Analysis
- max time kernel
74s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe
- Size 448KB
- Sample260730-hhetqswtbs
- SHA256 c2e6adbadaa4cf0f223a85b51abd39f8cceb2510507fa0170efd31c7336dad51
- MD5 d984693aaa9d9927ddf64543fa116f9e
- SHA1 e65101f9d0117a6d713621cf0dca6fc707b6c3c1
- SHA512 eabf12c0f645259f7e37ba7c7f84109abdb212fcf82b73e9b943933ff4fcab72dc1ef31caf5d6346610f5cadab28153675efc634cc33385d4f169fb9139148ad
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOEkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOEkmZzcukG2/
- TLSH T16CA49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6080 YHL.exe 5224 SEQDK.exe 4576 ASDJV.exe 5480 FLFL.exe 1736 HIS.exe 5128 VEW.exe 5644 BZIAI.exe 2460 GZE.exe 4520 QSOCZ.exe 1112 XDD.exe 3860 FLTWY.exe 572 LHXXEE.exe 5892 VELRTN.exe 960 KZUVFZV.exe 2232 HAW.exe 3492 ESGAUZN.exe 2512 OQLUCI.exe 5940 FYAAOZ.exe 4900 ZRPLYAZ.exe 4724 OHQ.exe 5992 HKUGSLX.exe 1336 DPMVI.exe 3176 ELQR.exe 4408 KGPZS.exe 4840 XRY.exe 2836 HOD.exe 2792 YZOAWYJ.exe 5424 GFTHZX.exe 3272 SVZH.exe 3300 FTHTVBC.exe 3292 EQSWIG.exe 1564 EWTKKL.exe 4336 KWAY.exe 2332 TECDE.exe 5880 OHLCS.exe 5980 HKPXYLN.exe 1404 LSVG.exe 4444 AIWXJZY.exe 3644 KGKRYIZ.exe 4356 FBPB.exe 5348 USQAH.exe 1256 YAW.exe 3848 TNBJ.exe 4436 TQF.exe 4764 MTJJW.exe 3676 KJCM.exe 4080 URWRNEI.exe 200 WEBA.exe 4748 RSFKH.exe 2708 AAHXLBO.exe 2288 BVLT.exe 2552 DTZ.exe 5852 XOEWI.exe 3076 NJN.exe 2236 LUQRKZR.exe 1628 MXUU.exe 6112 BUAJW.exe 5500 ZNCZ.exe 5976 UBHJPN.exe 5944 WOM.exe 1744 RBRKC.exe 1408 MWWTMMY.exe 4488 GKA.exe 4980 KSHDAX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ELQR.exe.bat DPMVI.exe File opened for modification C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File created C:\windows\SysWOW64\LVL.exe.bat KSHDAX.exe File created C:\windows\SysWOW64\FXVN.exe UFSUI.exe File created C:\windows\SysWOW64\JFC.exe.bat FXVN.exe File created C:\windows\SysWOW64\ZYHI.exe EAHXF.exe File created C:\windows\SysWOW64\OPDGGX.exe.bat KHXY.exe File opened for modification C:\windows\SysWOW64\SEQDK.exe YHL.exe File created C:\windows\SysWOW64\OQLUCI.exe.bat ESGAUZN.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat FTHTVBC.exe File created C:\windows\SysWOW64\LVL.exe KSHDAX.exe File created C:\windows\SysWOW64\ZYHI.exe.bat EAHXF.exe File created C:\windows\SysWOW64\WTFVPMG.exe UVRB.exe File created C:\windows\SysWOW64\NTBZXH.exe JDUZ.exe File created C:\windows\SysWOW64\AIWXJZY.exe LSVG.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe MXUU.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe HUKWU.exe File created C:\windows\SysWOW64\EAHXF.exe JFC.exe File created C:\windows\SysWOW64\SEQDK.exe YHL.exe File created C:\windows\SysWOW64\OQLUCI.exe ESGAUZN.exe File opened for modification C:\windows\SysWOW64\TECDE.exe KWAY.exe File created C:\windows\SysWOW64\TECDE.exe.bat KWAY.exe File created C:\windows\SysWOW64\TZTUU.exe.bat PRM.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe LSVG.