Analysis
- max time kernel
79s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe
- Size 320KB
- Sample260730-t91fasdk41
- SHA256 ac6458a92035bbfe1ffdeb57980d479ac9af389137576f1d3fa8b1531dd126c7
- MD5 f1da274b2731c9d7620b4f249ea02fe1
- SHA1 af353e16d2e7ef4891576ad867568a5a92dfeebd
- SHA512 32fee3d5d5950bcacf15ca7720ffd10ffc5a270baadfba3799c1508d1b3d9635ad287d34ad6e10a9a48cc98b5674801e7cad47a7c8e44bbe3a8f6b98249b8521
- SSDEEP 6144:MlZtbLWIgd1LZ9oECZbxlUS+LO5kEjWbjcSbcY+CA:OLWI09QZb6LO5kFbzs
- TLSH T1FA647D12B6C1C072D4AF02328CE2C7A826B5BC519F7586CB77D87B4EEE315D29A35391
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2136 UGI.exe 5444 AMILOB.exe 3888 TEXWFC.exe 3920 JULNNJ.exe 5272 CVSYEK.exe 4192 IIEZKZ.exe 2560 WDPSYVP.exe 5880 ETQR.exe 3804 XUGC.exe 5336 MKTUWQ.exe 1592 DKC.exe 2636 MII.exe 4548 FLTWY.exe 4648 CRELO.exe 4372 ACOB.exe 1572 BFSFDH.exe 4620 UXAQMI.exe 5156 GLHORJS.exe 3432 MGSPFY.exe 5348 RLCEVBD.exe 6088 SJQQ.exe 1740 BPVF.exe 4652 ZZY.exe 5696 PQHMUK.exe 1852 RLQOOVI.exe 4188 QWBE.exe 5644 XMC.exe 5732 CRM.exe 6028 LROY.exe 4676 MUSTCN.exe 3520 BPJG.exe 4840 ZLAHSDP.exe 4600 LTPH.exe 1920 EWTKKL.exe 1432 CHVAS.exe 2812 QRERG.exe 1152 YXRGR.exe 4948 YAUBXYB.exe 4292 TNZ.exe 1056 MQDOM.exe 4828 BLM.exe 3056 BOYWLRC.exe 6124 LXS.exe 3236 RXAPXQ.exe 1736 IXCUJWH.exe 4776 DLHE.exe 2480 GBNMXO.exe 5584 KJCM.exe 5476 LMGIPWP.exe 5352 EPJL.exe 5492 ONPG.exe 4260 GITBPK.exe 1208 QFHWF.exe 5620 LBLFHSZ.exe 2836 EWPJ.exe 5812 PMW.exe 5972 MEYLKFF.exe 4480 OCLFS.exe 1660 ASSF.exe 1216 VFXXOX.exe 4892 PTB.exe 2216 KOGQB.exe 4640 ZWHHIS.exe 3748 NHQGWV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MKTUWQ.exe XUGC.exe File opened for modification C:\windows\SysWOW64\RLQOOVI.exe PQHMUK.exe File opened for modification C:\windows\SysWOW64\EWTKKL.exe LTPH.exe File created C:\windows\SysWOW64\GITBPK.exe.bat ONPG.exe File created C:\windows\SysWOW64\QFHWF.exe GITBPK.exe File created C:\windows\SysWOW64\YXRGR.exe.bat QRERG.exe File created C:\windows\SysWOW64\ETQR.exe.bat WDPSYVP.exe File opened for modification C:\windows\SysWOW64\GLHORJS.exe UXAQMI.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe RLCEVBD.exe File created C:\windows\SysWOW64\LTPH.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\EWTKKL.exe LTPH.exe File created C:\windows\SysWOW64\QRERG.exe.bat CHVAS.exe File created C:\windows\SysWOW64\GITBPK.exe ONPG.exe File created C:\windows\SysWOW64\PTB.exe VFXXOX.exe File created C:\windows\SysWOW64\KOGQB.exe PTB.exe File created C:\windows\SysWOW64\IXYTL.exe.bat HUU.exe File opened for modification C:\windows\SysWOW64\OYKABVN.exe VDY.exe File created C:\windows\SysWOW64\AAEN.exe CAWAFWI.exe File opened for modification C:\windows\SysWOW64\HWC.exe MJXHVXQ.exe File created C:\windows\SysWOW64\SPXJN.exe HWC.exe File created C:\windows\SysWOW64\ANSR.exe.bat LSBFTU.exe File opened for modification C:\windows\SysWOW64\SVFFC.exe EYFUANG.exe File opened for modification C:\windows\SysWOW64\BPVF.exe SJQQ.exe File created C:\windows\SysWOW64\OYKABVN.exe VDY.exe File created C:\windows\SysWOW64\OYKABVN.exe.bat VDY.exe File created C:\windows\SysWOW64\MJRG.exe GIJSIST.exe File created C:\windows\SysWOW64\ZXXGJK.exe BXPS.exe File created C:\windows\SysWOW64\SVFFC.exe.bat EYFUANG.exe File created C:\windows\SysWOW64\BPVF.exe SJQQ.exe File opened for modification C:\windows\SysWOW64\QFHWF.exe