Analysis
- max time kernel
93s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe
- Size 208KB
- Sample260727-talg4aweka
- SHA256 0b7e05576e4ec6829ea02388712f3c2cb07e50d955f68da645bcb1961e74194c
- MD5 44b48a1d942d41f1dc1307a3b0872a1d
- SHA1 aefe2660bad19b9c5158bae763857ed1d1f6fe90
- SHA512 3d72bcd55be8782d543b54b2b3c4a0cfaadbc1aa7227710789b359c293fadfaecb1997e165ce4eb0924dd437c381edfacce36f0180ff66507fc493f4c9a5d8b8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOfS4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LO6kEj1
- TLSH T16C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1628 RJP.exe 5504 RMZJGC.exe 240 CECCOKI.exe 1576 IXKP.exe 5588 KUQC.exe 1140 FQUTPU.exe 4344 RYJ.exe 2668 LLGCL.exe 5808 GGLMWEY.exe 4768 PHN.exe 5600 TXTZL.exe 3488 WKYIOCL.exe 4336 FKANZ.exe 5396 YNERFPP.exe 2776 EOMF.exe 2752 JOTTX.exe 4740 KRXO.exe 5700 XPFAMNK.exe 980 NKOMX.exe 3184 UAP.exe 4988 EYVYTE.exe 1904 IOC.exe 4084 JJNCLMG.exe 4268 BMRY.exe 5984 LKXS.exe 4824 VSZXJ.exe 2328 VNDB.exe 5724 ULOWCLK.exe 2044 AGN.exe 5948 HBFJRB.exe 5768 KOB.exe 4132 ECGCM.exe 4832 EHGQN.exe 4540 ZCLZYNV.exe 4972 SVBKHOD.exe 1264 LYEO.exe 1524 XGL.exe 2816 LMR.exe 3100 GZOVQ.exe 1776 RSRNYN.exe 908 XSY.exe 1928 SFDLR.exe 4480 JNFQVN.exe 3372 YDGPC.exe 364 WEODLCP.exe 3404 ZRTM.exe 4636 XRAA.exe 4324 OSCFPCH.exe 5888 SIJNU.exe 1468 MVOWEUS.exe 3908 HIS.exe 4472 YRULS.exe 3848 TERUCRX.exe 2168 IZJH.exe 5908 BCNCAC.exe 4748 ZNPSB.exe 3016 TFFDS.exe 2836 XQD.exe 1836 ZOJ.exe 2096 HUVZKJS.exe 1496 CEEQZ.exe 4228 SURIOA.exe 1860 LIYGTC.exe 1208 CQELYT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\LKXS.exe BMRY.exe File created C:\windows\SysWOW64\XSY.exe.bat RSRNYN.exe File created C:\windows\SysWOW64\YDGPC.exe JNFQVN.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe SIJNU.exe File created C:\windows\SysWOW64\HVJIGPW.exe ODBXOOO.exe File opened for modification C:\windows\SysWOW64\XTARLM.exe XQWN.exe File created C:\windows\SysWOW64\BBGRX.exe.bat XTARLM.exe File created C:\windows\SysWOW64\CECCOKI.exe RMZJGC.exe File created C:\windows\SysWOW64\YNERFPP.exe FKANZ.exe File created C:\windows\SysWOW64\SVBKHOD.exe ZCLZYNV.exe File created C:\windows\SysWOW64\YDGPC.exe.bat JNFQVN.exe File created C:\windows\SysWOW64\WEODLCP.exe YDGPC.exe File created C:\windows\SysWOW64\EYVYTE.exe UAP.exe File opened for modification C:\windows\SysWOW64\BMRY.exe JJNCLMG.exe File created C:\windows\SysWOW64\YRULS.exe HIS.exe File created C:\windows\SysWOW64\OGWBK.exe KYQTY.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe LSVG.exe File created C:\windows\SysWOW64\RRYK.exe.bat AIWXJZY.exe File created C:\windows\SysWOW64\PDJH.exe FXZPFT.exe File opened for modification C:\windows\SysWOW64\XQWN.exe PDJH.exe File opened for modification C:\windows\SysWOW64\WEODLCP.exe YDGPC.exe File created C:\windows\SysWOW64\EAJWW.exe.bat UCWCPZ.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe XTARLM.exe File opened for modification C:\windows\SysWOW64\DSTM.exe CNB.exe File created C:\windows\SysWOW64\IXKP.exe.bat CECCOKI.exe File opened for modification C:\windows\SysWOW64\RYJ.exe FQUTPU.exe File opened for modification C:\windows\SysWOW64\JOTTX.exe EOMF.exe File created C:\windows\SysWOW64\SVBKHOD.exe.bat ZCLZYNV.exe File created C:\windows\SysWOW64\DSTM.exe.bat CNB.exe File created C:\windows\SysWOW64\JOTTX.exe EOMF.exe File created C:\windows\SysWOW64\VSZXJ.exe LKXS.exe File created C:\windows\SysWOW64\HBFJRB.exe AGN.exe File opened for modification C:\windows\SysWOW64\EHGQN.exe ECGCM.