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat LSVG.exe File created C:\windows\SysWOW64\KJCM.exe.bat MTJJW.exe File created C:\windows\SysWOW64\LUQRKZR.exe.bat NJN.exe File opened for modification C:\windows\SysWOW64\KHXY.exe GRQYINY.exe File created C:\windows\SysWOW64\FLFL.exe.bat ASDJV.exe File created C:\windows\SysWOW64\UFSUI.exe.bat HUKWU.exe File opened for modification C:\windows\SysWOW64\TZTUU.exe PRM.exe File created C:\windows\SysWOW64\FLFL.exe ASDJV.exe File opened for modification C:\windows\SysWOW64\ELQR.exe DPMVI.exe File opened for modification C:\windows\SysWOW64\EQSWIG.exe FTHTVBC.exe File opened for modification C:\windows\SysWOW64\KJCM.exe MTJJW.exe File created C:\windows\SysWOW64\NJN.exe.bat XOEWI.exe File created C:\windows\SysWOW64\EAHXF.exe.bat JFC.exe File created C:\windows\SysWOW64\DPMVI.exe.bat HKUGSLX.exe File opened for modification C:\windows\SysWOW64\OQLUCI.exe ESGAUZN.exe File created C:\windows\SysWOW64\LUQRKZR.exe NJN.exe File created C:\windows\SysWOW64\BUAJW.exe MXUU.exe File created C:\windows\SysWOW64\GKA.exe.bat MWWTMMY.exe File created C:\windows\SysWOW64\KSHDAX.exe GKA.exe File created C:\windows\SysWOW64\SEQDK.exe.bat YHL.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat EQSWIG.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe UVRB.exe File opened for modification C:\windows\SysWOW64\NTBZXH.exe JDUZ.exe File opened for modification C:\windows\SysWOW64\PQOTE.exe NTBZXH.exe File opened for modification C:\windows\SysWOW64\OPDGGX.exe KHXY.exe File created C:\windows\SysWOW64\HKPXYLN.exe OHLCS.exe File created C:\windows\SysWOW64\DPMVI.exe HKUGSLX.exe File opened for modification C:\windows\SysWOW64\NJN.exe XOEWI.exe File opened for modification C:\windows\SysWOW64\ZYHI.exe EAHXF.exe File created C:\windows\SysWOW64\TZTUU.exe PRM.exe File opened for modification C:\windows\SysWOW64\HKPXYLN.exe OHLCS.exe File created C:\windows\SysWOW64\JFC.exe FXVN.exe File created C:\windows\SysWOW64\KHXY.exe GRQYINY.exe File created C:\windows\SysWOW64\OPDGGX.exe KHXY.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat OHLCS.exe File created C:\windows\SysWOW64\AAHXLBO.exe.bat RSFKH.exe File opened for modification C:\windows\SysWOW64\LUQRKZR.exe NJN.exe File created C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File opened for modification C:\windows\SysWOW64\KSHDAX.exe GKA.exe File created C:\windows\SysWOW64\KSHDAX.exe.bat GKA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\HAW.exe KZUVFZV.exe File created C:\windows\system\ASDJV.exe.bat SEQDK.exe File opened for modification C:\windows\MWWTMMY.exe RBRKC.exe File created C:\windows\IJZGLT.exe.bat ETT.exe File opened for modification C:\windows\PRM.exe UDILXA.exe File created C:\windows\VEW.exe HIS.exe File opened for modification C:\windows\system\QSOCZ.exe GZE.exe File created C:\windows\system\LHXXEE.exe FLTWY.exe File opened for modification C:\windows\system\FBPB.exe KGKRYIZ.exe File opened for modification C:\windows\system\USQAH.exe FBPB.exe File created C:\windows\MJXHVXQ.exe.bat ZYHI.exe File opened for modification C:\windows\FYAAOZ.exe OQLUCI.exe File created C:\windows\system\HKUGSLX.exe.bat OHQ.exe File opened for modification C:\windows\FTHTVBC.exe SVZH.exe File created C:\windows\system\LSVG.exe HKPXYLN.exe File created C:\windows\system\XOEWI.exe.bat DTZ.exe File created C:\windows\system\MXUU.exe.bat LUQRKZR.exe File created C:\windows\ZNCZ.exe.bat BUAJW.exe File opened for modification C:\windows\system\ETT.exe JVTUX.exe File opened for modification C:\windows\VEW.exe HIS.exe File created C:\windows\GZE.exe BZIAI.exe File created C:\windows\TQF.exe TNBJ.exe File opened for modification C:\windows\system\WEBA.exe URWRNEI.exe File created C:\windows\UDILXA.exe.bat WTFVPMG.exe File opened for modification C:\windows\GRQYINY.exe PQOTE.exe File created C:\windows\system\XDD.exe.bat QSOCZ.exe File