GITBPK.exe File created C:\windows\SysWOW64\PTB.exe.bat VFXXOX.exe File created C:\windows\SysWOW64\GAMBFAK.exe.bat AAEN.exe File created C:\windows\SysWOW64\HWC.exe.bat MJXHVXQ.exe File opened for modification C:\windows\SysWOW64\MJRG.exe GIJSIST.exe File opened for modification C:\windows\SysWOW64\CWOVXW.exe NGNWQ.exe File created C:\windows\SysWOW64\RLQOOVI.exe.bat PQHMUK.exe File created C:\windows\SysWOW64\UGI.exe.bat 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe File created C:\windows\SysWOW64\GLHORJS.exe.bat UXAQMI.exe File created C:\windows\SysWOW64\MUSTCN.exe LROY.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat LROY.exe File created C:\windows\SysWOW64\YXRGR.exe QRERG.exe File opened for modification C:\windows\SysWOW64\YXRGR.exe QRERG.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe TNZ.exe File created C:\windows\SysWOW64\UGI.exe 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ACOB.exe CRELO.exe File created C:\windows\SysWOW64\SJQQ.exe RLCEVBD.exe File created C:\windows\SysWOW64\BPVF.exe.bat SJQQ.exe File opened for modification C:\windows\SysWOW64\KJCM.exe GBNMXO.exe File created C:\windows\SysWOW64\KJCM.exe.bat GBNMXO.exe File created C:\windows\SysWOW64\MQDOM.exe.bat TNZ.exe File created C:\windows\SysWOW64\VFXXOX.exe ASSF.exe File created C:\windows\SysWOW64\ETQR.exe WDPSYVP.exe File created C:\windows\SysWOW64\MQDOM.exe TNZ.exe File created C:\windows\SysWOW64\VFXXOX.exe.bat ASSF.exe File opened for modification C:\windows\SysWOW64\AAEN.exe CAWAFWI.exe File created C:\windows\SysWOW64\HWC.exe MJXHVXQ.exe File opened for modification C:\windows\SysWOW64\MII.exe DKC.exe File opened for modification C:\windows\SysWOW64\LTPH.exe ZLAHSDP.exe File created C:\windows\SysWOW64\QRERG.exe CHVAS.exe File created C:\windows\SysWOW64\AAEN.exe.bat CAWAFWI.exe File opened for modification C:\windows\SysWOW64\GAMBFAK.exe AAEN.exe File opened for modification C:\windows\SysWOW64\ANSR.exe LSBFTU.exe File created C:\windows\SysWOW64\RUKJ.exe WGFAHVD.exe File created C:\windows\SysWOW64\RUKJ.exe.bat WGFAHVD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\AMILOB.exe UGI.exe File opened for modification C:\windows\WDPSYVP.exe IIEZKZ.exe File created C:\windows\system\ZZY.exe.bat BPVF.exe File created C:\windows\XMC.exe QWBE.exe File created C:\windows\LROY.exe CRM.exe File created C:\windows\system\GBNMXO.exe.bat DLHE.exe File opened for modification C:\windows\system\MEYLKFF.exe PMW.exe File created C:\windows\system\PEM.exe.bat RUKJ.exe File created C:\windows\MGSPFY.exe.bat GLHORJS.exe File created C:\windows\BOYWLRC.exe BLM.exe File opened for modification C:\windows\system\IXCUJWH.exe RXAPXQ.exe File created C:\windows\system\GBNMXO.exe DLHE.exe File created C:\windows\system\LMGIPWP.exe.bat KJCM.exe File created C:\windows\system\EUCQEF.exe.bat CWOVXW.exe File created C:\windows\system\XUGC.exe ETQR.exe File created C:\windows\CRELO.exe FLTWY.exe File opened for modification C:\windows\ZLAHSDP.exe BPJG.exe File opened for modification C:\windows\ASSF.exe OCLFS.exe File created C:\windows\system\WGFAHVD.exe.bat MJRG.exe File created C:\windows\system\IQPBET.exe USPQDH.exe File created C:\windows\system\IQPBET.exe.bat USPQDH.exe File created C:\windows\system\OQXPOV.exe IQPBET.exe File created C:\windows\system\UXAQMI.exe BFSFDH.exe File opened