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe ZNPSB.exe File created C:\windows\SysWOW64\KUQC.exe.bat IXKP.exe File created C:\windows\SysWOW64\WEODLCP.exe.bat YDGPC.exe File created C:\windows\SysWOW64\MVOWEUS.exe SIJNU.exe File opened for modification C:\windows\SysWOW64\RRYK.exe AIWXJZY.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe GLJNC.exe File created C:\windows\SysWOW64\HBFJRB.exe.bat AGN.exe File created C:\windows\SysWOW64\YRULS.exe.bat HIS.exe File created C:\windows\SysWOW64\XQWN.exe PDJH.exe File created C:\windows\SysWOW64\YNERFPP.exe.bat FKANZ.exe File created C:\windows\SysWOW64\EYVYTE.exe.bat UAP.exe File created C:\windows\SysWOW64\JJNCLMG.exe IOC.exe File created C:\windows\SysWOW64\EHGQN.exe ECGCM.exe File created C:\windows\SysWOW64\PDJH.exe.bat FXZPFT.exe File opened for modification C:\windows\SysWOW64\RFPQQ.exe EUZRCXB.exe File opened for modification C:\windows\SysWOW64\UAP.exe NKOMX.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe KYQTY.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe SEL.exe File opened for modification C:\windows\SysWOW64\CECCOKI.exe RMZJGC.exe File created C:\windows\SysWOW64\JOTTX.exe.bat EOMF.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat SIJNU.exe File created C:\windows\SysWOW64\KBQNORU.exe GLJNC.exe File opened for modification C:\windows\SysWOW64\XSY.exe RSRNYN.exe File created C:\windows\SysWOW64\LKXS.exe BMRY.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe ZOJ.exe File created C:\windows\SysWOW64\HVJIGPW.exe.bat ODBXOOO.exe File created C:\windows\SysWOW64\RRHQES.exe BBGRX.exe File created C:\windows\SysWOW64\ITAZLQ.exe DSTM.exe File created C:\windows\SysWOW64\BMRY.exe JJNCLMG.exe File created C:\windows\SysWOW64\JNFQVN.exe SFDLR.exe File created C:\windows\SysWOW64\HUVZKJS.exe ZOJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ARHWU.exe.bat GWC.exe File opened for modification C:\windows\FKANZ.exe WKYIOCL.exe File opened for modification C:\windows\KOB.exe HBFJRB.exe File opened for modification C:\windows\HNUAAY.exe QFSVW.exe File opened for modification C:\windows\FNM.exe BXFMY.exe File created C:\windows\system\GWC.exe.bat UOWNFW.exe File created C:\windows\PHN.exe GGLMWEY.exe File created C:\windows\system\AGN.exe.bat ULOWCLK.exe File created C:\windows\PSR.exe EAJWW.exe File created C:\windows\system\LLPIS.exe HVJIGPW.exe File created C:\windows\system\GLJNC.exe LBBOO.exe File opened for modification C:\windows\RJP.exe 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe File created C:\windows\LLGCL.exe.bat RYJ.exe File created C:\windows\system\IOC.exe.bat EYVYTE.exe File created C:\windows\ZCLZYNV.exe.bat EHGQN.exe File created C:\windows\system\LMR.exe.bat XGL.exe File created C:\windows\HIS.exe.bat MVOWEUS.exe File created C:\windows\system\WOHCKBC.exe QSITNYM.exe File opened for modification C:\windows\UCWCPZ.exe OGWBK.exe File created C:\windows\system\LYEO.exe SVBKHOD.exe File opened for modification C:\windows\TERUCRX.exe YRULS.exe File created C:\windows\system\LIYGTC.exe.bat SURIOA.exe File opened for modification C:\windows\EUZRCXB.exe YGZQXU.exe File opened for modification C:\windows\PSR.exe EAJWW.exe File opened for modification C:\windows\system\ODBXOOO.exe PSR.exe File created C:\windows\system\VSHNGKF.exe.bat AMZ.exe File opened for modification C:\windows\system\AGN.exe ULOWCLK.exe File created C:\windows\system\LMR.exe XGL.exe File created C:\windows\OSCFPCH.exe.bat XRAA.exe File created C:\windows\TERUCRX.exe.bat YRULS.exe File created C:\windows\system\BCNCAC.exe.bat IZJH.exe File created C:\windows\system\CEEQZ.exe.bat