created C:\windows\HIS.exe.bat FLFL.exe File created C:\windows\KGPZS.exe ELQR.exe File created C:\windows\KGPZS.exe.bat ELQR.exe File opened for modification C:\windows\system\XRY.exe KGPZS.exe File created C:\windows\HOD.exe XRY.exe File opened for modification C:\windows\OHLCS.exe TECDE.exe File created C:\windows\ZNCZ.exe BUAJW.exe File opened for modification C:\windows\system\BZIAI.exe VEW.exe File created C:\windows\system\LHXXEE.exe.bat FLTWY.exe File opened for modification C:\windows\KGPZS.exe ELQR.exe File opened for modification C:\windows\HOD.exe XRY.exe File created C:\windows\MWWTMMY.exe.bat RBRKC.exe File opened for modification C:\windows\HIS.exe FLFL.exe File created C:\windows\system\BZIAI.exe VEW.exe File created C:\windows\KZUVFZV.exe VELRTN.exe File opened for modification C:\windows\system\KWAY.exe EWTKKL.exe File created C:\windows\TNBJ.exe.bat YAW.exe File opened for modification C:\windows\system\XOEWI.exe DTZ.exe File created C:\windows\IJZGLT.exe ETT.exe File opened for modification C:\windows\UDILXA.exe WTFVPMG.exe File created C:\windows\system\QSOCZ.exe.bat GZE.exe File created C:\windows\system\HKUGSLX.exe OHQ.exe File created C:\windows\YZOAWYJ.exe.bat HOD.exe File created C:\windows\FYAAOZ.exe.bat OQLUCI.exe File opened for modification C:\windows\system\FLTWY.exe XDD.exe File created C:\windows\HIS.exe FLFL.exe File opened for modification C:\windows\KZUVFZV.exe VELRTN.exe File opened for modification C:\windows\SVZH.exe GFTHZX.exe File created C:\windows\KGKRYIZ.exe AIWXJZY.exe File opened for modification C:\windows\system\RSFKH.exe WEBA.exe File created C:\windows\CZYYB.exe MJXHVXQ.exe File created C:\windows\OHLCS.exe.bat TECDE.exe File opened for modification C:\windows\TNBJ.exe YAW.exe File opened for modification C:\windows\MTJJW.exe TQF.exe File opened for modification C:\windows\system\URWRNEI.exe KJCM.exe File opened for modification C:\windows\system\ESIWWR.exe WMDIMTB.exe File created C:\windows\GRQYINY.exe PQOTE.exe File created C:\windows\system\USQAH.exe.bat FBPB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4644 cmd.exe 1192 cmd.exe 6032 cmd.exe 4424 cmd.exe 4812 cmd.exe 5768 cmd.exe 2352 cmd.exe 1128 cmd.exe 2192 cmd.exe 824 cmd.exe 5532 cmd.exe 5564 cmd.exe 1568 cmd.exe 2812 cmd.exe 4532 cmd.exe 3240 cmd.exe 3340 cmd.exe 3932 cmd.exe 4180 cmd.exe 3116 cmd.exe 1280 cmd.exe 5316 cmd.exe 1180 cmd.exe 4552 cmd.exe 5436 cmd.exe 5124 cmd.exe 460 cmd.exe 4604 cmd.exe 3748 cmd.exe 4244 cmd.exe 4088 cmd.exe 4524 cmd.exe 2408 cmd.exe 2896 cmd.exe 5868 cmd.exe 4400 cmd.exe 3148 cmd.exe 4596 cmd.exe 5108 cmd.exe 5204 cmd.exe 4268 cmd.exe 1012 cmd.exe 5608 cmd.exe 5660 cmd.exe 2200 cmd.exe 3136 cmd.exe 2784 cmd.exe 2400 cmd.exe 3904 cmd.exe 1496 cmd.exe 5236 cmd.exe 3020 cmd.exe 5352 cmd.exe 5440 cmd.exe 4844 cmd.exe 2124 cmd.exe 4984 cmd.exe 4528 cmd.exe 4608 cmd.exe 2768 cmd.exe 5640 cmd.exe 5632 cmd.exe 5848 cmd.exe 1816 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1272 616 WerFault.exe 87 3432 6080 WerFault.exe 93 5520 5224 WerFault.exe 99 4408 4576 WerFault.exe 104 2040 5480 WerFault.exe 109 3368 1736 WerFault.exe 114 1136 5128 WerFault.exe 119 1988 5644 WerFault.exe 124 4940 2460 WerFault.exe 129 4836 4520 WerFault.exe 134 3528 1112 WerFault.exe 139 5372 3860 WerFault.exe 144 2356 572 WerFault.exe 149 4720 5892 WerFault.exe 154 3524 960 WerFault.exe 159 5936 2232 WerFault.exe 164 3144 3492 WerFault.exe 169 3464 