for modification C:\windows\system\ZZY.exe BPVF.exe File created C:\windows\UUWLDR.exe FRNH.exe File opened for modification C:\windows\UUWLDR.exe FRNH.exe File opened for modification C:\windows\system\XUGC.exe ETQR.exe File opened for modification C:\windows\system\RLCEVBD.exe MGSPFY.exe File created C:\windows\TNZ.exe YAUBXYB.exe File opened for modification C:\windows\BOYWLRC.exe BLM.exe File created C:\windows\system\IXCUJWH.exe RXAPXQ.exe File opened for modification C:\windows\system\GBNMXO.exe DLHE.exe File created C:\windows\BNQK.exe GAMBFAK.exe File created C:\windows\TEXWFC.exe AMILOB.exe File created C:\windows\JULNNJ.exe.bat TEXWFC.exe File created C:\windows\system\LMGIPWP.exe KJCM.exe File opened for modification C:\windows\system\NHQGWV.exe ZWHHIS.exe File created C:\windows\system\EYFUANG.exe ZXXGJK.exe File created C:\windows\DKC.exe MKTUWQ.exe File created C:\windows\system\ZZY.exe BPVF.exe File opened for modification C:\windows\CRM.exe XMC.exe File created C:\windows\LBLFHSZ.exe.bat QFHWF.exe File created C:\windows\system\NHQGWV.exe ZWHHIS.exe File opened for modification C:\windows\system\CAWAFWI.exe UUWLDR.exe File created C:\windows\LSBFTU.exe.bat SPXJN.exe File created C:\windows\UPLU.exe EUCQEF.exe File created C:\windows\system\BFSFDH.exe.bat ACOB.exe File opened for modification C:\windows\PQHMUK.exe ZZY.exe File opened for modification C:\windows\system\OQXPOV.exe IQPBET.exe File created C:\windows\system\UXAQMI.exe.bat BFSFDH.exe File created C:\windows\PQHMUK.exe ZZY.exe File created C:\windows\system\BLM.exe MQDOM.exe File opened for modification C:\windows\system\EUCQEF.exe CWOVXW.exe File created C:\windows\EWPJ.exe.bat LBLFHSZ.exe File created C:\windows\TEXWFC.exe.bat AMILOB.exe File created C:\windows\WDPSYVP.exe.bat IIEZKZ.exe File created C:\windows\CRM.exe.bat XMC.exe File created C:\windows\system\DLHE.exe.bat IXCUJWH.exe File opened for modification C:\windows\LBLFHSZ.exe QFHWF.exe File opened for modification C:\windows\BNQK.exe GAMBFAK.exe File created C:\windows\WDPSYVP.exe IIEZKZ.exe File created C:\windows\system\FLTWY.exe.bat MII.exe File opened for modification C:\windows\system\QWBE.exe RLQOOVI.exe File created C:\windows\system\QWBE.exe.bat RLQOOVI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1156 cmd.exe 4712 cmd.exe 3020 cmd.exe 2200 cmd.exe 1844 cmd.exe 3240 cmd.exe 5592 cmd.exe 3232 cmd.exe 6036 cmd.exe 52 cmd.exe 5460 cmd.exe 3076 cmd.exe 3972 cmd.exe 124 cmd.exe 2464 cmd.exe 5060 cmd.exe 4688 cmd.exe 2060 cmd.exe 2268 cmd.exe 5796 cmd.exe 4604 cmd.exe 4636 cmd.exe 5376 cmd.exe 4796 cmd.exe 980 cmd.exe 1832 cmd.exe 3808 cmd.exe 4084 cmd.exe 1720 cmd.exe 3968 cmd.exe 1808 cmd.exe 5016 cmd.exe 1564 cmd.exe 5764 cmd.exe 4208 cmd.exe 1904 cmd.exe 6128 cmd.exe 1536 cmd.exe 4672 cmd.exe 4172 cmd.exe 5324 cmd.exe 4704 cmd.exe 5464 cmd.exe 6064 cmd.exe 2012 cmd.exe 2772 cmd.exe 3348 cmd.exe 1856 cmd.exe 2852 cmd.exe 3956 cmd.exe 1344 cmd.exe 2976 cmd.exe 5684 cmd.exe 2168 cmd.exe 5780 cmd.exe 916 cmd.exe 2428 cmd.exe 3368 cmd.exe 1968 cmd.exe 4428 cmd.exe 4964 cmd.exe 6116 cmd.exe 2112 cmd.exe 5624 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3856 1328 WerFault.exe 87 2304 2136 WerFault.exe 93 5748 5444 WerFault.exe 99 5132 3888 WerFault.exe 104 5556 3920 WerFault.exe 109 2220 5272 WerFault.exe 114 3680 4192 WerFault.exe 119 5732 2560 