HUVZKJS.exe File opened for modification C:\windows\system\FZURUH.exe LLPIS.exe File created C:\windows\system\FZURUH.exe.bat LLPIS.exe File opened for modification C:\windows\LLGCL.exe RYJ.exe File opened for modification C:\windows\system\ECGCM.exe KOB.exe File created C:\windows\XRAA.exe.bat ZRTM.exe File created C:\windows\SIJNU.exe OSCFPCH.exe File created C:\windows\system\IZJH.exe TERUCRX.exe File created C:\windows\YGZQXU.exe EGSFNB.exe File opened for modification C:\windows\system\WOHCKBC.exe QSITNYM.exe File opened for modification C:\windows\system\KYQTY.exe WOHCKBC.exe File created C:\windows\system\SFDLR.exe XSY.exe File created C:\windows\SURIOA.exe CEEQZ.exe File created C:\windows\EUZRCXB.exe.bat YGZQXU.exe File created C:\windows\HNUAAY.exe QFSVW.exe File created C:\windows\XKZAEG.exe KHQ.exe File created C:\windows\CNB.exe NSJTI.exe File opened for modification C:\windows\CNB.exe NSJTI.exe File created C:\windows\CNB.exe.bat NSJTI.exe File opened for modification C:\windows\system\WKYIOCL.exe TXTZL.exe File created C:\windows\system\ECGCM.exe.bat KOB.exe File created C:\windows\system\SFDLR.exe.bat XSY.exe File created C:\windows\system\XQD.exe.bat TFFDS.exe File created C:\windows\UCWCPZ.exe OGWBK.exe File created C:\windows\system\LLPIS.exe.bat HVJIGPW.exe File opened for modification C:\windows\system\AMZ.exe FZURUH.exe File created C:\windows\HNUAAY.exe.bat QFSVW.exe File opened for modification C:\windows\HIS.exe MVOWEUS.exe File created C:\windows\system\HMIOFJB.exe RRYK.exe File created C:\windows\LBBOO.exe QNW.exe File created C:\windows\system\PBYXL.exe.bat PWMRI.exe File created C:\windows\UOWNFW.exe WNOZ.exe File created C:\windows\system\EOMF.exe YNERFPP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4468 cmd.exe 2444 cmd.exe 2380 cmd.exe 4528 cmd.exe 692 cmd.exe 1076 cmd.exe 4188 cmd.exe 4212 cmd.exe 4180 cmd.exe 5860 cmd.exe 1972 cmd.exe 3316 cmd.exe 3096 cmd.exe 4348 cmd.exe 356 cmd.exe 5512 cmd.exe 2812 cmd.exe 3656 cmd.exe 1352 cmd.exe 4128 cmd.exe 3132 cmd.exe 1644 cmd.exe 3712 cmd.exe 5928 cmd.exe 4840 cmd.exe 2384 cmd.exe 5740 cmd.exe 6088 cmd.exe 4448 cmd.exe 3136 cmd.exe 1340 cmd.exe 3836 cmd.exe 4340 cmd.exe 1924 cmd.exe 4384 cmd.exe 1472 cmd.exe 3228 cmd.exe 4220 cmd.exe 5508 cmd.exe 2724 cmd.exe 3208 cmd.exe 4788 cmd.exe 2552 cmd.exe 3672 cmd.exe 616 cmd.exe 5900 cmd.exe 1768 cmd.exe 2232 cmd.exe 1912 cmd.exe 2004 cmd.exe 2832 cmd.exe 3324 cmd.exe 620 cmd.exe 3880 cmd.exe 2468 cmd.exe 4308 cmd.exe 6036 cmd.exe 1832 cmd.exe 2116 cmd.exe 2884 cmd.exe 1404 cmd.exe 1356 cmd.exe 3004 cmd.exe 3172 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5652 4968 WerFault.exe 88 5436 1628 WerFault.exe 93 5396 5504 WerFault.exe 99 5488 240 WerFault.exe 104 1644 1576 WerFault.exe 109 2468 5588 WerFault.exe 114 2408 1140 WerFault.exe 119 2336 4344 WerFault.exe 124 2116 2668 WerFault.exe 129 4472 5808 WerFault.exe 134 5352 4768 WerFault.exe 139 6060 5600 WerFault.exe 144 4520 3488 WerFault.exe 149 1536 4336 WerFault.exe 154 2972 5396 WerFault.exe 159 928 2776 WerFault.exe 164 2468 2752 WerFault.exe 169 3100 4740 WerFault.exe 174 1712 5700 WerFault.exe 179 976 980 WerFault.exe 184 1200 3184 WerFault.exe 189 4512 4988 WerFault.exe 194 3928 1904 WerFault.exe 199 4520 4084 WerFault.exe 204 4292 4268 WerFault.exe 209 3656 5984 WerFault.exe 214 5952 4824 WerFault.exe 219 4464 2328 WerFault.exe 224 2296 5724 WerFault.exe 229 4536 2044 WerFault.exe 234 4776 5948 WerFault.exe 239 6016 5768 WerFault.exe 244 4432 4132 WerFault.exe 249 4976 4832 WerFault.exe 253 404 4540 WerFault.exe 259 