2512 WerFault.exe 174 1896 5940 WerFault.exe 179 1944 4900 WerFault.exe 184 3944 4724 WerFault.exe 189 3236 5992 WerFault.exe 194 3148 1336 WerFault.exe 199 3188 3176 WerFault.exe 204 5672 4408 WerFault.exe 209 2328 4840 WerFault.exe 214 1404 2836 WerFault.exe 219 3564 2792 WerFault.exe 224 1000 5424 WerFault.exe 229 5856 3272 WerFault.exe 234 2708 3300 WerFault.exe 239 2780 3292 WerFault.exe 244 628 1564 WerFault.exe 249 4712 4336 WerFault.exe 254 5792 2332 WerFault.exe 260 2964 5880 WerFault.exe 265 4080 5980 WerFault.exe 270 1244 1404 WerFault.exe 275 832 4444 WerFault.exe 280 5856 3644 WerFault.exe 285 4352 4356 WerFault.exe 290 3128 5348 WerFault.exe 295 1056 1256 WerFault.exe 300 2844 3848 WerFault.exe 305 1848 4436 WerFault.exe 310 6108 4764 WerFault.exe 315 5084 3676 WerFault.exe 320 4580 4080 WerFault.exe 325 6104 200 WerFault.exe 330 5108 4748 WerFault.exe 335 4928 2708 WerFault.exe 340 4604 2288 WerFault.exe 345 4600 2552 WerFault.exe 350 3060 5852 WerFault.exe 355 1948 3076 WerFault.exe 360 700 2236 WerFault.exe 365 6116 1628 WerFault.exe 369 832 6112 WerFault.exe 375 2188 5500 WerFault.exe 380 1128 5976 WerFault.exe 385 1284 5944 WerFault.exe 390 1380 1744 WerFault.exe 395 3244 1408 WerFault.exe 400 4964 4488 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWRNEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBRKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWWTMMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTBZXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGPZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOEWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TECDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGKRYIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJXHVXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZYYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWTKKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUAJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDILXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQLUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USQAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRQYINY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHXLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHLCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 616 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe 616 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe 6080 YHL.exe 6080 YHL.exe 5224 SEQDK.exe 5224 SEQDK.exe 4576 ASDJV.exe 4576 ASDJV.exe 5480 FLFL.exe 5480 FLFL.exe 1736 HIS.exe 1736 HIS.exe 5128 VEW.exe 5128 VEW.exe 5644 BZIAI.exe 5644 BZIAI.exe 2460 GZE.exe 2460 GZE.exe 4520 QSOCZ.exe 4520 QSOCZ.exe 1112 XDD.exe 1112 XDD.exe 3860 FLTWY.exe 3860 FLTWY.exe 572 LHXXEE.exe 572 LHXXEE.exe 5892 VELRTN.exe 5892 VELRTN.exe 960 KZUVFZV.exe 960 KZUVFZV.exe 2232 HAW.exe 2232 HAW.exe 3492 ESGAUZN.exe 3492 ESGAUZN.exe 2512 OQLUCI.exe 2512 OQLUCI.exe 5940 FYAAOZ.exe 5940 FYAAOZ.exe 4900 ZRPLYAZ.exe 4900 ZRPLYAZ.exe 4724 OHQ.exe 4724 OHQ.exe 5992 HKUGSLX.exe 5992 HKUGSLX.exe 1336 DPMVI.exe 1336 DPMVI.exe 3176 ELQR.exe 3176 ELQR.exe 4408 KGPZS.exe 4408 KGPZS.exe 4840 XRY.exe 4840 XRY.exe 2836 HOD.exe 2836 HOD.exe 2792 YZOAWYJ.exe 2792 YZOAWYJ.exe 5424 GFTHZX.exe 5424 GFTHZX.exe 3272 SVZH.exe 3272 SVZH.exe 3300 FTHTVBC.exe 3300 FTHTVBC.exe 3292 EQSWIG.exe 3292 EQSWIG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 616 