WerFault.exe 124 5592 5880 WerFault.exe 129 5440 3804 WerFault.exe 134 1940 5336 WerFault.exe 139 4640 1592 WerFault.exe 144 4488 2636 WerFault.exe 149 5748 4548 WerFault.exe 154 4136 4648 WerFault.exe 159 5996 4372 WerFault.exe 164 2516 1572 WerFault.exe 169 3500 4620 WerFault.exe 174 1300 5156 WerFault.exe 179 572 3432 WerFault.exe 184 1568 5348 WerFault.exe 189 1668 6088 WerFault.exe 194 5764 1740 WerFault.exe 199 3020 4652 WerFault.exe 204 2420 5696 WerFault.exe 209 5456 1852 WerFault.exe 214 5648 4188 WerFault.exe 219 6096 5644 WerFault.exe 224 504 5732 WerFault.exe 229 4768 6028 WerFault.exe 234 4568 4676 WerFault.exe 239 5064 3520 WerFault.exe 244 4092 4840 WerFault.exe 249 4640 4600 WerFault.exe 254 4084 1920 WerFault.exe 260 6064 1432 WerFault.exe 265 5496 2812 WerFault.exe 270 3516 1152 WerFault.exe 275 3368 4948 WerFault.exe 280 2976 4292 WerFault.exe 285 4568 1056 WerFault.exe 290 2248 4828 WerFault.exe 295 1932 3056 WerFault.exe 300 5840 6124 WerFault.exe 305 1160 3236 WerFault.exe 310 6116 1736 WerFault.exe 315 1144 4776 WerFault.exe 320 3328 2480 WerFault.exe 325 5012 5584 WerFault.exe 330 5028 5476 WerFault.exe 335 4408 5352 WerFault.exe 340 3524 5492 WerFault.exe 345 5600 4260 WerFault.exe 350 4544 1208 WerFault.exe 355 2652 5620 WerFault.exe 360 1172 2836 WerFault.exe 365 2244 5812 WerFault.exe 370 4864 5972 WerFault.exe 375 4112 4480 WerFault.exe 380 692 1660 WerFault.exe 385 5616 1216 WerFault.exe 390 1436 4892 WerFault.exe 395 4712 2216 WerFault.exe 400 4360 4640 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYSOKPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSBFTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCLFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKTUWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LROY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXRGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYKABVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFSFDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIEZKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUWLDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJSIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQHMUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQPBET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHHIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJXHVXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLHORJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe 1328 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe 2136 UGI.exe 2136 UGI.exe 5444 AMILOB.exe 5444 AMILOB.exe 3888 TEXWFC.exe 3888 TEXWFC.exe 3920 JULNNJ.exe 3920 JULNNJ.exe 5272 CVSYEK.exe 5272 CVSYEK.exe 4192 IIEZKZ.exe 4192 IIEZKZ.exe 2560 WDPSYVP.exe 2560 WDPSYVP.exe 5880 ETQR.exe 5880 ETQR.exe 3804 XUGC.exe 3804 XUGC.exe 5336 MKTUWQ.exe 5336 MKTUWQ.exe 1592 DKC.exe 1592 DKC.exe 2636 MII.exe 2636 MII.exe 4548 FLTWY.exe 4548 FLTWY.exe 4648 CRELO.exe 4648 CRELO.exe 4372 ACOB.exe 4372 ACOB.exe 1572 BFSFDH.exe 1572 BFSFDH.exe 4620 UXAQMI.exe 4620 UXAQMI.exe 5156 GLHORJS.exe 5156 GLHORJS.exe 3432 MGSPFY.exe 3432 MGSPFY.exe 5348 RLCEVBD.exe 5348 RLCEVBD.exe 6088 SJQQ.exe 6088 SJQQ.exe 1740 BPVF.exe 1740 BPVF.exe 4652 ZZY.exe 4652 ZZY.exe 5696 PQHMUK.exe 5696 PQHMUK.exe 1852 RLQOOVI.exe 1852 RLQOOVI.exe 4188 QWBE.exe 4188 QWBE.exe 5644 XMC.exe 5644 XMC.exe 