256 4972 WerFault.exe 264 1332 1264 WerFault.exe 269 5408 1524 WerFault.exe 274 5648 2816 WerFault.exe 280 4332 3100 WerFault.exe 285 1132 1776 WerFault.exe 290 2228 908 WerFault.exe 295 5236 1928 WerFault.exe 300 4940 4480 WerFault.exe 305 916 3372 WerFault.exe 310 1664 364 WerFault.exe 315 1084 3404 WerFault.exe 320 3448 4636 WerFault.exe 325 2864 4324 WerFault.exe 330 1852 5888 WerFault.exe 335 2368 1468 WerFault.exe 340 3492 3908 WerFault.exe 345 5448 4472 WerFault.exe 350 6032 3848 WerFault.exe 355 3284 2168 WerFault.exe 360 4948 5908 WerFault.exe 365 4700 4748 WerFault.exe 370 3800 3016 WerFault.exe 375 5952 2836 WerFault.exe 380 5532 1836 WerFault.exe 385 2284 2096 WerFault.exe 390 5608 1496 WerFault.exe 395 3708 4228 WerFault.exe 400 4116 1860 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFDLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUVZKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVBKHOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQELYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBGRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLPIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYVYTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSZXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCWCPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOHCKBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXZPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRHQES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNPSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSJTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIYGTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVOWEUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe 4968 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe 1628 RJP.exe 1628 RJP.exe 5504 RMZJGC.exe 5504 RMZJGC.exe 240 CECCOKI.exe 240 CECCOKI.exe 1576 IXKP.exe 1576 IXKP.exe 5588 KUQC.exe 5588 KUQC.exe 1140 FQUTPU.exe 1140 FQUTPU.exe 4344 RYJ.exe 4344 RYJ.exe 2668 LLGCL.exe 2668 LLGCL.exe 5808 GGLMWEY.exe 5808 GGLMWEY.exe 4768 PHN.exe 4768 PHN.exe 5600 TXTZL.exe 5600 TXTZL.exe 3488 WKYIOCL.exe 3488 WKYIOCL.exe 4336 FKANZ.exe 4336 FKANZ.exe 5396 YNERFPP.exe 5396 YNERFPP.exe 2776 EOMF.exe 2776 EOMF.exe 2752 JOTTX.exe 2752 JOTTX.exe 4740 KRXO.exe 4740 KRXO.exe 5700 XPFAMNK.exe 5700 XPFAMNK.exe 980 NKOMX.exe 980 NKOMX.exe 3184 UAP.exe 3184 UAP.exe 4988 EYVYTE.exe 4988 EYVYTE.exe 1904 IOC.exe 1904 IOC.exe 4084 JJNCLMG.exe 4084 JJNCLMG.exe 4268 BMRY.exe 4268 BMRY.exe 5984 LKXS.exe 5984 LKXS.exe 4824 VSZXJ.exe 4824 VSZXJ.exe 2328 VNDB.exe 2328 VNDB.exe 5724 ULOWCLK.exe 5724 ULOWCLK.exe 2044 AGN.exe 2044 AGN.exe 5948 HBFJRB.exe 5948 HBFJRB.exe 5768 KOB.exe 5768 KOB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4968 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe 4968 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe 1628 RJP.exe 1628 RJP.exe 5504 RMZJGC.exe 5504 RMZJGC.exe 240 CECCOKI.exe 240 CECCOKI.exe 1576 IXKP.exe 1576 IXKP.exe 5588 KUQC.exe 5588 KUQC.exe 1140 FQUTPU.exe 1140 FQUTPU.exe 4344 RYJ.exe 4344 RYJ.exe 2668 LLGCL.exe 2668 LLGCL.exe 5808 GGLMWEY.exe 5808 GGLMWEY.exe 4768 PHN.exe 4768 PHN.exe 5600 TXTZL.exe 5600 TXTZL.exe 3488 WKYIOCL.exe 3488 WKYIOCL.exe 4336 FKANZ.exe 4336 FKANZ.exe 5396 YNERFPP.exe 5396 YNERFPP.exe 2776 EOMF.exe 2776 EOMF.exe 2752 JOTTX.exe 2752 JOTTX.exe 4740 KRXO.exe 4740 KRXO.exe 5700 XPFAMNK.exe 5700 XPFAMNK.exe 980 NKOMX.exe 980 NKOMX.exe 3184 UAP.exe 3184 UAP.exe 4988 EYVYTE.exe 4988 EYVYTE.exe 1904 IOC.exe 1904 IOC.exe 4084 JJNCLMG.exe 4084 JJNCLMG.exe 4268 