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe 616 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe 6080 YHL.exe 6080 YHL.exe 5224 SEQDK.exe 5224 SEQDK.exe 4576 ASDJV.exe 4576 ASDJV.exe 5480 FLFL.exe 5480 FLFL.exe 1736 HIS.exe 1736 HIS.exe 5128 VEW.exe 5128 VEW.exe 5644 BZIAI.exe 5644 BZIAI.exe 2460 GZE.exe 2460 GZE.exe 4520 QSOCZ.exe 4520 QSOCZ.exe 1112 XDD.exe 1112 XDD.exe 3860 FLTWY.exe 3860 FLTWY.exe 572 LHXXEE.exe 572 LHXXEE.exe 5892 VELRTN.exe 5892 VELRTN.exe 960 KZUVFZV.exe 960 KZUVFZV.exe 2232 HAW.exe 2232 HAW.exe 3492 ESGAUZN.exe 3492 ESGAUZN.exe 2512 OQLUCI.exe 2512 OQLUCI.exe 5940 FYAAOZ.exe 5940 FYAAOZ.exe 4900 ZRPLYAZ.exe 4900 ZRPLYAZ.exe 4724 OHQ.exe 4724 OHQ.exe 5992 HKUGSLX.exe 5992 HKUGSLX.exe 1336 DPMVI.exe 1336 DPMVI.exe 3176 ELQR.exe 3176 ELQR.exe 4408 KGPZS.exe 4408 KGPZS.exe 4840 XRY.exe 4840 XRY.exe 2836 HOD.exe 2836 HOD.exe 2792 YZOAWYJ.exe 2792 YZOAWYJ.exe 5424 GFTHZX.exe 5424 GFTHZX.exe 3272 SVZH.exe 3272 SVZH.exe 3300 FTHTVBC.exe 3300 FTHTVBC.exe 3292 EQSWIG.exe 3292 EQSWIG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 616 wrote to memory of 5640 616 2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe 89 PID 5640 wrote to memory of 6080 5640 cmd.exe 93 PID 6080 wrote to memory of 2192 6080 YHL.exe 95 PID 2192 wrote to memory of 5224 2192 cmd.exe 99 PID 5224 wrote to memory of 4388 5224 SEQDK.exe 100 PID 4388 wrote to memory of 4576 4388 cmd.exe 104 PID 4576 wrote to memory of 3668 4576 ASDJV.exe 105 PID 3668 wrote to memory of 5480 3668 cmd.exe 109 PID 5480 wrote to memory of 812 5480 FLFL.exe 110 PID 812 wrote to memory of 1736 812 cmd.exe 114 PID 1736 wrote to memory of 4644 1736 HIS.exe 115 PID 4644 wrote to memory of 5128 4644 cmd.exe 119 PID 5128 wrote to memory of 824 5128 VEW.exe 120 PID 824 wrote to memory of 5644 824 cmd.exe 124 PID 5644 wrote to memory of 4824 5644 BZIAI.exe 125 PID 4824 wrote to memory of 2460 4824 cmd.exe 129 PID 2460 wrote to memory of 5888 2460 GZE.exe 130 PID 5888 wrote to memory of 4520 5888 cmd.exe 134 PID 4520 wrote to memory of 4456 4520 QSOCZ.exe 135 PID 4456 wrote to memory of 1112 4456 cmd.exe 139 PID 1112 wrote to memory of 5532 1112 XDD.exe 140 PID 5532 wrote to memory of 3860 5532 cmd.exe 144 PID 3860 wrote to memory of 3048 3860 FLTWY.exe 145 PID 3048 wrote to memory of 572 3048 cmd.exe 149 PID 572 wrote to memory of 4788 572 LHXXEE.exe 150 PID 4788 wrote to memory of 5892 4788 cmd.exe 154 PID 5892 wrote to memory of 3672 5892 VELRTN.exe 155 PID 3672 wrote to memory of 960 3672 cmd.exe 159 PID 960 wrote to memory of 5436 960 KZUVFZV.exe 160 PID 5436 wrote to memory of 2232 5436 cmd.exe 164 PID 2232 wrote to memory of 5492 2232 HAW.exe 165 PID 5492 wrote to memory of 3492 5492 cmd.exe 169 PID 3492 wrote to memory of 4924 3492 ESGAUZN.exe 170 PID 4924 wrote to memory of 2512 4924 cmd.exe 174 PID 2512 wrote to memory of 2620 2512 OQLUCI.exe 175 PID 2620 wrote to memory of 5940 2620 cmd.exe 179 PID 5940 wrote to memory of 5632 5940 FYAAOZ.exe 180 PID 5632 wrote to memory of 4900 5632 cmd.exe 184 PID 4900 wrote to memory of 5564 4900 ZRPLYAZ.exe 185 PID 5564 wrote to memory of 4724 5564 cmd.exe 189 PID 4724 wrote to memory of 5352 4724 OHQ.exe 190 PID 5352 wrote to memory of 5992 5352 cmd.exe 194 PID 5992 wrote to memory of 920 5992 HKUGSLX.exe 195 PID 920 wrote to memory of 1336 920 cmd.exe 199 PID 1336 wrote to memory of 1192 1336 DPMVI.exe 200 PID 1192 wrote to memory of 3176 1192 cmd.exe 204 