5732 CRM.exe 5732 CRM.exe 6028 LROY.exe 6028 LROY.exe 4676 MUSTCN.exe 4676 MUSTCN.exe 3520 BPJG.exe 3520 BPJG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1328 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe 1328 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe 2136 UGI.exe 2136 UGI.exe 5444 AMILOB.exe 5444 AMILOB.exe 3888 TEXWFC.exe 3888 TEXWFC.exe 3920 JULNNJ.exe 3920 JULNNJ.exe 5272 CVSYEK.exe 5272 CVSYEK.exe 4192 IIEZKZ.exe 4192 IIEZKZ.exe 2560 WDPSYVP.exe 2560 WDPSYVP.exe 5880 ETQR.exe 5880 ETQR.exe 3804 XUGC.exe 3804 XUGC.exe 5336 MKTUWQ.exe 5336 MKTUWQ.exe 1592 DKC.exe 1592 DKC.exe 2636 MII.exe 2636 MII.exe 4548 FLTWY.exe 4548 FLTWY.exe 4648 CRELO.exe 4648 CRELO.exe 4372 ACOB.exe 4372 ACOB.exe 1572 BFSFDH.exe 1572 BFSFDH.exe 4620 UXAQMI.exe 4620 UXAQMI.exe 5156 GLHORJS.exe 5156 GLHORJS.exe 3432 MGSPFY.exe 3432 MGSPFY.exe 5348 RLCEVBD.exe 5348 RLCEVBD.exe 6088 SJQQ.exe 6088 SJQQ.exe 1740 BPVF.exe 1740 BPVF.exe 4652 ZZY.exe 4652 ZZY.exe 5696 PQHMUK.exe 5696 PQHMUK.exe 1852 RLQOOVI.exe 1852 RLQOOVI.exe 4188 QWBE.exe 4188 QWBE.exe 5644 XMC.exe 5644 XMC.exe 5732 CRM.exe 5732 CRM.exe 6028 LROY.exe 6028 LROY.exe 4676 MUSTCN.exe 4676 MUSTCN.exe 3520 BPJG.exe 3520 BPJG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 52 1328 2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe 89 PID 52 wrote to memory of 2136 52 cmd.exe 93 PID 2136 wrote to memory of 5460 2136 UGI.exe 95 PID 5460 wrote to memory of 5444 5460 cmd.exe 99 PID 5444 wrote to memory of 1040 5444 AMILOB.exe 100 PID 1040 wrote to memory of 3888 1040 cmd.exe 104 PID 3888 wrote to memory of 748 3888 TEXWFC.exe 105 PID 748 wrote to memory of 3920 748 cmd.exe 109 PID 3920 wrote to memory of 3968 3920 JULNNJ.exe 110 PID 3968 wrote to memory of 5272 3968 cmd.exe 114 PID 5272 wrote to memory of 4520 5272 CVSYEK.exe 115 PID 4520 wrote to memory of 4192 4520 cmd.exe 119 PID 4192 wrote to memory of 1812 4192 IIEZKZ.exe 120 PID 1812 wrote to memory of 2560 1812 cmd.exe 124 PID 2560 wrote to memory of 2788 2560 WDPSYVP.exe 125 PID 2788 wrote to memory of 5880 2788 cmd.exe 129 PID 5880 wrote to memory of 5936 5880 ETQR.exe 130 PID 5936 wrote to memory of 3804 5936 cmd.exe 134 PID 3804 wrote to memory of 3076 3804 XUGC.exe 135 PID 3076 wrote to memory of 5336 3076 cmd.exe 139 PID 5336 wrote to memory of 5844 5336 MKTUWQ.exe 140 PID 5844 wrote to memory of 1592 5844 cmd.exe 144 PID 1592 wrote to memory of 2060 1592 DKC.exe 145 PID 2060 wrote to memory of 2636 2060 cmd.exe 149 PID 2636 wrote to memory of 1536 2636 MII.exe 150 PID 1536 wrote to memory of 4548 1536 cmd.exe 154 PID 4548 wrote to memory of 1232 4548 FLTWY.exe 155 PID 1232 wrote to memory of 4648 1232 cmd.exe 159 PID 4648 wrote to memory of 2000 4648 CRELO.exe 160 PID 2000 wrote to memory of 4372 2000 cmd.exe 164 PID 4372 wrote to memory of 5256 4372 ACOB.exe 165 PID 5256 wrote to memory of 1572 5256 cmd.exe 169 PID 1572 wrote to memory of 4660 1572 BFSFDH.exe 170 PID 4660 wrote to memory of 4620 4660 cmd.exe 174 PID 4620 wrote to memory of 3928 4620 UXAQMI.exe 175 PID 3928 wrote to memory of 5156 3928 cmd.exe 179 PID 5156 wrote to memory of 2132 5156 GLHORJS.exe 180 PID 2132 wrote to memory of 3432 2132 cmd.exe 184 PID 3432 wrote to memory of 3308 3432 MGSPFY.exe 185 PID 3308 wrote to memory of 5348 3308 cmd.exe 189 PID 5348 wrote to memory of 1344 5348 RLCEVBD.exe 