BMRY.exe 4268 BMRY.exe 5984 LKXS.exe 5984 LKXS.exe 4824 VSZXJ.exe 4824 VSZXJ.exe 2328 VNDB.exe 2328 VNDB.exe 5724 ULOWCLK.exe 5724 ULOWCLK.exe 2044 AGN.exe 2044 AGN.exe 5948 HBFJRB.exe 5948 HBFJRB.exe 5768 KOB.exe 5768 KOB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4968 wrote to memory of 6036 4968 2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe 89 PID 6036 wrote to memory of 1628 6036 cmd.exe 93 PID 1628 wrote to memory of 3172 1628 RJP.exe 95 PID 3172 wrote to memory of 5504 3172 cmd.exe 99 PID 5504 wrote to memory of 3852 5504 RMZJGC.exe 100 PID 3852 wrote to memory of 240 3852 cmd.exe 104 PID 240 wrote to memory of 2312 240 CECCOKI.exe 105 PID 2312 wrote to memory of 1576 2312 cmd.exe 109 PID 1576 wrote to memory of 2856 1576 IXKP.exe 110 PID 2856 wrote to memory of 5588 2856 cmd.exe 114 PID 5588 wrote to memory of 5740 5588 KUQC.exe 115 PID 5740 wrote to memory of 1140 5740 cmd.exe 119 PID 1140 wrote to memory of 3672 1140 FQUTPU.exe 120 PID 3672 wrote to memory of 4344 3672 cmd.exe 124 PID 4344 wrote to memory of 5584 4344 RYJ.exe 125 PID 5584 wrote to memory of 2668 5584 cmd.exe 129 PID 2668 wrote to memory of 2716 2668 LLGCL.exe 130 PID 2716 wrote to memory of 5808 2716 cmd.exe 134 PID 5808 wrote to memory of 5832 5808 GGLMWEY.exe 135 PID 5832 wrote to memory of 4768 5832 cmd.exe 139 PID 4768 wrote to memory of 3004 4768 PHN.exe 140 PID 3004 wrote to memory of 5600 3004 cmd.exe 144 PID 5600 wrote to memory of 3508 5600 TXTZL.exe 145 PID 3508 wrote to memory of 3488 3508 cmd.exe 149 PID 3488 wrote to memory of 4672 3488 WKYIOCL.exe 150 PID 4672 wrote to memory of 4336 4672 cmd.exe 154 PID 4336 wrote to memory of 356 4336 FKANZ.exe 155 PID 356 wrote to memory of 5396 356 cmd.exe 159 PID 5396 wrote to memory of 2380 5396 YNERFPP.exe 160 PID 2380 wrote to memory of 2776 2380 cmd.exe 164 PID 2776 wrote to memory of 480 2776 EOMF.exe 165 PID 480 wrote to memory of 2752 480 cmd.exe 169 PID 2752 wrote to memory of 5512 2752 JOTTX.exe 170 PID 5512 wrote to memory of 4740 5512 cmd.exe 174 PID 4740 wrote to memory of 4392 4740 KRXO.exe 175 PID 4392 wrote to memory of 5700 4392 cmd.exe 179 PID 5700 wrote to memory of 2388 5700 XPFAMNK.exe 180 PID 2388 wrote to memory of 980 2388 cmd.exe 184 PID 980 wrote to memory of 3280 980 NKOMX.exe 185 PID 3280 wrote to memory of 3184 3280 cmd.exe 189 PID 3184 wrote to memory of 5500 3184 UAP.exe 190 PID 5500 wrote to memory of 4988 5500 cmd.exe 194 PID 4988 wrote to memory of 1452 4988 EYVYTE.exe 195 PID 1452 wrote to memory of 1904 1452 cmd.exe 199 PID 1904 wrote to memory of 5676 1904 IOC.exe 200 PID 5676 wrote to memory of 4084 5676 cmd.exe 204 PID 4084 wrote to memory of 4340 4084 JJNCLMG.exe 205 PID 4340 wrote to memory of 4268 4340 cmd.exe 209 PID 4268 wrote to memory of 4528 4268 BMRY.exe 210 PID 4528 wrote to memory of 5984 4528 cmd.exe 214 PID 5984 wrote to memory of 616 5984 LKXS.exe 215 PID 616 wrote to memory of 4824 616 cmd.exe 219 PID 4824 wrote to memory of 692 4824 VSZXJ.exe 220 PID 692 wrote to memory of 2328 692 cmd.exe 224 PID 2328 wrote to memory of 3268 2328 VNDB.exe 225 PID 3268 wrote to memory of 5724 3268 cmd.exe 229 PID 5724 wrote to memory of 2004 5724 ULOWCLK.exe 230 PID 2004 wrote to memory of 2044 2004 cmd.exe 234 PID 2044 wrote to memory of 1076 2044 AGN.exe 235 PID 1076 wrote to memory of 5948 1076 cmd.exe 239 PID 5948 wrote to memory of 976 5948 HBFJRB.exe 240 PID 976 wrote to memory of 5768 976 cmd.exe 244 PID 5768 wrote to memory of 4212 5768 KOB.exe 245 PID 4212 wrote to memory of 4132 4212 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_44b48a1d942d41f1dc1307a3b0872a1d_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJP.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\RJP.exeC:\windows\RJP.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RMZJGC.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\system\RMZJGC.exeC:\windows\system\RMZJGC.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECCOKI.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\SysWOW64\CECCOKI.exeC:\windows\system32\CECCOKI.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXKP.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\SysWOW64\IXKP.exeC:\windows\system32\IXKP.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUQC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\KUQC.exeC:\windows\system32\KUQC.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQUTPU.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\system\FQUTPU.exeC:\windows\system\FQUTPU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RYJ.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\windows\SysWOW64\RYJ.exeC:\windows\system32\RYJ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LLGCL.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\windows\LLGCL.exeC:\windows\LLGCL.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GGLMWEY.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\windows\system\GGLMWEY.exeC:\windows\system\GGLMWEY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHN.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\PHN.exeC:\windows\PHN.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXTZL.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\TXTZL.exeC:\windows\system\TXTZL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKYIOCL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\system\WKYIOCL.exeC:\windows\system\WKYIOCL.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKANZ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\FKANZ.exeC:\windows\FKANZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNERFPP.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:356 -
C:\windows\SysWOW64\YNERFPP.exeC:\windows\system32\YNERFPP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOMF.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\system\EOMF.exeC:\windows\system\EOMF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JOTTX.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\SysWOW64\JOTTX.exeC:\windows\system32\JOTTX.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRXO.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\SysWOW64\KRXO.exeC:\windows\system32\KRXO.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPFAMNK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\system\XPFAMNK.exeC:\windows\system\XPFAMNK.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKOMX.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\SysWOW64\NKOMX.exeC:\windows\system32\NKOMX.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\SysWOW64\UAP.exeC:\windows\system32\UAP.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYVYTE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\SysWOW64\EYVYTE.exeC:\windows\system32\EYVYTE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\system\IOC.exeC:\windows\system\IOC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJNCLMG.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\SysWOW64\JJNCLMG.exeC:\windows\system32\JJNCLMG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKXS.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SysWOW64\LKXS.exeC:\windows\system32\LKXS.