PID 3176 wrote to memory of 2200 3176 ELQR.exe 205 PID 2200 wrote to memory of 4408 2200 cmd.exe 209 PID 4408 wrote to memory of 4848 4408 KGPZS.exe 210 PID 4848 wrote to memory of 4840 4848 cmd.exe 214 PID 4840 wrote to memory of 5124 4840 XRY.exe 215 PID 5124 wrote to memory of 2836 5124 cmd.exe 219 PID 2836 wrote to memory of 2364 2836 HOD.exe 220 PID 2364 wrote to memory of 2792 2364 cmd.exe 224 PID 2792 wrote to memory of 4252 2792 YZOAWYJ.exe 225 PID 4252 wrote to memory of 5424 4252 cmd.exe 229 PID 5424 wrote to memory of 3304 5424 GFTHZX.exe 230 PID 3304 wrote to memory of 3272 3304 cmd.exe 234 PID 3272 wrote to memory of 1568 3272 SVZH.exe 235 PID 1568 wrote to memory of 3300 1568 cmd.exe 239 PID 3300 wrote to memory of 6032 3300 FTHTVBC.exe 240 PID 6032 wrote to memory of 3292 6032 cmd.exe 244 PID 3292 wrote to memory of 2376 3292 EQSWIG.exe 245 PID 2376 wrote to memory of 1564 2376 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d984693aaa9d9927ddf64543fa116f9e_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\YHL.exeC:\windows\YHL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\windows\HIS.exeC:\windows\HIS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEW.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\VEW.exeC:\windows\VEW.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZIAI.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\system\BZIAI.exeC:\windows\system\BZIAI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\GZE.exeC:\windows\GZE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSOCZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\system\QSOCZ.exeC:\windows\system\QSOCZ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\XDD.exeC:\windows\system\XDD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHXXEE.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\system\LHXXEE.exeC:\windows\system\LHXXEE.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VELRTN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\system\VELRTN.exeC:\windows\system\VELRTN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZUVFZV.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\windows\KZUVFZV.exeC:\windows\KZUVFZV.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\HAW.exeC:\windows\HAW.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYAAOZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\FYAAOZ.exeC:\windows\FYAAOZ.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPMVI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\SysWOW64\DPMVI.exeC:\windows\system32\DPMVI.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGPZS.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\KGPZS.exeC:\windows\KGPZS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\system\XRY.exeC:\windows\system\XRY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\HOD.exeC:\windows\HOD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZOAWYJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\YZOAWYJ.exeC:\windows\YZOAWYJ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\SVZH.exeC:\windows\SVZH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWAY.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2408 -
C:\windows\system\KWAY.exeC:\windows\system\KWAY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "68⤵PID:2524
-
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLCS.exe.bat" "70⤵PID:2032
-