190 PID 1344 wrote to memory of 6088 1344 cmd.exe 194 PID 6088 wrote to memory of 1164 6088 SJQQ.exe 195 PID 1164 wrote to memory of 1740 1164 cmd.exe 199 PID 1740 wrote to memory of 1808 1740 BPVF.exe 200 PID 1808 wrote to memory of 4652 1808 cmd.exe 204 PID 4652 wrote to memory of 980 4652 ZZY.exe 205 PID 980 wrote to memory of 5696 980 cmd.exe 209 PID 5696 wrote to memory of 1552 5696 PQHMUK.exe 210 PID 1552 wrote to memory of 1852 1552 cmd.exe 214 PID 1852 wrote to memory of 3956 1852 RLQOOVI.exe 215 PID 3956 wrote to memory of 4188 3956 cmd.exe 219 PID 4188 wrote to memory of 2112 4188 QWBE.exe 220 PID 2112 wrote to memory of 5644 2112 cmd.exe 224 PID 5644 wrote to memory of 2516 5644 XMC.exe 225 PID 2516 wrote to memory of 5732 2516 cmd.exe 229 PID 5732 wrote to memory of 5360 5732 CRM.exe 230 PID 5360 wrote to memory of 6028 5360 cmd.exe 234 PID 6028 wrote to memory of 3896 6028 LROY.exe 235 PID 3896 wrote to memory of 4676 3896 cmd.exe 239 PID 4676 wrote to memory of 2672 4676 MUSTCN.exe 240 PID 2672 wrote to memory of 3520 2672 cmd.exe 244 PID 3520 wrote to memory of 1568 3520 BPJG.exe 245 PID 1568 wrote to memory of 4840 1568 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f1da274b2731c9d7620b4f249ea02fe1_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\SysWOW64\UGI.exeC:\windows\system32\UGI.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMILOB.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\AMILOB.exeC:\windows\AMILOB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIEZKZ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\IIEZKZ.exeC:\windows\system\IIEZKZ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDPSYVP.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\WDPSYVP.exeC:\windows\WDPSYVP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\DKC.exeC:\windows\DKC.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MII.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\SysWOW64\MII.exeC:\windows\system32\MII.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\CRELO.exeC:\windows\CRELO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLHORJS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\GLHORJS.exeC:\windows\system32\GLHORJS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGSPFY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\windows\MGSPFY.exeC:\windows\MGSPFY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQHMUK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:980 -
C:\windows\PQHMUK.exeC:\windows\PQHMUK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\XMC.exeC:\windows\XMC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\CRM.exeC:\windows\CRM.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LROY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\LROY.exeC:\windows\LROY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPJG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\BPJG.exeC:\windows\BPJG.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTPH.exe.bat" "66⤵PID:3116
-
C:\windows\SysWOW64\LTPH.exeC:\windows\system32\LTPH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "68⤵PID:1960
-
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe69⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHVAS.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\windows\CHVAS.exeC:\windows\CHVAS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QRERG.exe.bat" "72⤵PID:3588
