVSYEK.exe 5096 VQE.exe 5096 VQE.exe 2540 FOKORII.exe 2540 FOKORII.exe 3724 XRNS.exe 3724 XRNS.exe 4348 YUR.exe 4348 YUR.exe 3020 HUTBO.exe 3020 HUTBO.exe 2796 TKABAMJ.exe 2796 TKABAMJ.exe 5248 KVDRJS.exe 5248 KVDRJS.exe 5884 LYP.exe 5884 LYP.exe 2976 ATYZHC.exe 2976 ATYZHC.exe 1824 SWCUM.exe 1824 SWCUM.exe 2668 ACCJO.exe 2668 ACCJO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3704 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe 3704 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe 2724 SVZM.exe 2724 SVZM.exe 5016 QGQIXA.exe 5016 QGQIXA.exe 5344 DRZH.exe 5344 DRZH.exe 2128 JNYIIGG.exe 2128 JNYIIGG.exe 1284 ICJLD.exe 1284 ICJLD.exe 3208 MFH.exe 3208 MFH.exe 4192 BAZKOR.exe 4192 BAZKOR.exe 3300 ATB.exe 3300 ATB.exe 6028 EBIAJXJ.exe 6028 EBIAJXJ.exe 4444 IRPIV.exe 4444 IRPIV.exe 2652 RSRNYN.exe 2652 RSRNYN.exe 1872 KKGYIO.exe 1872 KKGYIO.exe 1540 CSIDTLR.exe 1540 CSIDTLR.exe 2376 UNMH.exe 2376 UNMH.exe 2992 YDTH.exe 2992 YDTH.exe 2760 QEVMO.exe 2760 QEVMO.exe 888 UUBUAJF.exe 888 UUBUAJF.exe 1088 DUDZ.exe 1088 DUDZ.exe 2640 EXH.exe 2640 EXH.exe 5920 CVSYEK.exe 5920 CVSYEK.exe 5096 VQE.exe 5096 VQE.exe 2540 FOKORII.exe 2540 FOKORII.exe 3724 XRNS.exe 3724 XRNS.exe 4348 YUR.exe 4348 YUR.exe 3020 HUTBO.exe 3020 HUTBO.exe 2796 TKABAMJ.exe 2796 TKABAMJ.exe 5248 KVDRJS.exe 5248 KVDRJS.exe 5884 LYP.exe 5884 LYP.exe 2976 ATYZHC.exe 2976 ATYZHC.exe 1824 SWCUM.exe 1824 SWCUM.exe 2668 ACCJO.exe 2668 ACCJO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2924 3704 2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe 89 PID 2924 wrote to memory of 2724 2924 cmd.exe 93 PID 2724 wrote to memory of 4732 2724 SVZM.exe 95 PID 4732 wrote to memory of 5016 4732 cmd.exe 99 PID 5016 wrote to memory of 1264 5016 QGQIXA.exe 100 PID 1264 wrote to memory of 5344 1264 cmd.exe 104 PID 5344 wrote to memory of 5932 5344 DRZH.exe 105 PID 5932 wrote to memory of 2128 5932 cmd.exe 109 PID 2128 wrote to memory of 2828 2128 JNYIIGG.exe 110 PID 2828 wrote to memory of 1284 2828 cmd.exe 114 PID 1284 wrote to memory of 4476 1284 ICJLD.exe 115 PID 4476 wrote to memory of 3208 4476 cmd.exe 118 PID 3208 wrote to memory of 1128 3208 MFH.exe 120 PID 1128 wrote to memory of 4192 1128 cmd.exe 124 PID 4192 wrote to memory of 1524 4192 BAZKOR.exe 125 PID 1524 wrote to memory of 3300 1524 cmd.exe 129 PID 3300 wrote to memory of 1084 3300 ATB.exe 130 PID 1084 wrote to memory of 6028 1084 cmd.exe 134 PID 6028 wrote to memory of 2280 6028 EBIAJXJ.exe 135 PID 2280 wrote to memory of 4444 2280 cmd.exe 139 PID 4444 wrote to memory of 2800 4444 IRPIV.exe 140 PID 2800 wrote to memory of 2652 2800 cmd.exe 144 PID 2652 wrote to memory of 2528 2652 RSRNYN.exe 145 PID 2528 wrote to memory of 1872 2528 cmd.exe 148 PID 1872 wrote to memory of 5496 1872 KKGYIO.exe 150 PID 5496 wrote to memory of 1540 5496 cmd.exe 154 PID 1540 wrote to memory of 1676 1540 CSIDTLR.exe 155 PID 1676 wrote to memory of 2376 1676 cmd.exe 159 PID 2376 wrote to memory of 1368 2376 UNMH.exe 160 PID 1368 wrote to memory of 2992 1368 cmd.exe 164 PID 2992 wrote to memory of 5624 2992 YDTH.exe 165 PID 5624 wrote to memory of 2760 5624 cmd.exe 169 PID 2760 wrote to memory of 5316 2760 QEVMO.exe 170 PID 5316 wrote to memory of 888 5316 cmd.exe 173 PID 888 wrote to memory of 3220 888 UUBUAJF.exe 175 PID 3220 wrote to memory of 1088 3220 cmd.exe 179 PID 1088 wrote to memory of 5100 1088 DUDZ.exe 180 PID 5100 wrote to memory of 2640 5100 cmd.exe 184 PID 2640 wrote to memory of 5104 2640 EXH.exe 185 PID 5104 wrote to memory of 5920 5104 cmd.exe 189 PID 5920 wrote to memory of 1992 5920 CVSYEK.exe 190 PID 1992 wrote to memory of 5096 1992 cmd.exe 194 PID 5096 wrote to memory of 3120 5096 VQE.exe 195 PID 3120 wrote to memory of 2540 3120 cmd.exe 199 PID 2540 wrote to memory of 3520 2540 FOKORII.exe 200 PID 3520 wrote to memory of 3724 3520 cmd.exe 204 PID 3724 wrote to memory of 6096 3724 XRNS.exe 205 PID 6096 wrote to memory of 4348 6096 cmd.exe 209 PID 4348 wrote to memory of 2212 4348 YUR.exe 210 PID 2212 wrote to memory of 3020 2212 cmd.exe 214 PID 3020 wrote to memory of 1412 3020 HUTBO.exe 215 PID 1412 wrote to memory of 2796 1412 cmd.exe 219 PID 2796 wrote to memory of 5772 2796 TKABAMJ.exe 220 PID 5772 wrote to memory of 5248 5772 cmd.exe 224 PID 5248 wrote to memory of 5200 5248 KVDRJS.exe 225 PID 5200 wrote to memory of 5884 5200 cmd.exe 229 PID 5884 wrote to memory of 4248 5884 LYP.exe 230 PID 4248 wrote to memory of 2976 4248 cmd.exe 234 PID 2976 wrote to memory of 4756 2976 ATYZHC.exe 235 PID 4756 wrote to memory of 1824 4756 cmd.exe 239 PID 1824 wrote to memory of 2880 1824 SWCUM.exe 240 PID 2880 wrote to memory of 2668 2880 cmd.exe 244 PID 2668 wrote to memory of 4576 2668 ACCJO.exe 245 PID 4576 wrote to memory of 3376 4576 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_95af885365190f6632e8390a2f815e84_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVZM.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\system\SVZM.exeC:\windows\system\SVZM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\DRZH.exeC:\windows\DRZH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNYIIGG.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\JNYIIGG.exeC:\windows\system\JNYIIGG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICJLD.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\ICJLD.exeC:\windows\ICJLD.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MFH.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\MFH.exeC:\windows\system32\MFH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAZKOR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\BAZKOR.exeC:\windows\BAZKOR.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\YDTH.exeC:\windows\YDTH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUBUAJF.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\system\UUBUAJF.exeC:\windows\system\UUBUAJF.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUDZ.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\DUDZ.exeC:\windows\DUDZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\EXH.exeC:\windows\EXH.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\windows\VQE.exeC:\windows\VQE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRNS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\XRNS.exeC:\windows\XRNS.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\YUR.exeC:\windows\YUR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\windows\LYP.exeC:\windows\LYP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACCJO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\SysWOW64\ACCJO.exeC:\windows\system32\ACCJO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\CZIDV.exeC:\windows\CZIDV.exe65⤵
- Executes dropped EXE
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe67⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3344 -
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNWFA.exe.bat" "70⤵PID:2892
-
C:\windows\system\UNWFA.exeC:\windows\system\UNWFA.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5300 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "74⤵PID:3160
-
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe75⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "76⤵PID:3728
-
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWNINJ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\VWNINJ.exeC:\windows\VWNINJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCNOOOE.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4136 -
C:\windows\VCNOOOE.exeC:\windows\VCNOOOE.exe81⤵
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCVC.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\windows\BCVC.exeC:\windows\BCVC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1380 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "86⤵PID:3936
-
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRFR.exe.bat" "88⤵PID:4164
-
C:\windows\system\QRFR.exeC:\windows\system\QRFR.exe89⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "90⤵PID:984
-
C:\windows\WREFCX.exeC:\windows\WREFCX.exe91⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1280 -
C:\windows\XUQ.exeC:\windows\XUQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "94⤵PID:1340
-
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe95⤵
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4600 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5976 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:6092 -
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4160 -
C:\windows\system\SOM.exeC:\windows\system\SOM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOTOXY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4548 -
C:\windows\SysWOW64\YOTOXY.exeC:\windows\system32\YOTOXY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4736 -
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\windows\NXDH.exeC:\windows\NXDH.exe111⤵
- Executes dropped EXE
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1512 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe113⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDDJCFU.exe.bat" "114⤵PID:4964
-
C:\windows\system\TDDJCFU.exeC:\windows\system\TDDJCFU.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EVGCCN.exe.bat" "116⤵PID:3432
-
C:\windows\EVGCCN.exeC:\windows\EVGCCN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOJ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4268 -
C:\windows\SysWOW64\QOJ.exeC:\windows\system32\QOJ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBTFA.exe.bat" "120⤵PID:2368
-
C:\windows\system\HBTFA.exeC:\windows\system\HBTFA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-