C:\windows\OHLCS.exeC:\windows\OHLCS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKPXYLN.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\windows\SysWOW64\HKPXYLN.exeC:\windows\system32\HKPXYLN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSVG.exe.bat" "74⤵PID:5164
-
C:\windows\system\LSVG.exeC:\windows\system\LSVG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "76⤵PID:5528
-
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGKRYIZ.exe.bat" "78⤵PID:1000
-
C:\windows\KGKRYIZ.exeC:\windows\KGKRYIZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBPB.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5848 -
C:\windows\system\FBPB.exeC:\windows\system\FBPB.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAW.exe.bat" "84⤵PID:248
-
C:\windows\system\YAW.exeC:\windows\system\YAW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNBJ.exe.bat" "86⤵PID:2720
-
C:\windows\TNBJ.exeC:\windows\TNBJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQF.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2812 -
C:\windows\TQF.exeC:\windows\TQF.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTJJW.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:460 -
C:\windows\MTJJW.exeC:\windows\MTJJW.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4532 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URWRNEI.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\system\URWRNEI.exeC:\windows\system\URWRNEI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEBA.exe.bat" "96⤵PID:3564
-
C:\windows\system\WEBA.exeC:\windows\system\WEBA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSFKH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2456 -
C:\windows\system\RSFKH.exeC:\windows\system\RSFKH.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "100⤵PID:1040
-
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVLT.exe.bat" "102⤵PID:5420
-
C:\windows\system\BVLT.exeC:\windows\system\BVLT.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "104⤵PID:4256
-
C:\windows\DTZ.exeC:\windows\DTZ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOEWI.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4268 -
C:\windows\system\XOEWI.exeC:\windows\system\XOEWI.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJN.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3932 -
C:\windows\SysWOW64\NJN.exeC:\windows\system32\NJN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUQRKZR.exe.bat" "110⤵PID:2964
-
C:\windows\SysWOW64\LUQRKZR.exeC:\windows\system32\LUQRKZR.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXUU.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\windows\system\MXUU.exeC:\windows\system\MXUU.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUAJW.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5440 -
C:\windows\SysWOW64\BUAJW.exeC:\windows\system32\BUAJW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNCZ.exe.bat" "116⤵PID:2028
-
C:\windows\ZNCZ.exeC:\windows\ZNCZ.exe117⤵
- Executes dropped EXE
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBHJPN.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3136 -
C:\windows\system\UBHJPN.exeC:\windows\system\UBHJPN.exe119⤵
- Executes dropped EXE
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOM.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5156 -
C:\windows\WOM.exeC:\windows\WOM.exe121⤵
- Executes dropped EXE
PID:5944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-