-
C:\windows\SysWOW64\QRERG.exeC:\windows\system32\QRERG.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXRGR.exe.bat" "74⤵PID:3620
-
C:\windows\SysWOW64\YXRGR.exeC:\windows\system32\YXRGR.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAUBXYB.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5780 -
C:\windows\system\YAUBXYB.exeC:\windows\system\YAUBXYB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNZ.exe.bat" "78⤵PID:1132
-
C:\windows\TNZ.exeC:\windows\TNZ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1832 -
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLM.exe.bat" "82⤵PID:4856
-
C:\windows\system\BLM.exeC:\windows\system\BLM.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "84⤵PID:3176
-
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe85⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXS.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3420 -
C:\windows\SysWOW64\LXS.exeC:\windows\system32\LXS.exe87⤵
- Executes dropped EXE
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "88⤵PID:6048
-
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXCUJWH.exe.bat" "90⤵PID:3784
-
C:\windows\system\IXCUJWH.exeC:\windows\system\IXCUJWH.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "92⤵PID:4920
-
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBNMXO.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2124 -
C:\windows\system\GBNMXO.exeC:\windows\system\GBNMXO.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMGIPWP.exe.bat" "98⤵PID:5396
-
C:\windows\system\LMGIPWP.exeC:\windows\system\LMGIPWP.exe99⤵
- Executes dropped EXE
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPJL.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1156 -
C:\windows\system\EPJL.exeC:\windows\system\EPJL.exe101⤵
- Executes dropped EXE
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONPG.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4332 -
C:\windows\system\ONPG.exeC:\windows\system\ONPG.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GITBPK.exe.bat" "104⤵PID:5660
-
C:\windows\SysWOW64\GITBPK.exeC:\windows\system32\GITBPK.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFHWF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5268 -
C:\windows\SysWOW64\QFHWF.exeC:\windows\system32\QFHWF.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBLFHSZ.exe.bat" "108⤵PID:5840
-
C:\windows\LBLFHSZ.exeC:\windows\LBLFHSZ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWPJ.exe.bat" "110⤵PID:1560
-
C:\windows\EWPJ.exeC:\windows\EWPJ.exe111⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMW.exe.bat" "112⤵PID:6132
-
C:\windows\PMW.exeC:\windows\PMW.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEYLKFF.exe.bat" "114⤵PID:4180
-
C:\windows\system\MEYLKFF.exeC:\windows\system\MEYLKFF.exe115⤵
- Executes dropped EXE
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCLFS.exe.bat" "116⤵PID:5440
-
C:\windows\OCLFS.exeC:\windows\OCLFS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASSF.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5464 -
C:\windows\ASSF.exeC:\windows\ASSF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFXXOX.exe.bat" "120⤵PID:2392
-
C:\windows\SysWOW64\VFXXOX.exeC:\windows\system32\VFXXOX.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-