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSZXJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\VSZXJ.exeC:\windows\system32\VSZXJ.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNDB.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\system\VNDB.exeC:\windows\system\VNDB.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULOWCLK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\SysWOW64\ULOWCLK.exeC:\windows\system32\ULOWCLK.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBFJRB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\SysWOW64\HBFJRB.exeC:\windows\system32\HBFJRB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOB.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\windows\KOB.exeC:\windows\KOB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EHGQN.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4180 -
C:\windows\SysWOW64\EHGQN.exeC:\windows\system32\EHGQN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2724 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "70⤵PID:2244
-
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "72⤵PID:3248
-
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe73⤵
- Executes dropped EXE
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGL.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1352 -
C:\windows\XGL.exeC:\windows\XGL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2832 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe77⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3324 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe79⤵
- Executes dropped EXE
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4188 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "82⤵PID:4676
-
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFDLR.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\windows\system\SFDLR.exeC:\windows\system\SFDLR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2812 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1924 -
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEODLCP.exe.bat" "90⤵PID:2220
-
C:\windows\SysWOW64\WEODLCP.exeC:\windows\system32\WEODLCP.exe91⤵
- Executes dropped EXE
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1832 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "94⤵PID:4688
-
C:\windows\XRAA.exeC:\windows\XRAA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "96⤵PID:3544
-
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5408 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "100⤵PID:2784
-
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4524 -
C:\windows\HIS.exeC:\windows\HIS.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "104⤵PID:2992
-
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZJH.exe.bat" "108⤵PID:5352
-
C:\windows\system\IZJH.exeC:\windows\system\IZJH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCNCAC.exe.bat" "110⤵PID:5044
-
C:\windows\system\BCNCAC.exeC:\windows\system\BCNCAC.exe111⤵
- Executes dropped EXE
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNPSB.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4128 -
C:\windows\SysWOW64\ZNPSB.exeC:\windows\system32\ZNPSB.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5900 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "116⤵PID:2012
-
C:\windows\system\XQD.exeC:\windows\system\XQD.exe117⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "118⤵PID:3644
-
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "120⤵PID:2460
-
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-